Privacy policy
This page explains which personal data bytereport processes, for what purpose, on which legal basis and for how long. In short: bytereport checks publicly available information about domains and websites. We never store the content of test mails. We set no tracking or advertising cookies and do not share data for advertising. We measure reach with statistics we run ourselves, without cookies and without passing data to third parties.
Controller
bytepark GmbH
Friedrichstraße 155
10117 Berlin
Email: support@bytereport.eu
Commercial register: Amtsgericht Charlottenburg, HRB 94433 B
Managing directors: Florian Batschi und Paul Nitsche
Send data protection requests to datenschutz@bytereport.eu.
Overview
We only process the data needed for the reports and for running the service securely:
- Account data: name, email address, role, language, plan and your sign-in data.
- Targets and results: the domains, hosts and addresses you have checked and the findings of the reports. For AI visibility, also your projects with brand, competitors, prompts and keywords.
- Test mails and mail sources: only the technical details the report needs, never content, subject or recipients.
- Usage and metadata: times of sign-ins and reports, quotas used and credits spent.
- Access data: technical details of page requests in the server logs.
This concerns users with an account, visitors who run checks without one, and people whose details are public on a checked domain or website, such as a contact address in a security.txt.
Legal bases
We process data under the General Data Protection Regulation (GDPR). The sections below name the legal basis for each processing:
- Contract (Art. 6(1)(b) GDPR): providing your account, reports, schedules and paid plans.
- Legitimate interest (Art. 6(1)(f) GDPR): secure and stable operation, protection against abuse, and reports without an account. This also covers third-party details that are public on a checked domain or website: we only read them as far as the report needs them.
- Legal obligations (Art. 6(1)(c) GDPR), such as retention duties.
Security and encryption
The connection to bytereport is encrypted with TLS (you can tell by “https” in the address bar). In addition:
- Your password never leaves your device, not even encrypted. Sign-in uses a protocol (OPAQUE) in which the server never learns the password.
- We store names and email addresses encrypted. All other sensitive details on the server, such as keys for confirmation codes, access to mailboxes and providers, and outgoing emails, are sealed with a key that is not kept in the database.
- Fonts, scripts and images come from our own server. There is no external content, no counting script and no tracking pixel, not even in our emails.
- Checks only reach public addresses on the internet, never internal networks.
Account and sign-in
For an account we process your name, email address, language, plan and sign-in data. You confirm your email address with a link or code that is valid for 24 hours. We delete unconfirmed accounts after seven days.
If you set up passkeys, we store the public part of the passkey with the technical details of your authenticator, the name you give it and when it was last used. Biometric data such as fingerprint or face never leaves your device. For codes from an authenticator app we store a sealed key, and recovery codes only as a check value. Codes sent by email are valid for ten minutes and are kept in memory only.
For each sign-in we store a session with its time and sign-in method, without IP address or device details. Under Account → Security you can sign out on all other devices.
If an administrator invites you, we store your name and email address for the invitation. It is valid for seven days.
Legal basis: contract (Art. 6(1)(b) GDPR).
Single sign-on
Organisations can connect bytereport to their identity provider, such as Microsoft Entra ID, Google Workspace or Okta (company login via SAML). You then sign in directly with your identity provider. We neither see nor store the password you enter there.
After sign-in, the identity provider sends us a signed confirmation with your email address and, depending on the setup, your name. Your organisation decides which details it sends. We check that the address belongs to one of the organisation's domains. Depending on the settings, we create an account automatically at the first sign-in and take over a changed name at later sign-ins. The identity provider gets no access to your reports.
Your organisation is responsible for the processing at the identity provider. If you no longer want to use the company login, contact your organisation.
Legal basis: contract (Art. 6(1)(b) GDPR) and the legitimate interest of your organisation and of us in a secure, centrally managed sign-in (Art. 6(1)(f) GDPR).
Reports and checks
For a report we process the target (a domain, a host or an address), the chosen reports and options, and the findings. The checks only read what is publicly available: DNS records, the responses of web and mail servers, robots.txt, sitemap, security.txt and the pages of the website. This may include third-party details, such as a contact address in the security.txt. We only store what the finding needs: at most 300 characters of an HTTP header, only the names of cookies, and from the security.txt only the path, the first contact and the expiry date.
For the email check we look up the domain and the addresses of its mail servers on DNS blocklists such as UCEPROTECT and URIBL. The lookups go through our own DNS resolver, so the list operators only see our server, not you. We connect to the domain's mail servers to check reachability and encryption. We do not send an email.
With an account, the accessibility check can also open the pages in a browser without a screen. It loads them like an ordinary visit, including content the page embeds from third parties. We do not store screenshots there.
The consent check opens the chosen pages of the checked website three times in such a browser: without a click, after “Reject” and after “Accept all” in its cookie banner. It stores the names and domains of cookies and storage entries (no values), the hosts of the third parties loaded, the checked addresses and one screenshot of the start page as it shows on the first visit. It reads the text of the checked website's privacy policy only to find the names of services in it and does not store it.
We keep reports in your account as long as your plan provides (how long is stated on the pricing page) and then delete them automatically. You can delete them yourself at any time and export them as JSON under Account → Overview. Schedules start reports regularly and notify only your account's email address.
If you share a report by link, anyone with that link can see it, for at most 30 days. You can revoke the link at any time.
Legal basis: contract (Art. 6(1)(b) GDPR). We process third-party details in the legitimate interest of a complete technical report (Art. 6(1)(f) GDPR).
Reports without an account
You can create single reports without an account. So that you can find them again, we set a cookie with a random identifier; we only keep a check value of it. To limit the number of reports per hour, we count them per IP address. For this we do not store the IP address but a check value formed with a secret key, from which the address cannot be derived. We delete these counters after 48 hours.
We delete reports without an account after seven days. If you sign in before then, we move them into your account.
Legal basis: legitimate interest in a freely usable service that is protected against abuse (Art. 6(1)(f) GDPR).
Test mails and mail source
For a test mail report you send an email to an address with a code shown on the page. The code is valid for 30 minutes. We only match an incoming email to a valid, waiting code, never to any other report.
We fetch every email from the mailbox right away and delete it there, whether it was matched or not. Until the report is done it is kept in memory only; it is never stored. The report contains technical details only: the domains of sender and return path, the results of SPF, DKIM and DMARC, the route through the mail servers, the size and the hosts of link shorteners. We do not store recipient addresses, subject or content. We delete the record of the code (address, status and times) after 30 days.
A pasted mail source is handled the same way: it is kept in memory until the report is done, and the report contains only the technical details named above.
Legal basis: contract (Art. 6(1)(b) GDPR).
AI visibility
The AI visibility check asks language models and search engines what they know about a website. For this we send to the providers we have enabled:
- Language models (OpenAI, Anthropic, Google Gemini, Perplexity, Mistral): the prompts with brand and domain. For the evaluation, the answers go to a model together with your fact sheet; for suggestions, the title, description and headings of the start page, the competitors and the existing prompts.
- Search providers (DataForSEO, SerpApi): the keywords with country, language and device type.
Without an account we only ask what a model knows about the host you entered. We send no details about you or your account; the providers only see our server as the sender.
We answer identical questions from a cache for a while so they are not paid for again: at most seven days, 24 hours with web search. The report keeps the prompt, the answer (at most 4,000 characters) and the sources. Answers may contain statements about third parties, such as the people behind a brand. To bill credits we store provider, model, tokens and cost per request, without text, and delete these entries after 13 months. Projects remain until you delete them or your account.
Legal basis: contract (Art. 6(1)(b) GDPR); without an account, legitimate interest in a freely usable service (Art. 6(1)(f) GDPR).
AI summary
On request a language model explains a report in plain words. Only when you click "Create summary" do we send the findings of exactly this report to the provider we chose for it (one of OpenAI, Anthropic, Google Gemini or Mistral):
- kind of report, checked domain or address, time and scores,
- the failures, warnings and hints with title, the value found (such as a DNS record) and our suggestion, shortened,
- number and titles of the checks that passed.
Not included are your name, your email address, your account, your organisation, your plan, other reports, and content and recipients of a test mail. Email addresses in findings are cut to their domain first. Each summary is a request of its own, without tools and without a history stored at the provider.
We store the answer with the report; it is deleted with it. For quota and billing we store provider, model, tokens and cost per request, without text, and delete these entries after 13 months. Only the administration sees whether a summary was helpful.
Legal basis: contract (Art. 6(1)(b) GDPR), without an account legitimate interest in a freely usable service (Art. 6(1)(f) GDPR).
DNS queries through public resolvers
We ask for the DNS records of a checked domain through our own resolver. If it gives no answer or reports an error, for example because the domain's name servers are unreachable at times, we ask for the same records through public resolvers: Cloudflare (1.1.1.1), Quad9 (9.9.9.9) and Google Public DNS (8.8.8.8). They then learn the names we ask for, that is the checked domain and its mail servers. We send no details about you; the providers only see our server as the sender. We never ask blocklists through these resolvers.
Legal basis: contract (Art. 6(1)(b) GDPR); without an account, legitimate interest in a freely usable service (Art. 6(1)(f) GDPR).
Core Web Vitals from Google
If the Core Web Vitals measurement is switched on, the performance check sends the address of the checked start page to Google's PageSpeed Insights API. Google loads the page and returns measurements from the Chrome User Experience Report. We send no details about you; Google only sees our server as the sender. For more information see Google's privacy policy.
Legal basis: contract (Art. 6(1)(b) GDPR); without an account, legitimate interest in a freely usable service (Art. 6(1)(f) GDPR).
Payments
Paid plans are handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). At the first purchase we send Stripe your email address, your account's identifier and the chosen plan. You enter payment details directly with Stripe; they never reach our servers. We only store Stripe's customer and subscription identifiers, the plan, the status and the end of the billing period. For more information see Stripe's privacy policy.
Legal basis: contract (Art. 6(1)(b) GDPR) and, for keeping accounting records, legal obligations (Art. 6(1)(c) GDPR).
API tokens
If you create an API token, we store its name, a check value of the token, and when it was created and last used. We show the token itself only once.
Legal basis: contract (Art. 6(1)(b) GDPR).
Sending and hosting email
We only send emails that belong to using the service: confirmation codes and links, invitations, security notices and notifications about scheduled reports. There is no newsletter.
The hosting services we use also cover sending, receiving and storing emails, including the mailbox for test mails. This processes the sender and recipient addresses, the content and technical details of delivery, such as the mail servers involved and the delivery status. This data may also be used to detect spam. Until an email is delivered it is kept sealed in our queue. If delivery fails, we keep trying for up to one day. We only log the kind of email and, if any, the cause of an error, never recipient, subject or content.
Emails are usually encrypted with TLS in transit, but not on the servers that send and receive them. So they are not end-to-end encrypted. We cannot take responsibility for the path between your mail server and ours.
If you write to us, we process your details to answer your request.
Legal basis: contract (Art. 6(1)(b) GDPR) for emails that belong to using the service and for requests about it. Otherwise, legitimate interest in reliable and secure communication (Art. 6(1)(f) GDPR).
Hosting
bytereport runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner provides storage, computing capacity and network and processes the data on our behalf. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR. For more information see Hetzner's privacy policy.
Names, email addresses and access credentials are stored on the servers and in the backups only in encrypted form. We back up the database daily and keep the last seven backups.
Legal basis: legitimate interest in reliable, secure operation in Germany (Art. 6(1)(f) GDPR).
Server logs and abuse protection
With every request your browser sends technical details to our server. The web server in front records them in server log files: time, requested address, status code, amount of data transferred, IP address, browser and operating system and, if applicable, the previously visited page (referrer).
The application itself does not log page requests with IP addresses. It only records IP addresses for security-relevant events, such as attempts to unlock the server. To limit too many sign-in, code or check attempts, it counts requests per IP address, in memory only. Before some forms your browser solves a small computing task that makes automated abuse harder. No cookie is set for this.
We evaluate the logs to detect and fend off attacks and abuse, such as guessing passwords or codes and overload attacks. We also use them to find errors and keep the service stable. We do not combine them with other data and do not build profiles.
We delete the logs after 30 days at the latest. Entries we need to investigate a specific incident are kept until it is closed.
Legal basis: legitimate interest in secure, stable operation and protection against abuse (Art. 6(1)(f) GDPR).
Reach measurement
On all pages of bytereport, including after signing in, we measure reach with the open-source software Umami. We run Umami ourselves at bytereport.eu on servers of Hetzner in Germany. We do not pass the data on to third parties.
Umami records the page viewed, the page visited before (referrer), browser, operating system, device type, screen size, language and the country or region derived from the IP address. The parts of the address after “?” and “#” are not sent. Addresses that name a particular report, a share link or an invitation are summed up: instead of the identifier we send a placeholder. Umami therefore learns that a report was viewed, but not which one and not for which domain.
The IP address is not stored. To tell visits apart, Umami computes a checksum from the IP address, browser details and a random value that changes every month. The IP address cannot be derived from it, and visits cannot be linked to a person beyond the month. Umami therefore stores no personal data. We do not link the measurement to your account. Umami sets no cookies and stores nothing on your device. We only evaluate aggregated figures, such as views per page and day.
If you have enabled “Do Not Track” in your browser, we record nothing. You can also switch counting off here; your browser then remembers this in its local storage. We delete the measurement data after 24 months at the latest.
Legal basis: legitimate interest in understanding how our service is found and used, and in improving it (Art. 6(1)(f) GDPR).
Transfers to third countries
Servers, database and backups are located in Germany. Data only reaches countries outside the European Union or the European Economic Area in these cases:
- AI visibility and AI summary: OpenAI, Anthropic, Google and Perplexity are based in the USA. DataForSEO and SerpApi may also process requests outside the EU. Mistral is based in France.
- Core Web Vitals: Google may also process the request in the USA.
- Payments: Stripe may transfer data to Stripe, Inc. in the USA.
Transfers to the USA rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework where the provider is certified under it, otherwise on standard contractual clauses (Art. 46(2)(c) GDPR). Apart from Stripe for payments, we send these providers no details about you. If your organisation uses an identity provider outside the EU, that transfer is its responsibility.
Deletion
We delete data as soon as it is no longer needed for its purpose and no retention duty applies.
- Reports: after your plan's retention period, without an account after seven days. You can delete them yourself at any time.
- Account: under Account → Security you can delete your account yourself. This immediately deletes your account data, reports, schedules, projects, API tokens and test mail records. A running subscription ends at once, without a pro-rata refund. Invoices and accounting records stay with Stripe for the statutory retention periods. Counters for quotas and credits that only carry the account's identifier are deleted after 13 months.
- Invitations and unconfirmed accounts: after seven days.
- Test mails: right after they are fetched from the mailbox; the record of the code after 30 days.
- Cache of AI answers: after seven days at most.
- Counters for reports without an account: after 48 hours.
- Emails in the queue: once sent; undeliverable ones after seven days.
- Backups: after seven days.
- Server logs: after 30 days at the latest, unless needed to investigate an incident.
- Reach measurement: after 24 months at the latest.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interest on grounds relating to your particular situation (Art. 21). Write to us at datenschutz@bytereport.eu.
You can export your reports as JSON yourself at any time under Account → Plan and billing.
You can also lodge a complaint with a supervisory authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.
Changes
We update this privacy policy when bytereport or the law changes. The version published here applies.
As of October 2026