Privacy Policy

WebInspect (webinspect.dev) is operated by INSPIRING RESEARCH&INVENTIVE SOLUTIONS SRL, registration number J2023015414400 (Bucharest Trade Register), tax ID (CUI) RO48657227, with its registered office at Str. Radu Beller nr. 3-5, Sector 1, Bucharest, Romania (“we”, “us”). We are the controller of the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Romanian Law no. 190/2018.

For any question about this policy or your data, contact us at [email protected].

3.1 Account data

If you create an account we store:

• your email address (stored in lowercase);
• a password hash — your password is processed with the scrypt key-derivation function and a random per-user salt. We never store or log the plain-text password;
• the date your account was created and the date of your last login;
• a salted hash of the IP address used at sign-up, so we can limit how many accounts can be created from one network within 24 hours.

3.2 Login sessions

When you log in we set a wi_user cookie containing a long random token. Our database stores only a SHA-256 hash of that token, your user ID, and the session’s creation and expiry time. Logging out deletes the session immediately; expired sessions are deleted automatically.

3.3 Visitor analytics (only with your consent)

If you accept analytics cookies in the cookie banner, then while you browse WebInspect (except the operator’s admin area) your browser sends a small analytics request for each page view. If you reject them, or have not decided yet, no analytics request is sent, no analytics cookie is set and nothing in this section is recorded. Linked to a random visitor ID and session ID (see Cookies, section 5), we record:

• the page URL and title, the referring page, and any UTM campaign parameters in the URL;
• page timing measurements (load time, time to first byte, DOM interactive);
• the full user-agent string and what we derive from it — browser and version, operating system and version, device type (desktop / tablet / mobile / bot);
• your preferred browser language (the first entry of the Accept-Language header);
• a salted SHA-256 hash of your IP address and, derived from the IP at the time of the request, an approximate location (country, region, city, approximate latitude/longitude), the network operator (ASN / ISP), and heuristic flags indicating whether the address appears to belong to a VPN, proxy, Tor exit node or data centre;
• visit timestamps, number of visits, session duration, entry and exit page, and counts of pages and events;
• events such as inspections you run (inspector type, the target you entered, success or error, and duration).

Your raw IP address is not written to our database. To work out the approximate location we send it to an IP geolocation service (see section 6) at the time of the request. We also compare it against the public Tor exit-node list, which we download — your IP is not sent to the Tor Project.

3.4 Inspections and usage limits

To run an inspection, the target you enter (a URL, hostname, IP address or API endpoint, plus any request method, headers, body or credentials you add in the API Inspector) is sent to our servers, which then make requests to that target. Inspection results are returned to your browser; we do not keep a copy of them unless you publish a report (3.5) or use an AI feature (3.6). Request credentials you add in the API Inspector are used only to make that request and are not stored.

To enforce the free inspection allowance, we keep a usage ledger with one entry per inspection: the tool used, the time, and either your account ID (if logged in) or the salted hash of your IP address plus, if you accepted analytics cookies, your random visitor ID (if not). The ledger does not contain the target you inspected.

3.5 Published reports

When you choose to publish a report we store a snapshot of the inspection result, the target, scores, your chosen visibility (public, private or password-protected), display settings, the expiry you chose, a scrypt hash of the report password (if any), the number of views, and when it was last viewed. API reports are published with credentials redacted. If you are logged in when you publish, the report is linked to your account ID so you can find and delete it under Account settings and so it is erased with your account; otherwise it is not linked to you. Every report also gets a random manage token: we store only its hash, and your browser keeps the token (local storage, wi_report_manage_tokens) so you can delete the report later from the same browser without an account.

When someone opens, downloads or shares a published report we record a salted hash of their IP address, their country, the referring page, their device type and browser.

3.6 AI features

If you use an AI feature (explanations, fix suggestions, recommendations or chat), we send the relevant part of the inspection result (for example scores, detected issues, response headers, TLS or DNS data, and the target URL) and any message you type to the AI provider described in section 6. We log each AI request: your visitor and session IDs, the salted IP hash, your country, the target website, the feature and model used, token counts, estimated cost, timing and status, and a detailed record containing the full prompt sent (including the inspection data and your messages) and the AI’s response. The visitor ID and session ID are present only if you accepted analytics cookies. Do not paste secrets or personal data into the chat, and avoid putting API keys in URLs you ask the AI about.

3.7 Security and abuse prevention

To protect the service we keep short-lived, in-memory counters keyed by the hashed IP address (and, for login attempts, by email address). These counters are not written to the database and disappear within minutes or when the server restarts.

3.8 Data stored only in your browser

Your theme preference is kept in your browser’s local storage (wi-theme), a flag that the home-page intro animation has played is kept in session storage (wi_entrance_played), and the manage tokens of reports you published are kept in local storage (wi_report_manage_tokens). These stay on your device; a manage token is sent to us only when you ask to delete that report.

3.9 Contacting us

If you email us — including a notice about a published report through “Report this content” — we process your email address, your name if you give it, and the content of your message to reply and to handle the notice. When we act on a notice we may tell the publisher that a notice was received, but not who sent it, unless the law requires otherwise.

Where we rely on legitimate interests you have the right to object at any time (section 9). Where we rely on consent (analytics) you can withdraw it at any time via “Cookie settings” in the footer, which is as easy as giving it; this does not affect processing before the withdrawal. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automatic checks only stop further free inspections or AI requests when a usage limit is reached.

The cookies WebInspect itself sets are all first-party; we do not use advertising or cross-site tracking cookies. Strictly necessary cookies are always on. The one third-party exception is the home-page background video, described below.

We set analytics cookies (wi_vid, wi_sid) and record visitor analytics only if you opt in through the cookie banner (legal basis: your consent, Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive); you can withdraw at any time via “Cookie settings” in the footer, which immediately deletes those cookies, and rejecting analytics never limits your use of the inspectors — see our Cookie Policy.

Fonts. Pages load the Inter and JetBrains Mono typefaces from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Your browser therefore connects to Google’s servers, which receive your IP address and user-agent. We do not set Google cookies.

Home-page background video. The home page plays a background video served from the Pexels content network (videos.pexels.com). Your browser connects to Pexels’ servers, which receive your IP address and user-agent, and their CDN (Cloudflare) may set its own security / load balancing cookies on .pexels.com — __cf_bm (bot management, about 30 minutes) and _cfuvid (rate limiting, session). These are third-party cookies set by Pexels’ provider, not by us; we cannot read them.

You can also delete or block cookies in your browser settings. Blocking wi_user prevents logging in. Rejecting or deleting wi_vid neither limits your use of the inspectors nor resets the free inspection allowance, which is tracked by hashed IP address.

We share personal data only as needed to run the service:

• Hosting and infrastructure: [Hosting provider name and data-centre location] hosts our servers and database. [CDN / reverse-proxy provider, e.g. Cloudflare, Inc. — confirm] may sit in front of the site as a CDN and reverse proxy and processes request data, including IP addresses, as it passes through.
• AI provider: AI features are provided through OpenRouter, Inc. (United States), an AI model gateway, which forwards prompts to the developer of the AI model selected by the operator (for example providers of large language models based in the United States). The operator may change the provider or model. These parties receive the AI prompt content described in section 3.6, but not your email address.
• IP geolocation: ipwho.is (IP geolocation API) receives visitors’ IP addresses so we can derive an approximate location and network operator. It is also used to locate the IP addresses of inspection targets.
• Fonts: Google Fonts (Google LLC / Google Ireland Ltd.), as described in section 5.
• Home-page video: Pexels (and its CDN provider), which receives your IP address and user-agent when the background video loads, as described in section 5.
• Inspection targets and lookup services: to inspect a target our servers contact that target directly and may query public lookup services about the target (DNS-over-HTTPS resolvers such as Cloudflare, Quad9 and AdGuard, the crt.sh certificate-transparency database, HackerTarget ASN lookups and the RIPE RPKI validator). These receive the target you entered and the request details you configured — not your IP address or account details.
• People you share reports with: a public report can be viewed by anyone who has its link, and may appear in search engines unless you or the operator turn indexing off. Password-protected reports require the password; private reports are not viewable through the public link.
• Authorities and advisers: where required by law or to establish, exercise or defend legal claims.

The promotional banner and the “Built with Biela” link in the footer are plain links to biela.dev. No data is sent to biela.dev unless you click them.

Some recipients are located, or process data, outside the European Economic Area — in particular the AI gateway and AI model developers (United States), and possibly the IP geolocation, font and CDN providers.

Where personal data is transferred outside the EEA, we rely on a European Commission adequacy decision (including the EU–U.S. Data Privacy Framework where the recipient is certified) or on the Commission’s Standard Contractual Clauses, together with any supplementary measures needed. You can ask us for more information about these safeguards at [email protected].

Deletion is automatic: a clean-up job runs at least once an hour and removes or minimises data once its period below has passed. You can also ask us to delete data earlier (section 9).

We may keep data longer only where the law requires it or where it is needed to establish, exercise or defend legal claims (for example evidence of abuse of the Service), and only for as long as that applies.

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• rectification of inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability — receiving data you gave us in a machine-readable format;
• object to processing based on legitimate interests, including analytics;
• withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal;
• lodge a complaint with a supervisory authority (see below).

Self-service

• Download my data (access and portability): logged-in users can download a JSON file with their email, account dates, login sessions, inspection usage and the reports published from the account, on the Account settings page.
• Delete account (erasure): on the same page, confirm with your password to delete your account immediately, together with your login sessions, the reports published from it and your usage history. This also logs you out.
• Delete a report: open the report and use Delete — available when you are logged in to the account that published it, or in the browser you published it from.
• Withdraw analytics consent: “Cookie settings” in the footer, at any time.

Other requests

1. Email [email protected] from the address registered to your account, if you have one.
2. For analytics and other data linked to a visitor ID rather than an email, include the value of your wi_vid cookie (visible in your browser’s developer tools) so we can find your records. For a published report you can no longer delete yourself (for example from another browser), include its link.
3. We reply within one month. This can be extended by two further months for complex requests; we will tell you if so. We may ask for information to confirm your identity.

Supervisory authority

You may complain to the Romanian data protection authority — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, Bucharest, Romania, www.dataprotection.ro — or with the authority in the EU country where you live or work. We would appreciate the chance to address your concern first.

Measures built into WebInspect include:

• passwords hashed with scrypt and a per-user salt, verified in constant time;
• login session tokens stored only as hashes, in HttpOnly cookies marked Secure over HTTPS;
• IP addresses stored only as salted SHA-256 hashes;
• AI provider credentials encrypted at rest (AES-256-GCM);
• protection against requests to private or internal networks, rate limits and sign-up limits;
• an administrator area protected by signed, time-limited sessions.

No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify the ANSPDCP and, where required, you.

WebInspect is not intended for children under 16, and you must not create an account if you are under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy when the service or the law changes. The “Last updated” date at the top shows the current version. For significant changes we will give reasonable notice on the site before they apply.

INSPIRING RESEARCH&INVENTIVE SOLUTIONS SRL, Str. Radu Beller nr. 3-5, Sector 1, Bucharest, Romania. Registration number J2023015414400 (Bucharest Trade Register), tax ID (CUI) RO48657227. Email: [email protected].