This page covers the free surface check at https://webappscanner.root92.com and the commercial follow-up that may come after it. It does not cover the rest of the Root92 website.
Three things are worth saying before the details, because they are the questions people actually have.
- If you only run the check and never fill in the form, we do not keep you as a contact: no email, no lead, nothing anyone will write to you about. One line does get recorded — which address was checked, when, from which IP and browser, and how it ended — because a tool that reaches other people’s sites has to be able to show who asked it to. It is described under “Your IP address” below.
- What we scan is the public surface of the app you submitted. We never read your database, and we never use any key we find. The scanner is described in full at https://webappscanner.root92.com/about-scanner.
- We don’t sell your information to anybody. Not your email, not your IP address, not the results of the check.
Who is responsible#
Data controller: Root92 sh.p.k., NIPT (Albanian tax ID) M52111038D, Don Bosko, Njesia Administrative Nr.11, Zyre F-101, shkalla F.kati , ambienti 1, Tirane, Albania.
For any request about your data, write to: info@root92.it.
What we collect, exactly#
When you submit the contact form, we store one row with these fields and nothing else:
url— the address of the app you asked us to check.email— the address we reply to.problem— which of five fixed codes you picked (slow,security,cost_lockin,ownership,other). We store the code, not the translated label.- When you send the form, the same details (address you entered, app URL, problem code, scan outcome) are emailed to us so we can answer you. That email goes through our email provider (Resend) and is set up so that replying to it writes back to your address.
lang— the language the page was in, so we answer you in it.consent, plus the timestamp of the row and the version of the consent text you read (currentlyen-2026-08). This is the proof that you authorised the scan.detections— the technical result of the check: which technologies were detected, which security headers were present, sizes and timings. Metadata only. Never page content, never any data from your database.scoreand the status of the scan.
That is the whole list. There is no field for anything else, so there is nothing else to collect by accident.
Your IP address#
Your IP address is used for two things, and they are separate.
- Rate limiting, so the tool cannot be turned into a way of hammering someone else’s site. The limits are 20 checks per hour per IP address and 3 per hour against the same target host. For this, it is kept in memory for an hour and then forgotten.
- A record of checks: every check leaves one row saying which address was checked, when, from which IP and browser, and how it ended. This is how we can tell abuse from ordinary use before deciding to block anyone — blocking on thresholds invented without data turns away real customers.
That record does not live on the public server. It is written there for at most 24 hours, moved to the internal server, and deleted from the public one. It is kept for 12 months and then deleted.
Our server log keeps only a truncated prefix of it, alongside the target hostname and the outcome. It never contains your email address or the full address you submitted.
Ownership verification#
If you verify that a site is yours before a deeper check, a few more things are involved. None of them happens unless you start a verification.
- A session cookie,
HttpOnly, valid for 24 hours. It exists only so you can close the page and come back; it is strictly necessary for the service you asked for, and it is not used for tracking. We store a keyed hash of it, never the cookie itself. - The hostname you verify, the method you chose, and the outcome of each check (for example “found” or “not found yet”). We never store the token, the codes we send, or the links in our emails.
- Before the proof, the email address you enter to receive a 6-digit code. On the public server we keep only a keyed hash of the address and of the code, never either one in clear; the code is valid for 10 minutes and one use. To deliver it, the address and the code pass through our email delivery provider (Resend), which keeps a copy of the message as part of its delivery logs.
- If you prove ownership, the email address you then give us, so we can send you a one-time code and know whom to answer.
- Your IP address, for the same two reasons described above: rate limits (kept in the database for at most 24 hours, so a restart does not reset them) and the record of checks.
On the public server all of this is deleted within 24 hours. The internal server keeps the proof of authorisation (hostname, method, times, the email address or mailbox, and the consent text versions) and the report summary for 24 months, the record of checks for 12 months, and a delivery log of these emails (recipient, time, outcome — never the code or the link) for 7 days.
Report by email#
After you confirm your email address with the 6-digit code, you can ask us to email the full report of the site to an address on the site’s own domain, instead of proving ownership. This is not an ownership check: it does not make anyone a verified owner and does not give access to anything on our website.
- The address you type must be on the site’s domain (for example
name@example.comfor example.com); we refuse any other. It can be yours or that of whoever runs the site. We note whether it is the same address you confirmed with the code, so our team can see it. - Nothing is sent automatically. A person on our team reviews each request, and the report goes out only if they approve it. If they do not, nothing is sent.
- To prepare the report we run the same surface check described above, with the same limits. We store the site address, the address the report goes to, whether it matches the one you confirmed, the language, the version of the consent text you accepted, and the time.
On the public server this is deleted within 24 hours. The internal server keeps the request, the team’s decision and the time the report was sent for 24 months from first contact, like any other contact.
Why we are allowed to do this#
There are three separate operations here, with three separate legal bases. They are deliberately not merged into one sentence.
- Running the scan on the app: your consent as its owner, or as someone authorised to have it analysed. That is the checkbox, and it is why we record which version of its text you read.
- Contacting you afterwards about the paid audit: legitimate interest in business-to-business communication, with your own request for the report as the context.
- Keeping the record of checks described above: legitimate interest in the security of the service. A tool that reaches other people’s sites has to be able to show who asked it to, and to notice when it is being misused.
How long we keep it#
On the public server that runs the check: 24 hours, for everything, including the record of checks. A scheduled job deletes rows older than that, whether or not anything else has happened to them.
On the internal server we use to reply to you: 24 months from first contact for your contact details, and 12 months for the record of checks. Two different purposes, two different deadlines, two equivalent jobs.
These are fixed deadlines, not intentions. No elastic formula, no wording that could stretch to mean forever.
Who else sees it#
We don’t sell your information to anybody. The only other parties that handle it are the two providers below, and only to run the service for us.
The hosting provider of the public server and of the internal server: DigitalOcean (digitalocean.com).
The email provider that delivers the messages this site sends (the form notification to us, the verification code, the contact form): Resend (resend.com).
The email provider we use to reply to you: Google Workspace (Google Ireland Ltd, workspace.google.com).
Your rights#
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can also object to the commercial follow-up.
All of these go through one address: info@root92.it. We answer within one month, as the GDPR requires.
Deletion and opting out#
Same address, and we do it by hand.
We are aware that a self-service button would be more convenient. We do not have one because the server holding your data is not reachable from the internet, which is a deliberate part of how this is built: exposing a public endpoint to delete records would mean exposing that server. Until that changes, an email is the honest option, and the one that actually works.