Privacy

1Who this covers

This policy covers the Can We Launch website and the scanning service behind it, run by Doxa Technologies LLC. It applies whether you have an account or you have only run a free scan.

Doxa Technologies LLC is the data controller for everything described here. You can reach it at support@canwelaunch.com, or by post at PO Box 126, Buford, GA 30515, USA.

If you only read two sections, make them what we collect and who else sees your data.

2What we collect

• Account details. Your name and email address. If you sign in with Google we receive your name, email address and the account identifier Google gives us. We never see your Google password.
• Sites you add. The address, the name you give it, anything you supply to prove you control the domain, and the addresses of any APIs on that domain you list for the scan to audit. You can delete a site from its page, which removes it and every scan of it straight away.
• Scan results. The pages we fetched, the findings and scores, screenshots the browser took, and technical details of what your server sent back.
• Payments. Stripe is the seller for anything you buy here, so you pay Stripe and it handles the payment and the tax on it. Card details go straight to Stripe and never reach us. We are told when a payment is started and whether it went through, what it was for, and enough to keep a record of it. If you subscribe, we also keep the identifier Stripe gives your account, the state of your plan, and how often you asked for your sites to be rescanned. If you buy a report pass, we keep which site it was for, the date it runs out, and how often you asked for that site to be rescanned while it runs.
• Webhook endpoints. If you send your scan results somewhere of your own, we keep the address you gave us, the name you gave it, the key we sign those deliveries with, and whether the last one got through.
• Technical logs. IP address, browser user agent and request timestamps, so we can debug problems and spot abuse.
• Visit counts. Our hosting platform counts page views for us so we can see how many people arrive and which pages they read. It measures visits, not people: it writes nothing to your browser, gives you no identifier, and does not follow you to other sites.
• Free scan requests. When someone runs a free scan without an account, we record the IP address the request came from, so we can answer a complaint about a scan we ran and stop anyone using the scanner to attack other people.
• Steps toward a purchase. We count how many people reach each step between opening a free result and paying for a report: the result opened, its claim button pressed, an account registered, the result claimed, the locked report seen, the unlock chooser opened, a checkout started and a payment made. Each is a record that the step happened, tied to the scan or the site it happened on and, once you are signed in, to your account. A step taken without an account carries nothing about who took it: no IP address, no browser details and no referring page.
• Crashes in your browser. If a page here breaks while you are using it, your browser reports the error and where in our code it happened to our error monitoring service, so we find out about it. It carries the page you were on with the query string and anything token-shaped in the address removed, and it carries no part of a scan report.
• Anything you email us.

3Cookies and browser storage

We use a session cookie to keep you signed in, and a token cookie that protects forms against cross-site request forgery. Both are first-party and necessary for the service to work.

Your light or dark theme choice is kept in your browser and never sent to us. There are no advertising cookies, and nothing on this site writes a cookie or a stored identifier for measurement.

The one third-party script we load is the cookieless visit counter described above, served by our hosting platform. It runs without asking your consent because it stores nothing on your device and cannot single you out; if that ever changes, it goes behind a consent banner first.

4Why we use it

• To run scans and show you the results.
• To keep your account working and secure, including sign-in, email verification and password resets.
• To take payment and keep a record of what was bought.
• To send your scan results to an endpoint of your own, if you have asked us to.
• To email you about your account, your scans and anything that affects them. When you subscribe, or buy a report pass, we email you a copy of the report for that site, as a spreadsheet of the findings, and after each scheduled rescan, on your plan or while a report pass runs, we email you what changed with the report attached. While your plan is active we also check each of your sites once a day for a certificate or domain registration about to run out, and email you when one is. We do not sell your address or add you to a marketing list you did not ask for.
• To find bugs, measure how the service is holding up, see how many people arrive and which pages they read, and stop abuse.

5What happens when you scan a site

When you submit an address we request pages from it from our own servers, identifying ourselves as the scanner. We read what the site serves to any visitor. We do not try to sign in, and we do not go behind access controls.

Part of the scan drives the page in a real browser and uses it the way a visitor would, including submitting forms with data that is obviously fake, because a form that silently fails is one of the most common problems on a new site. If your forms email you, expect a test entry per scan.

Where performance measurement is switched on, the address you scanned is sent to a third-party performance measurement service so the report can carry real timings. Only the address goes, nothing about you.

Before we fetch anything, we check the address against third-party safety and reputation services, and we refuse to scan sites they flag as adult or unsafe. Only the address goes, nothing about you.

When a result page reached from one of our outreach emails is opened, we record that it was opened and when, so we can tell whether the email was worth sending. We do not record who opened it: no IP address, browser or referring page is kept for that.

A site scanned manually may later get an email from us about what the scan found, sent to the contact address the site itself publishes. That email is about the site, not about you: it never says who ran the scan, and we tell the recipient nothing about you.

We may use AI services to help deliver the service. When we do, they receive only what a site publishes to any visitor and what our scan found on it, never your personal information.

We also look up the public records the domain itself publishes, including its registration details, through a public domain lookup service. Only the domain name goes, nothing about you.

6Who else sees your data

We do not sell personal data, and we do not share it for advertising. We do rely on a handful of companies to run the service:

• Hosting and database providers, which is where the service and your data physically live.
• An email delivery provider, which handles verification, reset and notification mail, and the plan emails that carry your own report as an attachment.
• Stripe, which is the seller for anything you buy here. It takes the payment, works out and pays the sales tax or VAT, issues the invoice, and handles questions about the transaction itself.
• Google, if you choose to sign in with Google.
• An error monitoring service, which receives the technical details of a failure when something in the service breaks, whether it broke on our servers or in your browser. A browser report is sent by your browser to that service directly. We strip email addresses, request contents and session cookies out of those reports before they are sent, and a browser report carries no identifier for you and nothing it recorded along the way.
• Our hosting platform, in its second role as the analytics provider behind the visit counts. The measurement request carries the page address, the referring page and the usual details any web request carries, and it is processed for us rather than for the platform's own purposes.
• Safety, reputation, performance measurement, domain and email lookup services, which we ask about the address you scanned or a contact address a site publishes. They receive only that address.
• AI services, which we may use to deliver the best experience. We never send them personal information.
• Anywhere you tell us to send your scans. If you register a webhook endpoint, every finished scan of your sites is sent to that address, signed so the receiver can check it came from us. It carries the scan results and nothing about you beyond them. You chose the address, so what happens to the results once they arrive is between you and whoever runs it; remove the endpoint from your profile page and the deliveries stop.

7Where your data is held

Our providers operate internationally, so your data may be processed outside the country you live in. We choose providers that commit to appropriate safeguards for those transfers.

8How long we keep it

Account details are kept while your account is open. The most recent scan of each site you have added is kept in full for as long as the site is there, so the last report you opened is always the one waiting for you. Older scans age out behind it: their screenshots are deleted after 30 days and their findings after 180 days, leaving the score and the date so your history and its trend still read. While a site is on a paid plan its findings are kept for as long as the plan runs, and screenshots still go after 30 days. If the plan ends, the site goes back to the windows above. While a report pass is open on a site, its older findings are kept for as long as the pass lasts, and its older screenshots still go after 30 days. Technical logs are kept for a short period and then rotated out.

The IP address behind a free scan request is deleted 30 days after the scan, leaving nothing on the result about who asked for it.

The steps toward a purchase are kept as counts for as long as we run the service. Deleting a site or an account keeps the count and removes its link to what was deleted.

Screenshots taken during a free scan are deleted about two days after it runs, once the shared result link has had time to be read. The findings themselves are deleted 60 days after the scan, and the shared link then says the result has expired. If you claim the scan into an account, or it was a scan of a site you added, it becomes part of that site history and ages on the windows above instead.

When we scan a site in order to email whoever it publishes an address for, the screenshots from that scan are deleted 30 days after the last email we send about it, or 30 days after we decide not to write at all. If we scan the site again, the screenshots from the earlier scan are deleted 30 days after it ran. The findings stay, so the link in an email we already sent keeps working.

You can delete your account yourself from your profile page. Doing so cancels your plan at Stripe if you have one, then removes the account, the sites attached to it, and every scan result, screenshot and report file from those scans, apart from records we are required to keep, such as payment records for tax purposes, which are kept with your details stripped out of them. It happens straight away and cannot be undone.

9Your choices

Your profile page has both of the big ones: download a copy of everything we hold on your account as a file, and delete the account outright. For anything else, including correcting something that is wrong, email support@canwelaunch.com and we will deal with it.

Depending on where you live you may have rights under laws such as the UK and EU GDPR or the CCPA, including the right to complain to your data protection regulator. We honor these requests wherever you are, not only where the law requires it.

10Security

Traffic is served over HTTPS, passwords are stored hashed rather than in a readable form, and access to production data is limited to the people who need it. No service can promise perfect security, but if something goes wrong that affects you, we will tell you.

11Children

The service is meant for people running websites and is not directed at children. We do not knowingly collect data from anyone under 16.

12Changes to this policy

When this policy changes the date at the top changes with it. If a change materially affects how we handle your data, we will email account holders rather than quietly updating the page.

13Contact

Questions about any of this go to support@canwelaunch.com.