CheckWink Privacy Policy

1. Our Approach to Privacy

CheckWink is designed to analyze publicly accessible websites while limiting the amount of personal, sensitive, and confidential information processed through the Service.

Our approach is to:

• collect and use information only for identified and legitimate purposes;
• limit collection to information reasonably necessary to operate, secure, and improve the Service;
• avoid collecting sensitive or confidential information that CheckWink does not need;
• keep audit reports private by default;
• use reasonable technical and organizational safeguards;
• limit retention according to operational and legal needs;
• provide clear privacy choices for optional analytics; and
• not sell or rent personal information.

CheckWink is not designed for private websites, authenticated pages, passwords, authentication credentials, access tokens, password-reset links, or other confidential information.

2. Information You Provide to CheckWink

Website URLs

When you request an audit, you provide the URL of the website you want CheckWink to analyze.

CheckWink normalizes submitted URLs and uses technical controls designed to reject URLs containing information that appears to be a password, authentication credential, access token, reset token, API key, secret, or similar sensitive value.

You should submit only URLs for webpages that are publicly accessible.

Communications

If you contact CheckWink, we may receive information such as:

• your email address;
• your name, if you provide it;
• the contents of your message; and
• other information you voluntarily provide.

CheckWink does not currently require a user account to perform an audit.

3. Website Audit Information

When you ask CheckWink to analyze a website, CheckWink may automatically retrieve and process publicly accessible technical and content information from the website and pages discovered during the audit.

Depending on the audit, this may include:

• website and page URLs;
• redirects;
• HTTP status information and response headers;
• page titles and metadata;
• headings;
• canonical and language information;
• robots.txt and sitemap information;
• internal links;
• image and alternative-text signals;
• forms and form-control signals;
• structured data;
• security and configuration signals;
• cookie-security attributes;
• accessibility signals;
• website performance information;
• Lighthouse and PageSpeed information; and
• other technical information necessary to produce the requested audit and recommendations.

CheckWink may temporarily retrieve HTML, robots.txt files, sitemap information, headers, and other publicly accessible website content to perform an audit.

Raw webpage HTML is not intentionally retained as part of the stored audit record.

CheckWink does not currently take or store screenshots of websites it audits.

CheckWink does not submit forms on websites it audits.

4. Sensitive URLs and Confidential Information

Public webpages may occasionally contain URLs that include confidential or sensitive parameters.

CheckWink uses technical controls designed to prevent common credential, authentication, secret, password-reset, and token parameters from being accepted, retained, or transmitted through the normal audit process.

You should nevertheless not submit:

• private or authenticated URLs;
• passwords;
• authentication credentials;
• API keys;
• access or authentication tokens;
• password-reset or account-recovery links;
• confidential business information;
• sensitive personal information; or
• links that provide access to information that is not intended to be public.

5. Information Processed Automatically When You Visit CheckWink

When you access CheckWink, our infrastructure and service providers may automatically process technical information needed to operate, deliver, and secure the Service.

Depending on your interaction with the Service and your privacy choices, this may include:

• IP address and network information;
• browser and device information;
• operating-system information;
• date and time of access;
• CheckWink pages requested;
• security and diagnostic information;
• performance information;
• TrustedSite visit-session and trustmark-display information on eligible public pages; and
• analytics information where you have chosen to allow optional analytics.

CheckWink's application is designed not to intentionally store raw visitor IP addresses in the audit database for ordinary audit processing.

Our hosting and infrastructure providers may independently process network information required to deliver and secure their services.

6. How We Use Information

We may use information processed through CheckWink to:

• perform website audits;
• discover and analyze publicly accessible webpages;
• generate scores, findings, explanations, and recommendations;
• produce and provide audit reports;
• operate and maintain the Service;
• secure CheckWink and prevent abuse;
• enforce rate and usage limits;
• troubleshoot errors and improve reliability;
• respond to support requests;
• maintain aggregate, non-identifying counts of completed website audits;
• understand product usage where optional analytics consent has been provided;
• improve CheckWink's functionality and user experience;
• comply with applicable legal obligations;
• enforce our agreements and policies; and
• establish, exercise, or defend legal claims.

We will not materially expand the purposes for which personal information is used without providing additional notice or obtaining consent where required by applicable law.

7. Automated Analysis and Artificial Intelligence

CheckWink performs automated technical analysis of websites.

Certain features may refer to concepts such as AI Discoverability. At present, these checks are based on technical rules and signals analyzed by CheckWink.

CheckWink does not currently send website audit content to a general-purpose artificial intelligence or large-language-model provider such as OpenAI, Anthropic, or Gemini for analysis or model training.

If this practice materially changes, we will review and update this Privacy Policy as appropriate before or when such functionality is introduced.

8. Google PageSpeed Insights

CheckWink uses Google PageSpeed Insights to perform certain website performance and Lighthouse analyses.

When PageSpeed analysis is performed, CheckWink may transmit selected publicly accessible website URLs to Google.

CheckWink does not intentionally include your name, email address, private report-access capability, or CheckWink account information in those PageSpeed requests.

Google may independently process technical request information according to its own privacy and service terms.

9. Audit Reports

CheckWink audit reports are designed to be private by default.

Private reports use randomized access information and a confidential report capability.

CheckWink also applies technical protections intended to prevent private report pages from being indexed, cached, or exposed through ordinary referrer information.

Third-Party Code on Private Reports

Google Analytics, Microsoft Clarity, and the TrustedSite certification code are not loaded on private CheckWink report pages.

Private report pages use additional technical restrictions designed to prevent third-party analytics scripts, public trustmark code, and related network connections from running on those pages.

Sharing Reports

A valid report link may be shared.

Anyone who obtains a complete valid private-report link may be able to access that report while the link remains valid.

You should therefore treat private report links as confidential.

Report Access Period

Private report access is generally available for approximately 7 days, unless a different period is displayed or required for a particular feature.

Deleting a Report

Where the report-deletion functionality is available, a person possessing a valid report capability may revoke access to the report.

Revocation is intended to take effect immediately.

Certain underlying audit records may remain temporarily until the normal retention process removes them.

10. Retention

CheckWink retains information only for as long as reasonably necessary for the purposes for which it is processed, including operation, security, troubleshooting, and applicable legal obligations.

Our current technical retention practices include:

• PageSpeed cache: generally usable for approximately 20 minutes;
• private report-access grants: generally approximately 7 days;
• eligible completed audit executions: generally approximately 30 days.

A scheduled retention process runs regularly to remove eligible expired information from our operational database.

CheckWink may retain an aggregate count of completed website audits for longer-term operational and historical measurement. This aggregate count does not contain submitted website URLs, report findings, contact information, payment information, or private report-access information.

Certain information may be retained longer where reasonably necessary to:

• investigate abuse or security incidents;
• comply with legal, regulatory, tax, or accounting obligations;
• resolve disputes;
• establish or defend legal claims; or
• satisfy legitimate infrastructure, backup, or security requirements.

Backup copies may remain for a limited period after information has been removed from active systems and are removed according to the applicable backup-retention process.

11. Analytics and Privacy Choices

CheckWink uses optional analytics technologies to understand how visitors interact with the public portions of the Service and to improve usability.

Optional analytics are disabled by default.

Google Analytics and Microsoft Clarity are loaded only after you make an affirmative choice to allow analytics.

You may use CheckWink without allowing optional analytics.

Google Analytics

If you allow analytics, CheckWink may use Google Analytics 4 to understand general product usage and interaction with CheckWink's public pages.

The CheckWink implementation is configured to avoid intentionally sending audit URLs, private report-access information, report findings, form values, account information, or payment information through CheckWink's custom Analytics events.

CheckWink does not currently use Google Analytics for advertising, remarketing, or advertising personalization.

Microsoft Clarity

If you allow analytics, CheckWink may use Microsoft Clarity on eligible public pages to understand interface interaction, usability patterns, clicks, scrolling, navigation behavior, and similar product-experience information.

Clarity may use session and interaction technologies to help us understand how the public CheckWink interface is used.

CheckWink currently uses privacy-oriented Clarity controls, including:

• strict content masking;
• explicit masking of the website URL submission field; and
• no Clarity analytics on private report pages.

Analytics Preference

Your analytics preference is stored locally in your browser so CheckWink can remember whether optional analytics should be loaded.

You may change your choice through Privacy settings on CheckWink.

If you withdraw previously granted analytics permission, CheckWink disables analytics and reloads into a non-analytics state.

12. Service Providers

We use service providers to operate CheckWink and perform functions on our behalf.

Current providers and infrastructure may support:

• cloud hosting and application processing;
• database hosting and backups;
• content delivery;
• website performance testing;
• payment processing and tax calculation;
• analytics;
• security;
• infrastructure logging;
• credential management; and
• domain and website delivery.

Current infrastructure, analytics, certification, and payment providers include:

• Google Cloud;
• Google Cloud Run;
• Google Cloud SQL;
• Google Secret Manager;
• Firebase Hosting;
• Google PageSpeed Insights;
• Google Analytics 4;
• Microsoft Clarity;
• TrustedSite; and
• Stripe.

TrustedSite Security Certification

On eligible public pages, CheckWink uses TrustedSite to support website security certification and display a live trustmark that visitors can verify.

TrustedSite counts a visit as a unique 24-hour session. Its public trustmark code may use a first-party visit-tracking cookie and browser storage to count that session and remember whether the floating trustmark has already been displayed.

This trustmark functionality operates separately from the optional Google Analytics and Microsoft Clarity preference. It is not loaded on private report pages. You may block or remove these browser technologies through your browser settings, although the live trustmark may not display or function as intended.

We seek to limit provider access to information to what is reasonably necessary for the services they provide and use technical, organizational, and contractual safeguards where appropriate.

13. Where Information Is Processed

CheckWink is operated from Québec, Canada.

The primary CheckWink application processing environment and operational PostgreSQL database are currently hosted in Montréal, Québec, Canada.

New operational database backups are also configured to be stored in Montréal.

However, CheckWink relies on global technology providers and infrastructure. As a result, certain information may be processed, transmitted, logged, cached, or otherwise handled outside Québec or outside Canada.

This may include processing associated with:

• Firebase's global delivery infrastructure;
• cloud logging and infrastructure telemetry;
• credential-management infrastructure;
• Google PageSpeed Insights;
• Google Analytics;
• Microsoft Clarity;
• TrustedSite;
• Stripe; and
• other service providers introduced in accordance with this Policy.

Information processed outside Québec or Canada may be subject to the laws of the jurisdiction in which it is processed and may, where legally permitted, be accessible to courts, regulators, or governmental authorities.

Where required by applicable law, we assess privacy and security considerations associated with cross-border processing and use appropriate safeguards.

14. Security

We use administrative, organizational, and technical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, loss, or destruction.

Depending on the information and processing involved, these safeguards may include:

• encrypted connections;
• restricted database access;
• managed credential and secret storage;
• access-control mechanisms;
• private-report capabilities;
• cryptographic token hashing;
• URL validation and sensitive-parameter blocking;
• network and request restrictions;
• rate limiting;
• restricted analytics behavior;
• security headers;
• backup and recovery procedures; and
• automated retention processes.

No information system, storage system, or transmission method can be guaranteed to be completely secure.

If we become aware of a privacy or security incident involving personal information, we will investigate and take the actions required by applicable law.

15. Sale, Advertising, and Profiling

CheckWink does not sell or rent personal information.

CheckWink does not currently use personal information for third-party advertising or remarketing.

Advertising-related Google consent categories remain disabled in the current CheckWink analytics implementation.

If our practices materially change in a way that creates additional privacy rights or disclosure obligations under applicable law, we will update this Policy and provide applicable choices.

16. Your Privacy Rights

Depending on your jurisdiction and the laws applicable to our processing, you may have rights concerning personal information about you.

These may include rights to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion or destruction in circumstances provided by law;
• withdraw consent to certain processing, subject to applicable restrictions;
• request information concerning how personal information has been used or disclosed;
• obtain a copy of certain information in a structured technological format where a portability right applies;
• object to or restrict certain processing where applicable;
• request cessation of dissemination or de-indexing where provided by applicable law; and
• make a complaint concerning our privacy practices.

Not every right applies in every circumstance or jurisdiction.

We may need to verify your identity before completing a request.

17. Québec and Canada

Blanc Magenta S.E.N.C. is responsible for personal information under its control in accordance with applicable Québec and Canadian privacy requirements.

Individuals may contact our Privacy Officer concerning:

• access;
• correction;
• deletion or destruction requests;
• withdrawal of consent;
• privacy questions;
• complaints; or
• other privacy rights available under applicable law.

Where applicable, individuals may also have the right to communicate with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

18. United States

Residents of certain U.S. states may have additional privacy rights where the applicable state privacy law applies to CheckWink and to the relevant processing.

Depending on applicable law, these rights may include access, correction, deletion, portability, and rights concerning certain sales, sharing, targeted advertising, or profiling.

CheckWink does not sell personal information.

Where additional legal rights apply, we will process eligible requests in accordance with applicable law.

19. Mexico

Where Mexican data-protection law applies, individuals may have rights concerning personal information, including rights of access, rectification, cancellation, and opposition, as well as other rights provided by applicable law.

Eligible requests may be directed to our Privacy Officer.

20. Children

CheckWink is a website-development and website-quality tool and is not directed to children.

We do not knowingly seek to collect personal information directly from children through the website-audit process.

If you believe that a child has provided personal information to CheckWink inappropriately, please contact us so that we can review the situation.

21. Third-Party Websites

CheckWink analyzes and may link to websites that we do not own or control.

An audit, technical finding, link, or reference to a third-party website does not mean that CheckWink:

• operates that website;
• endorses that website;
• controls its information practices; or
• is responsible for its privacy, security, content, or business practices.

Third-party websites are governed by their own terms and privacy practices.

22. Payments

Payments for paid reports are processed through Stripe on Stripe's hosted checkout page. CheckWink does not receive or store complete payment-card credentials.

Stripe may process payment, billing-address, transaction, and tax-calculation information to complete the payment, prevent fraud, and meet its own legal obligations. Stripe's processing is subject to its own terms and privacy notice.

We retain payment and transaction information that is reasonably necessary for customer support, accounting, tax, fraud prevention, and legal obligations. Before materially changing our payment practices, we will review and update this Privacy Policy as appropriate to explain:

• the payment provider;
• information processed;
• payment-related retention;
• financial and accounting records; and
• relevant cross-border processing.

Our intended payment architecture is designed so that complete payment-card credentials do not need to be stored by CheckWink.

23. Changes to This Privacy Policy

We may update this Privacy Policy as CheckWink evolves, our service providers change, or applicable legal requirements change.

When we update the Policy, we will revise the Last Updated date.

If a change materially affects how personal information already collected is used, we will provide additional notice or obtain consent where required by applicable law.

We will not rely solely on a change to this Privacy Policy to retroactively authorize a materially different use of personal information where additional notice or consent is legally required.

24. Contact and Privacy Officer

Questions, requests, or complaints concerning this Privacy Policy or CheckWink's handling of personal information may be directed to: