Privacy Policy
How CheckFox handles personal data, in which role, on what legal basis, and for how long.
CheckFox is operated by Crofte Studio S.à r.l.-S, Luxembourg (RCS B310079). This policy explains what I do with personal data. It complements the Terms & Conditions, the Data Processing Agreement and the Cookie Policy.
I act in two different roles, and the difference matters
For your account, billing, support and marketing data, I am the controller and this policy applies. For the data you put into the tool while auditing (pages, screenshots, comments, notes about real people), you are the controller and I am your processor: the Data Processing Agreement applies, not this policy.
1. Who is responsible
- Controller
- Crofte Studio S.à r.l.-S, Luxembourg, registered under RCS B310079.
- Contact
- See the contact block at the end of this page.
- Data protection officer
- CheckFox is not required to appoint one under Article 37. Data protection questions are handled directly by the operator.
- Supervisory authority
- Commission nationale pour la protection des données (CNPD), Luxembourg.
2. What I collect
As controller, I collect only what the service needs to function and to be paid for.
- Account data: name, email address, password (stored only as a salted hash, never in clear text), language and display preferences, and the workspaces you belong to.
- Authentication data: sign-in timestamps, and the second-factor configuration if you enable multi-factor authentication.
- Billing data: plan, subscription status, invoices, billing address and VAT number. Card numbers never reach my servers: they are handled directly by Stripe.
- Usage data: the actions you take in the application, kept so that a workspace owner can see who changed what, and so that quotas can be enforced.
- Support data: whatever you write to me when you ask for help.
- Technical data: IP address, browser and device type in server and security logs.
- Audience measurement: aggregated page views, without cookies and without storing your IP address. See the Cookie Policy.
I do not knowingly collect special categories of data under Article 9 (health, beliefs, biometrics and so on) for my own purposes. If you place such data in an audit, you do so as controller under the Data Processing Agreement.
3. Why I process it, and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the service and your account | Account, authentication, usage | Performance of the contract, Article 6(1)(b) |
| Billing and subscription management | Billing, account | Performance of the contract, Article 6(1)(b) |
| Keeping accounting records | Invoices, billing | Legal obligation, Article 6(1)(c) |
| Security, abuse and fraud prevention | Technical, authentication | Legitimate interests, Article 6(1)(f) |
| Answering support requests | Support, account | Performance of the contract, Article 6(1)(b) |
| Product emails about your account and plan | Account, billing | Performance of the contract, Article 6(1)(b) |
| Newsletter and product announcements | Email address | Consent, Article 6(1)(a), withdrawable at any time |
| Aggregated audience measurement | Anonymous page views | Legitimate interests, Article 6(1)(f), no cookie and no IP stored |
Where I rely on legitimate interests, I have weighed them against your rights. You can object to that processing at any time under Article 21.
4. The data you put into the tool
Audit results, samples, screenshots, comments, notes, uploaded files, accessibility statements and remediation plans belong to you. I process them only to run the service and only on your instructions.
I do not sell them, do not share them with anyone other than the sub-processors listed in the sub-processor register, and do not use them to train artificial intelligence models. Where an AI feature is used, the content is sent to the model provider for that single request and is not used for training.
The full terms are in the Data Processing Agreement.
5. How long I keep it
| Data | Retention |
|---|---|
| Active account | For as long as the account exists |
| Inactive account | 2 years after the last sign-in, then deletion after prior notice by email |
| Audit content | For the duration of the contract, then 30 days to export it, then deletion |
| Backups | Deleted data disappears from backups within 35 days at the latest |
| Invoices and accounting records | 10 years, as required by Luxembourg accounting law |
| Security and access logs | 12 months |
| Support exchanges | 3 years after the last contact |
| Newsletter subscription | Until you unsubscribe, then 3 years to prove that consent existed |
Why backups get their own line
Deleting a record removes it from the live database immediately, but point-in-time backups keep a copy for a while. Claiming instant and total erasure would be untrue, so the real figure is published instead.
6. Who else sees the data
I use a small number of service providers to run CheckFox. Each of them is bound by a data processing agreement and may only act on my instructions. The full, current list, with each provider's legal entity, hosting location and transfer safeguard, is published at checkfox.eu/subprocessors.
Beyond those providers, I disclose personal data only where a law or a court order requires it, and only to the extent required.
I never sell personal data, and I never share it for third-party advertising.
7. International transfers
The database, the file storage and the application backend are hosted inside the European Union. The website itself runs on infrastructure located in France.
Some providers are established outside the EEA, mainly in the United States. Where that is the case, the transfer relies on the European Commission's standard contractual clauses, and where applicable on the provider's certification under the EU-US Data Privacy Framework. Each safeguard is named per provider in the sub-processor register.
8. How the data is protected
- Encryption in transit (TLS) and at rest.
- Passwords stored only as salted hashes.
- Row-level security in the database, so a query cannot reach another workspace's rows even if the application has a bug.
- Optional multi-factor authentication, enforced at the database level once enabled and not only in the interface.
- Role-based access inside a workspace, with least privilege applied by default.
- Automated backups, and administrative access restricted to the operator.
The detailed technical and organisational measures are published as Annex 2 of the Data Processing Agreement.
9. Your rights
Under the GDPR you may request access to your data, its correction, its erasure, a restriction of processing, a portable copy, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what was done before.
Most of this is available without asking: your settings let you edit your data, export your audits and delete your account yourself. For anything else, write to the address below. I answer within one month, and will tell you if I need the extension that Article 12(3) allows.
If you are not satisfied with my answer, you may lodge a complaint with the Commission nationale pour la protection des données (CNPD), at https://cnpd.public.lu, or with the supervisory authority of the country where you live.
If your data is in CheckFox because an organisation ran an audit that concerns you, that organisation is the controller, not me. Address your request to them; I will assist them in answering it.
10. Cookies and audience measurement
CheckFox sets only the cookies that are strictly necessary to keep you signed in and to keep the service secure, and uses cookieless audience measurement. That is why there is no cookie banner. The detail is in the Cookie Policy.
11. Children
CheckFox is a professional tool and is not directed at children. I do not knowingly create accounts for people under 16. If you believe a child has an account, tell me and I will delete it.
12. Changes to this policy
When this policy changes in substance, the version number and the effective date at the top of this page change with it, and account holders are notified by email before the new version takes effect.
Printed from checkfox.eu. Check the site for the current version.