Privacy Policy
Ce document est fourni uniquement en anglais.
Effective date: 10 July 2026 · Data controller: Sejder AB, org. no. 559554-8164, Sweden · [email protected]
1. What this site publishes
Gavroux publishes technical information about company domains: DNS records, TLS certificate metadata, email-authentication configuration (SPF/DMARC/DKIM), detected web technologies, SEO characteristics and AI-crawler directives, plus company name, country and registry number from official public company registries. This is information about organizations and their infrastructure, collected exclusively from publicly accessible sources. As part of scanning a company’s own website we may also record business contact details it publishes there (such as a contact email address or phone number). We do not build behavioural profiles of private individuals; where such contact details relate to a person, we process them under legitimate interest (section 2) with the unconditional opt-out below (section 3).
2. Legal basis
Where registry data incidentally contains personal data (for example a sole trader whose company name is their own name), we process it under legitimate interest (GDPR Art. 6(1)(f)): informing the public about the security posture of the European web, based on data the organizations themselves make publicly available. We balance this against the interests of the persons concerned — and back it with an unconditional, fast opt-out (below).
3. Opt-out — removal within 48 hours
If you want your domain or company removed from the public site, email [email protected] with the domain name, preferably from an address at that domain (so we can verify you represent it). We remove the public pages within 48 hours and exclude the domain from future publication. No justification is required.
4. Data you give us directly
If you email us or purchase a report, we process your email address and the contents of your message to answer and deliver — legal basis: contract (Art. 6(1)(b)). Purchase records are kept as required by Swedish accounting law. We never sell or share your contact details.
5. Cookies, analytics & operational logs
The site works without tracking cookies. We use only technically necessary storage and privacy-respecting, aggregate traffic metrics (via our CDN). No advertising trackers, no cross-site profiling. When you request an on-demand scan we store the requesting IP address with that request, used only to rate-limit abuse; calls to our AI (MCP) endpoint are logged for reliability. These operational logs are not used to profile you.
6. Recipients & transfers
The site is served through Cloudflare (CDN) and hosted on Amazon Web Services in the EU (Stockholm region); both act as processors and data at rest stays in the EU/EEA. Web fonts are self-hosted and served from our own domain — no third-party font service is contacted when you load the site.
7. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, and object to processing — write to [email protected]. You can also complain to the Swedish Authority for Privacy Protection (IMY).
8. Changes
We may update this policy; the effective date above reflects the current version.