Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website, within the meaning of the General Data Protection Regulation (GDPR), is:

2. What Data We Collect and Why

2.1 Website Scans

When you submit a URL for scanning, we store the following data in our database:

• The URL you submitted
• Scan results (detected builder, CMS, technologies, hosting provider, AI probability)
• Your IP address (for rate limiting and abuse prevention)
• Your browser’s User-Agent string (for bot detection)
• A screenshot of the scanned website (URL reference, not raw image data)
• Timestamp of the scan

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing the scanning service, preventing abuse, and maintaining service integrity.

2.2 User Accounts

If you register for an account (e.g. to access the developer API), we store:

• E-mail address
• Password (hashed with bcrypt — never stored in plain text)
• API keys you generate
• Account creation and last login timestamps

Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you.

2.3 Browser Extension

The browser extension analyses the active tab only when you explicitly trigger a scan. It sends the current page URL to our scan API. No browsing history is collected, and no data is transmitted without your interaction.

2.4 Contact Enquiries

If you contact us by e-mail, we process your e-mail address and the content of your message to respond to your enquiry. Data is deleted once the conversation is concluded and no legal retention obligations apply.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in handling enquiries.

2.5 Analytics

We collect aggregated, anonymised server-side traffic statistics (page views, referrers, country-level data) via our own infrastructure, which does not set cookies and stores no personal identifiers.

We may additionally run third-party analytics or advertising scripts (for example Google Analytics or Google AdSense, see Section 3) that can set their own cookies for measurement or ad delivery. Where a script requires consent under GDPR, it only loads after you accept it via our cookie consent banner (see Section 4).

Legal basis: Art. 6(1)(f) GDPR for our own server-side statistics — legitimate interest in understanding usage patterns to improve the Service. Art. 6(1)(a) GDPR (your consent) for any third-party analytics or advertising script that sets cookies.

2.6 Scanned Site Owners (Non-Users)

The website scanner analyses domains submitted by our users, who are not necessarily the owner of the scanned site. For a scanned site itself, we only ever collect the public, technical signals described in 2.1 above — HTML, HTTP headers, DNS records, IP/ASN and hosting information. We do not perform WHOIS lookups for registrant names or contact details, and we do not harvest e-mail addresses from scanned pages.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing technology-detection results about publicly accessible websites.

2.7 Ratings of AI Website Detector

If you rate AI Website Detector, we process your star rating, your e-mail address, an optional comment, first name and city/country, the page you rated it from, and a shortened hash of your IP address (used only to limit abuse). We use your e-mail address to send you one confirmation link: a rating only counts once you have clicked it. If we reply publicly to your comment, we also notify you by e-mail. Your e-mail address is never shown publicly; the rating, comment, first name and city/country are shown on our ratings page once the rating is confirmed and approved, and the average of all such ratings is published as the site rating.

Legal basis: Art. 6(1)(a) GDPR (your consent when you submit the form) for publishing your rating; Art. 6(1)(f) GDPR — legitimate interest in keeping ratings genuine and preventing fake or repeated ratings. Ratings that are not confirmed are deleted automatically after 7 days.

3. Third-Party Service Providers

We use the following third-party processors to operate the Service. Where providers are based outside the EU/EEA, data transfers are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards.

We do not sell personal data to any third party.

4. Cookies and Session Storage

We use cookies only where strictly necessary:

• Session cookie (next-auth) — set when you log in to your account or the admin dashboard. Contains an encrypted session token. Expires when you close your browser or after 30 days if “Remember me” is selected.
• Google AdSense (advertising) — we use Google AdSense to serve ads. AdSense may set cookies for ad delivery, frequency capping, and measurement. For full details, see Google’s Privacy & Terms.

Legal basis for advertising cookies: Art. 6(1)(a) GDPR — your consent.

5. Data Retention

• Scan records — retained indefinitely as anonymised technical data. IP addresses in scan records are not linked to personal accounts and are used solely for rate limiting.
• User accounts — retained for as long as the account is active. You may request deletion at any time (see Section 6).
• Ratings — a rating whose e-mail address is not confirmed is deleted automatically after 7 days. Confirmed ratings are kept until you ask us to remove them (see Section 6).
• E-mail correspondence — deleted once the enquiry is resolved, unless a longer retention period is required by law.
• Delisting requests — if a scanned site's owner submits a removal request (see Section 2.6), we retain the request itself (domain, requester e-mail, reason) for our records after review. If approved, the affected domain is excluded from all public directory pages, search indexing, and — for a full-removal request — future scanning, from that point forward. Existing scan records are not retroactively deleted by a directory-only delisting.

6. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the data we hold about you.
• Right to rectification (Art. 16) — request correction of inaccurate data.
• Right to erasure (Art. 17) — request deletion of your personal data (“right to be forgotten”).
• Right to restriction (Art. 18) — request that we limit how we process your data.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.

To exercise any of these rights, contact us at kontakt@aiwebsitedetector.com. We will respond within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority. In Germany, this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach.

If you are the owner of a scanned website rather than a registered user of the Service, the channel above is for account-related requests. To request removal of your site from our public directory pages or from future scanning, use /manage-listing instead — see Section 2.6.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights:

• Right to know — request disclosure of the categories of personal information we collect, the sources, and the third parties we share it with (see Section 3).
• Right to delete — request deletion of personal information we hold about you.
• Right to opt out — opt out of the “sale” or “sharing” of personal information.
• Right to non-discrimination — we will not deny you service or charge a different price for exercising these rights.

We do not sell personal information for monetary consideration. Third-party advertising cookies used by Google AdSense (Section 4) may constitute a “share” under the CPRA’s broad definition. You can opt out via your cookie consent choices on this site, through Google Ads Settings, or via www.aboutads.info. To exercise any of these rights, contact us at kontakt@aiwebsitedetector.com.

8. Children’s Privacy

The Service is not directed at children, and we do not knowingly collect personal information from anyone under the age of 13 (or the applicable minimum age in your jurisdiction). If you believe a child has provided us with personal information, contact us at kontakt@aiwebsitedetector.com and we will promptly remove it from our records.

9. Security

We implement appropriate technical and organisational measures to protect your data, including TLS encryption for all data in transit, bcrypt password hashing, and database access restricted to authorised infrastructure only.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date at the top of the page will always reflect the most recent revision. For significant changes, we will notify registered users by e-mail.

9. Contact

For all privacy-related enquiries: kontakt@aiwebsitedetector.com

See our Impressum for full contact and legal details.