Privacy policy
Last updated 2026-10-21
This policy explains what personal data Offensly processes when you use offensly.com, blog.offensly.com, dashboard.offensly.com and api.offensly.com (together “Offensly”), why, for how long, who helps us process it, and what rights you have. It applies to visitors, people who run free checks and account holders.
1. Who is responsible
The controller of your personal data is Lukáš Tejkl, č.p. 104, 517 36 Olešnice, Czech Republic, IČO 21912131, not a VAT payer (“we”, “us”). For anything about your data, including exercising your rights, write to contact@offensly.com. We have not appointed a data protection officer because the law does not require one for a service of our size; Lukáš Tejkl handles privacy requests personally.
2. What we process, why and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Domains you check, the check results and when you ran them | Run the check and show you the result; with an account, keep your history | Performance of a contract, Art. 6(1)(b) |
| A keyed hash of your IP address (changes every day and cannot be turned back into the address) and a random identifier in a cookie | Enforce the daily limit of free checks and stop automated abuse | Legitimate interest in protecting the service, Art. 6(1)(f) |
| Your name, email address and Google account identifier from “Continue with Google” | Create your account, sign you in and contact you about it | Performance of a contract, Art. 6(1)(b) |
| Projects: domains and IP addresses (with ports) you add, verification tokens, the DNS or HTTP evidence we find, the test scope and time window you confirm | Verify that you control a domain or an IP address, run checks and tests only within what you allowed | Performance of a contract, Art. 6(1)(b) |
| Proofs of permission: the confirmed scope, your account, the verification evidence and a qualified electronic timestamp | Prove, if ever questioned, that each test was authorised by the owner of the domain or IP address | Legitimate interest in being able to demonstrate lawful testing and defend legal claims, Art. 6(1)(f) |
| Penetration test results and findings, including the state you give each finding | Show you what was found, compare retests with earlier runs | Performance of a contract, Art. 6(1)(b) |
| Billing data: what you bought, when, the amount, your Stripe customer identifier. Card details go to Stripe only; we never see them. | Provide what you paid for, keep accounting records (Stripe takes the payment and issues invoices) | Contract, Art. 6(1)(b); legal obligation under tax and accounting law, Art. 6(1)(c) |
| Service emails: your address, what we sent and whether it was delivered | Tell you when a domain verification disappears or a test finishes | Performance of a contract, Art. 6(1)(b) |
| Technical logs: errors, security events and administrative changes (no passwords or tokens) | Keep Offensly running and secure, investigate incidents | Legitimate interest, Art. 6(1)(f) |
| Pages visited, clicks on main buttons, sign-ups, device type and approximate location (Google Analytics) | Understand which pages help people and improve them | Your consent, Art. 6(1)(a) – only if you choose “Accept all” |
| Cookieless visit counts (Cloudflare Web Analytics): page, referrer, country, browser – no identifier | Know how much the site is used, including by visitors who decline analytics | Legitimate interest, Art. 6(1)(f) |
We do not sell personal data, do not use it for advertising and do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The domains you check are not published or shared with other customers.
Where we rely on legitimate interest, we have weighed it against your interests; you may object at any time (see section 7).
3. Where the data comes from
From you (what you enter or upload), from Google when you sign in with it (name, email, account identifier), from Stripe about payments, and from public sources we check for you (public DNS records and, for verified domains, your website).
4. Who processes data for us
We use these providers. Each processes data only on our instructions under a data processing agreement.
- Cloudflare, Inc. (USA, with servers worldwide) – hosting of all our sites and their database and file storage, protection against attacks, Turnstile bot checks, Zaraz (loads Google Analytics from our own domain, only with consent), Web Analytics and access control for our administration.
- Google Ireland Limited / Google LLC – “Continue with Google” sign-in and, only with your consent, Google Analytics 4.
- Stripe – sells paid tests to you as merchant of record through its Link service (payment, tax, receipts and invoices) and runs the billing portal. As the seller of record, Stripe is an independent controller for your payment and billing data under its own privacy policy (link.com/privacy).
- Resend (Plus Five Five, Inc., USA) – sending service emails.
- Latvian State Radio and Television Centre (LVRTC) (Latvia, EU qualified trust service provider) – qualified electronic timestamps for proofs of permission. Only a cryptographic fingerprint of the proof is sent, never its content.
- Our own testing servers, operated by us – run the checks and tests. They receive the domain or IP address, the confirmed scope and nothing about you personally.
We also disclose data to authorities or courts where the law requires it, and to professional advisers (such as an accountant or lawyer) who are bound by confidentiality.
5. Transfers outside the EU
Cloudflare, Google and Resend may process data in the United States or other countries outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.
6. How long we keep it
- Daily counters for free checks (including the IP hash): deleted after 2 days.
- The anonymous cookie identifier: up to 1 year in your browser; you can delete it at any time.
- Sign-in sessions: until you sign out, at most 30 days.
- Your account, check history, projects, test results and findings: until you delete your account or the project. Deleting the account removes all of them.
- Proofs of permission: for the life of the project and then up to 3 years after the last test it covers, the general limitation period for claims, unless a dispute requires longer.
- Invoices and accounting records: 10 years, as Czech tax and accounting law requires.
- Technical logs: up to 12 months.
- Backups: overwritten within 30 days.
- Google Analytics data: 14 months, then deleted by Google.
7. Your rights
Under the GDPR you have the right to:
- access your data and get a copy – the dashboard’s Account → Export my data downloads everything we hold about your account as one file;
- rectification of inaccurate data – your name and email come from your Google account and are updated each time you sign in;
- erasure – Account → Delete account deletes your account and its data at once, except what we must keep by law (invoices) and proofs of permission, which we keep for the period in section 6 to show that past tests were allowed;
- restriction of processing and data portability;
- object to processing based on legitimate interest;
- withdraw consent to analytics at any time under Cookie settings in the footer; this does not affect processing before the withdrawal.
Write to contact@offensly.com for anything the dashboard does not cover. We answer within one month. You may also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or to the authority in the EU country where you live or work.
8. Security
All connections use HTTPS. Sign-in sessions use random tokens stored only as hashes; we never store passwords because sign-in goes through Google. IP addresses are not stored, only a daily changing keyed hash. Access to our administration requires a separate identity check. Proofs of permission carry qualified timestamps so they cannot be changed unnoticed.
9. Children
Offensly is meant for people responsible for websites and domains and is not directed at children. Accounts are for people aged 16 or older.
10. Changes
We may update this policy when the service or the law changes. We show the date of the latest version at the top and tell account holders about material changes by email or in the dashboard before they take effect.