Skip to content
ScanComb
Menu
Get started

Privacy Policy

WardBee is designed around least-privilege, read-only integrations for compliance evidence workflows.

Controller

The controller is Mr.D Apps. Contact details are in the legal notice.

Data Processing

We process account data, operational metadata, and compliance evidence needed to provide the service. We avoid collecting unnecessary personal data.

Security Controls

Access controls, encryption at rest and in transit, and audit logging are used to protect customer data.

NIS2 Supplier Check

For the free check we process your work email, the domains you add, scan results, your self-assessment answers and company profile, and the reports we generate. The legal basis is Art. 6(1)(b) GDPR (providing the check and report). Reminder and marketing emails are sent only with your consent, Art. 6(1)(a) GDPR, confirmed by double opt-in.

  • Data is stored in the EU (AWS eu-central-1, Frankfurt). Emails are sent through Amazon SES.
  • IP addresses are never stored in plain form; we keep only hashes with a daily rotating salt for rate limiting and consent records.
  • Unverified domains and previews are deleted after 7 days. Accounts are deleted 24 months after the last sign-in. Usage events are kept for 13 months.
  • Page views are counted without cookies. The only cookie is the essential sign-in session.
  • Your report is visible only to you. A public badge and check page exist only if you switch them on, and they show only the level of detail you choose.
  • If you link a WardBee scan, we read its results for the linked AWS accounts and GitHub organisations to mark answers as technically verified.
  • We publish aggregate statistics (for example, the share of checked domains without a DMARC reject policy) only from at least 50 scans and never name a domain.
  • You can export all your data as JSON and delete it yourself from your account page. Deletion completes within 24 hours.

Project Inquiries

If you submit the services inquiry form, your name, email address, and message are sent to Mr.D Apps to respond to your request. The form does not create a marketing subscription. Please do not include passwords, credentials, or sensitive evidence.

Contact

For privacy requests, contact your account administrator or Mr.D Apps.