Privacy Policy

ContentHub s.r.o. ("Company", "PreflightX", "we", "us", or "our") operates https://preflightx.io (the "Service"). We are the controller of personal information used to manage your account and respond to your support requests. Our role in relation to personal data in scan targets depends on the circumstances of the processing and applicable law. Our company and contact details appear below.

1. Information we collect

Account information

We process your email address, authentication and account identifiers, subscription or plan status, and account creation and activity timestamps. Supabase supports our account authentication and database services.

Scan information

We process submitted URLs or domains and the publicly accessible resources needed for scanning. Scan data can include findings, severities, security scores and grades, scan timestamps, technical metadata, saved scan history for registered users, and scan-to-scan verification metadata. Public resources and findings can incidentally contain personal information or exposed sensitive information.

Anonymous scans are processed to return results and are not added to a registered user's scan history. An anonymous scan's results are kept only in the server's working memory for your browser session, which ends about an hour after the scan, and are not written to storage unless you ask for your report by email (below); apart from that we keep only aggregate counts that identify no site. An anonymous scan does not mean that no technical data is processed.

Uploaded source code

If you upload a ZIP archive of your source code for a code scan, we process its contents only in our server's working memory, to scan them and show you the results. The archive, its files, their contents and their names are not written to storage or to our database, not kept in logs, not sent to any other service and not used to train anything; they are discarded when the scan ends. The results are shown only in your browser, are not saved to your scan history and cannot be emailed. Render, our hosting provider, processes the upload as part of running the Service. We process your IP address to limit how many code scans one network can start. Only upload code you own or are authorized to submit; avoid uploading files that hold real secrets where you can, and treat any credential the scan reports as exposed.

Emailed scan reports

After an anonymous scan you can ask for your full report by email by ticking “Email me my scan report”. We then process your email address, the time you asked, and a copy of that scan's free report: the scanned host name, grade, defense score, counts per severity and, for each finding, its title, severity and plain-language explanation. The report copy never contains exact locations, technical evidence, fixes or AI repair prompts. We use this to show you the full report and a private link to it on screen and, when we send report emails, to send you one email with that link, because you asked for it. The link stops working 30 days after you asked and the copy is deleted within a day after that; anyone with the link can read the report, so share it with care. At most three report emails go to one address a day: past that, and to an address that has unsubscribed, we still save the report and show you its link on screen, but send no email.

Occasional product updates and security tips are separate and optional: we send them only if you also tick “Also send me occasional product updates and security tips”, which is never ticked for you, and we record when you did. You can unsubscribe at any time with the link in any of our emails. After that we send your address no email of any kind: no security tips and no scan reports, even if a report is requested for it again; a report you request is still shown to you on screen. Ticking the box again later does not undo an unsubscribe. We keep your address and the record of your choices so that they stay respected; to have your address deleted, email hello@preflightx.io.

When email is enabled, Resend sends these emails for us as our processor. If you open a report's link while logged in to an account with the same confirmed email address, that report is linked to your account.

Only submit apps, websites or systems you own or are explicitly authorized to test. Avoid submitting personal information, credentials or secrets in URLs or support messages unless necessary to resolve your request.

Payments and support

Stripe processes card and billing information for purchases. We receive the purchase or subscription status, transaction references, the amount and currency paid, a link to Stripe's receipt and limited billing details needed to provide and support your paid access. PreflightX does not receive or store full card numbers.

If you contact us or request updates about Pro, we process your email address and the information you provide, including relevant account or scan references, to respond to your request.

Technical information and aggregate usage

We process IP addresses and request timestamps for rate limiting and abuse prevention. Our application and hosting infrastructure may also process browser or device information and access, error and security logs where those are available. Referrer information may be received when supplied by your browser; it is not required for scanning.

We use first-party aggregate counters for events such as page views, scan activity and interactions with plan features. These counters do not store submitted URLs, IP addresses or session tokens. Essential session state helps avoid counting the same event repeatedly. We do not currently use optional third-party analytics cookies. See our Cookie Policy.

When enabled, we also use PostHog for limited, cookieless product analytics to understand how the Service is used, from a visit through scanning, account creation, verification and interest in Pro, and to improve it. We send only named product events, such as that a scan started or completed, that the Pro prices were shown, that a Pro plan was chosen, or that checkout started or returned, with limited non-content details where relevant: plan category, the Pro plan and its price (Monthly or Lifetime), scan grade, aggregate finding counts by severity, verification status and which area of the page a Pro button was in. If you arrive through a campaign link, the first event also carries that link's campaign labels (utm_source, utm_medium, utm_campaign and utm_content), only when they are short plain words; anything else in them is dropped. We also send a page view when our main page loads and a page leave when you leave it, so we can measure visits, bounce rate and time on page. These carry only the page's address without any query string or fragment (for example, https://preflightx.io/), the domain name of the site that linked to it, if any (not the full linking address), and, on leaving, time on the page and how far it was scrolled. We do not intentionally send PostHog email addresses, account or authentication identifiers, submitted URLs or domains, query strings or fragments of page addresses other than those campaign labels, scan identifiers, finding content, technical evidence, remediation instructions, AI repair prompts, payment card details or secrets. Automatic click tracking, form capture and session recording are disabled.

When Stripe confirms a Pro payment, a cancelled or ended subscription, or a refunded Lifetime purchase, our server also sends PostHog one event saying so, with the plan, the amount and currency, the area of the page where the purchase started and its campaign labels. It carries an identifier derived one-way from the payment record, which PostHog cannot link to you, your account or your visits, and PostHog is told not to build a profile from it or look up a location. The same campaign labels and page area are stored with the payment at Stripe.

This analytics configuration does not store an analytics identifier in cookies, local storage or session storage. As part of delivering each request, PostHog receives your IP address and browser user-agent, and combines them with a salt that PostHog rotates daily to derive a visitor identifier on its servers, so visits are not linked across days. Cookieless does not mean that no personal data is processed. Our integration does not load analytics when your browser sends a Global Privacy Control or Do Not Track signal. This analytics is subject to the legal bases and rights described below.

2. Why we use information

We use information to:

• provide the Service, authenticate users and manage accounts;
• perform scans, deliver reports, save registered users' history and compare scans or verify remediation;
• provide Free and Pro functionality and administer subscriptions when paid billing is enabled;
• prevent abuse, fraud and unauthorized security testing, and protect users and the Service;
• troubleshoot errors, provide support and improve service quality;
• meet legal obligations and establish, exercise or defend legal claims.

3. Legal bases in the EEA

We rely on contract performance where processing is necessary to provide the Service you request; legitimate interests in maintaining, securing and improving the Service, subject to your rights and interests; legal obligations where applicable; and consent where required. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

4. Scan Data and Security Analysis

Our current URL scanner performs read-only checks against publicly accessible resources and does not intentionally modify target applications. It makes network requests to analyze the submitted target; public accessibility alone does not establish authorization to test it.

Results are informational and may contain false positives, false negatives or incomplete findings. A score or grade is not a certification of security. You remain responsible for reviewing findings, testing proposed changes, remediating issues and obtaining appropriate professional security testing.

5. Personal Data in Scan Targets

Submitted URLs and publicly accessible resources may incidentally contain personal data relating to third parties. You are responsible for ensuring that you are authorized and have a lawful basis to submit the target and any such data for scanning.

PreflightX processes such information only as necessary to perform the requested scan, provide the report, maintain authorized scan history and comparisons, protect the Service, prevent abuse, and comply with law.

Avoid submitting personal data, credentials, secrets, or sensitive information in URLs or support messages unless necessary for the requested scan or support.

6. Sharing and service providers

We do not sell personal data or share it for cross-context behavioral advertising.

We use Supabase for database and authentication services and Render for hosting. These providers process information needed to operate their services. Stripe will process payments and related fraud-prevention information when paid billing is enabled and you use payment features.

When cookieless analytics is enabled, PostHog processes the limited analytics information described above for us. See PostHog's Privacy Policy.

We may disclose relevant information to professional advisers or authorities where needed to comply with law, respond to valid legal requests, prevent fraud or abuse, or protect rights and safety. If our business is reorganized, acquired or transferred, relevant information may be transferred with appropriate safeguards and any notice required by law.

7. International transfers

Our company is based in Slovakia. Some service providers may process information outside the European Economic Area. Where legally required, transfers must be supported by appropriate mechanisms, such as an applicable adequacy decision or approved contractual safeguards. Contact us for information about safeguards relevant to your data.

8. Retention and deletion

We keep personal information only for as long as reasonably necessary for the purposes described here, considering account status, service delivery, security, fraud prevention and applicable legal obligations. Different records may be needed for different periods; we do not promise a single fixed retention period for all data.

You may request account or data deletion at hello@preflightx.io. We may verify your identity and retain information where lawful and necessary for security, fraud prevention, legal obligations or legal claims. Backup copies may remain until their normal replacement cycle, subject to appropriate restrictions.

9. Your privacy rights

Depending on applicable law, EEA individuals may request access to personal data, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. These rights have legal conditions and exceptions.

Contact hello@preflightx.io to exercise your rights. You may complain to your local supervisory authority or Slovakia's Úrad na ochranu osobných údajov SR at dataprotection.gov.sk.

Residents of certain US states may have rights to access, correct or delete personal information, obtain a copy, or appeal a decision where applicable law provides them. Applicability depends on the law and circumstances; we do not represent that every state privacy law applies to PreflightX. We do not sell personal information or share it for cross-context behavioral advertising, and we do not discriminate against you for exercising applicable privacy rights.

10. Security

We use reasonable safeguards designed to protect information, including HTTPS/TLS for the hosted Service, authentication controls, HttpOnly authentication cookies, and database access controls, including row-level security where applicable. Administrative access is restricted to authorized operators. No internet service or security measure can guarantee absolute protection.

11. Children

The Service is intended for people aged 18 or older. We do not knowingly collect personal information from children under 18. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

12. Changes and contact

We may update this policy as the Service or legal requirements change. We will update the date above and provide additional notice where required. For privacy questions or requests, contact the company below.