Privacy Policy
HeaderShield scans the URLs you submit. We process them only to return a validation result and to enforce per-account usage limits.
What we store
Your account email, a hashed API key, and aggregate usage counters. We do not store the response contents of sites you scan beyond transient processing and rate-limit windows.
Who processes your data
These are every vendor that handles data on our behalf, what each one is for, and where it happens. The list is generated from the code, so it cannot fall out of step with what the product actually does.
| Vendor | What for | What it sees | Where |
|---|---|---|---|
| Vercel | Application hosting and page delivery | IP address and request metadata, in server logs | EU (deploy region) and United States |
| Upstash | Database holding accounts, keys and product data | Email, hashed API key, usage counters, scan results and monitors | EU |
| Stripe | Payments and subscription management | Email, billing and payment details. Card numbers never touch our servers | EU and United States |
| Brevo | Transactional email (welcome, API key, alerts) | Email address and message content | EU (France) |
| Sentry | Application error reporting | Technical error details and browsing context. Configured with sendDefaultPii disabled, so we do not send identifying data | EU (.de ingestion host) |
| Vercel BotID | Bot protection on public forms | Technical browser signals, no personal identifier | EU and United States |
| Google Analytics 4 | Aggregate visit statistics | Cookie identifier and browsing data — only after you consent. Without consent it writes nothing to your device | United States |
| Vercel Analytics and Speed Insights | Page performance metrics | No cookies, no persistent identifier | EU and United States |
Cookies
On this website we set no cookies of our own, and nothing that is not strictly necessary is stored before you agree to it. Google Analytics 4 is the only technology here that uses cookies (_ga, _gid), and it runs under Google Consent Mode v2 with every storage type denied by default: until you accept, it records nothing on your device. Vercel Analytics and Speed Insights are cookieless and need no consent. We store your own choice in your browser’s local storage (cookie-consent-v1) so we do not have to ask again.
You can accept or refuse when the banner appears, and change or withdraw that choice at any time via Cookie preferences in the footer. Refusing costs you nothing: every feature works either way.
Your rights
You can request export or deletion of your account data at any time by emailing hello@headershield.dev.