Privacy Policy

1. Who is responsible

ONLINE PORQUPINE LTD (company number 17108652, West Mersea, Colchester, Essex, United Kingdom) is the data controller for webguard247.com. Contact: hello@onlineporqupine.com.

2. What we collect

• Scan requests — the website address you enter, the time of the scan and the result. We keep server logs of these to run the service, prevent abuse and improve our checks.
• Account details — your email address and a hashed password (or a magic-link login), which plan you are on, and when you signed up. Stored with our authentication provider, Supabase.
• Payment details — handled entirely by Stripe. We receive your name, email, the last four digits of your card, and a Stripe customer reference. We never see or store your full card number.
• Technical data — IP address, browser type and basic request logs, collected automatically by our hosting provider, Netlify.
• Messages — anything you send us by email.

We do not collect special-category data and we do not buy data about you from anyone.

3. Why we use it (lawful basis)

• To run the scan and show you the result — performance of a contract (or steps you ask for before one).
• To create and secure your account and unlock what you have paid for — contract.
• To take payment and keep accounting records — contract and legal obligation.
• To prevent abuse, rate-limit traffic and keep the service secure — legitimate interests.
• To email you about your account, receipts and important service changes — contract. We only send marketing email if you have opted in, and every such email has an unsubscribe link.

4. Who we share it with

Only the providers we need to run the service, each under their own data-processing terms: Netlify (hosting and serverless functions), Supabase (accounts and database), Stripe (payments) and Google Fonts (typefaces, which may log your IP address). We do not sell personal data and we do not share it with advertisers. We will disclose data if the law requires it.

5. International transfers

Some of these providers process data in the United States or elsewhere outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Agreement, UK-approved standard contractual clauses, or an adequacy decision.

6. Cookies

We use only the cookies and browser storage needed to keep you logged in and to remember a scan in progress. We do not use advertising or tracking cookies. Stripe sets its own cookies on its checkout page for fraud prevention.

7. How long we keep it

• Scan logs: up to 12 months, then deleted or anonymised.
• Account data: for as long as your account exists, and up to 30 days after you close it.
• Payment and invoice records: 6 years, as HMRC requires.

8. Your rights

Under UK GDPR you can ask us to: tell you what personal data we hold about you; correct it; delete it; restrict or object to how we use it; or give you a copy in a portable form. You can also withdraw consent for marketing at any time. Email hello@onlineporqupine.com and we will respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

9. Security

The site is served over HTTPS, passwords are stored hashed by Supabase, card details never touch our servers, and the database table that records your plan can only be changed by our server, not from a browser. No system is perfectly secure; if we ever discover a breach affecting your data we will tell you and the ICO as the law requires.

10. Changes

If we change this policy we will update the date at the top and, for significant changes, email account holders.