Privacy policy

As of October 2026. This is a translation; the German version is legally binding.

1. Controller

ECODYNAMICS GmbH

Rheinpromenade 9

40789 Monheim am Rhein, Germany

Managing director: Hamidreza Hosseini

Email: info@ecodynamics.de

Phone: +49 (2173) 297 2024

2. Overview

Webcheck is an AI readiness checker for websites. Using 68 criteria in four areas (REACH, UNDERSTAND, TRUST, RECOMMEND), we assess how well AI-powered search engines find, understand, trust, and recommend a website.

In doing so, we process personal data of our users (account data, usage data) as well as technical data of the analyzed websites (publicly accessible website content). This policy explains which data we collect, for what purpose, and on what legal basis.

3. Hosting & infrastructure

Railway (application)

The Webcheck application runs in Docker containers on Railway. The server location we use is Amsterdam, Netherlands (EU). Provider: Railway Corporation, San Francisco, USA. A data processing agreement (DPA) is in place. Application data does not leave the EU location.

Supabase (database & auth)

For the database (PostgreSQL), authentication, storage, and realtime features we use Supabase in the eu-central-1 (Frankfurt) region. Provider: Supabase Inc., San Francisco, USA. A data processing agreement (DPA) is in place. All data is stored and processed exclusively in the EU.

No personal data is transferred to third countries for hosting and data storage.

4. Data we collect

Account data

Email address (for sign-in and communication)
Password (stored as a bcrypt hash via Supabase Auth; the plain-text password is never stored)
Language setting (German or English)

Organization data

Company name and logo (optional)
Team members: email addresses, roles (admin, manager, editor, viewer), departments

Website analysis data

URLs of the websites to be analyzed (entered by the user)
Crawl results: HTTP status codes, page types, scores per criterion
HTML content of crawled pages (temporary, for analysis; not stored permanently)
Schema.org data, meta tags, and performance metrics of the analyzed pages

Usage data

Sign-in times
IP address (logged automatically by Supabase Auth)
Session information (auth token)

5. Cookies & tracking

Cookies we use

Supabase Auth session cookie: functional and technically necessary for authentication. It is set when you sign in and is required to operate the application. Legal basis: Art. 6 (1)(b) GDPR (performance of a contract) and § 25 (2) TDDDG (technically necessary).
Language setting (cookie “locale”): stores whether you use Webcheck in German or English. It contains only “de” or “en”, lasts one year, and is technically necessary to keep your chosen language. Legal basis: § 25 (2) TDDDG.

Local storage

Theme preference: stored in your browser’s localStorage (light, dark, or system). It is not a cookie, and no data is sent to a server.

No tracking

We use no Google Analytics, no advertising trackers, no social media pixels, and no other tracking services. No profiling takes place.

6. Contact form and requests

The home page has a contact form. We store a request in our database and send it by email to our mailbox info@ecodynamics.de, but only after you have confirmed it via a link.

After the confirmation you receive a short acknowledgement by email. The emails to you do not contain your entries.

Confirmation procedure

Before sending, you confirm via a mandatory checkbox that you have taken note of this privacy notice. The box is not pre-ticked; it is an acknowledgement, not consent.

After sending, we store the request as unconfirmed and send an email with a link to the address you entered. The link is valid for 48 hours and only once. The request only reaches us once you open the link and choose “Confirm request” there.

This ensures that nobody makes requests with your address and that our form cannot be used to deliver messages to other people’s mailboxes. Without confirmation we forward nothing and delete the details after the link expires. We send at most three such emails per address and day.

As proof (Art. 5(2) GDPR) we store the time the mandatory checkbox was confirmed, the version of its wording, the language and the time of confirmation via the link. We do not store an IP address for this; of the link itself only a check value (SHA-256).

Protection against automated requests

The form contains a field that is invisible to humans and is limited in number per IP address. In addition, there is a security check using the open-source software ALTCHA, which we operate ourselves: when sending, your browser solves a small computing task set by our server, and our server checks the solution.

The security check sets no cookies, writes nothing to your browser’s storage, creates no fingerprint of your device and transfers no data to third parties. So that a solution can only be used once, the server keeps the signature of the task until it expires (ten minutes), without any reference to your person.

For the rate limits we count requests for the security check, submissions and confirmations per IP address, and confirmation emails per email address. We store neither the IP address nor the email address in plain text, only a shortened check value formed with a secret key (HMAC-SHA-256), together with a counter and the start of the time window.

The time windows last at most one day. We delete these entries automatically 48 hours after the start of their time window.

Purpose: answering your request, initiating and performing a contract; protection against requests made with someone else’s address and against automated abuse.
Data: name, company, email address, optionally a phone number, message, language, timestamps and the details of the confirmation procedure; for the rate limits, a check value of your IP address and of your email address (HMAC).
Legal basis: Art. 6(1)(b) GDPR where the request aims at a contract; otherwise Art. 6(1)(f) GDPR (answering business requests, protection against abuse). The security check is strictly necessary to provide the form securely (Section 25(2) no. 2 TDDDG).
Retention: unconfirmed requests until the link expires (48 hours); completed ones twelve months after completion; all others no later than 24 months after receipt; check values for the rate limits 48 hours after the start of their time window. If a contract results, the statutory retention periods apply (Section 257 HGB, Section 147 AO).
Recipients: Supabase (database), Railway (operation), Resend, Inc., USA (sending the emails) and Microsoft, which hosts our mailbox. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and, in addition, the EU standard contractual clauses.

Balancing of interests: You contact us on your own initiative and expect an answer. We use your details only for that and for follow-up questions on the same matter, not for advertising. In our assessment, your interests therefore do not prevail.

7. Third-party services

Supabase (authentication, database, storage)

Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 / San Francisco, CA, USA.

Purpose: user authentication, data storage, file storage (reports).

Data processed: email, password hash, IP address, session data, all application data.

Legal basis: Art. 28 GDPR (data processing). Data location: EU (Frankfurt, eu-central-1).

Anthropic Claude API (AI rating)

Provider: Anthropic PBC, San Francisco, CA, USA.

Purpose: AI-assisted rating of website content against the 68 Webcheck criteria.

Data processed: only publicly accessible content (HTML text, metadata) of the websites being analyzed. No personal data of our users is sent to Anthropic.

Legal basis: Art. 6 (1)(b) GDPR (performance of a contract) and Art. 6 (1)(f) GDPR (legitimate interest in providing the core functionality).

Third-country transfer (Schrems II): Anthropic processes data in the USA. Transfers are based on the EU Standard Contractual Clauses (SCC, Module 2, controller to processor, Implementing Decision (EU) 2021/914). Anthropic is certified under the EU-U.S. Data Privacy Framework (DPF list). Additional safeguards: TLS 1.3 transport encryption, no training on API data under the Anthropic terms, data retention at Anthropic of 30 days or less. Users can view the DPA on request.

Railway (hosting)

Provider: Railway Corporation, San Francisco, CA, USA.

Purpose: hosting the Webcheck application and the website scanner in Docker containers.

Data processed: IP addresses, HTTP requests, application logs.

Legal basis: Art. 28 GDPR (data processing). Server location: Amsterdam, Netherlands (EU).

8. Legal bases (Art. 6 GDPR)

Art. 6 (1)(a) GDPR (consent): where you have given us consent to process data, for example for optional notifications.
Art. 6 (1)(b) GDPR (performance of a contract): processing is necessary to perform the user agreement (account creation, website analysis, report generation).
Art. 6 (1)(f) GDPR (legitimate interest): ensuring operation, fixing errors, preventing abuse, improving the service.

9. Your rights

As a data subject, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): You can request information about your personal data that we process.
Right to rectification (Art. 16 GDPR): You can request that incorrect data be corrected.
Right to erasure (Art. 17 GDPR): You can request that your data be deleted. You can delete your account at any time in the settings.
Restriction of processing (Art. 18 GDPR): You can request that the processing of your data be restricted.
Data portability (Art. 20 GDPR): You can receive your data in a structured, commonly used, and machine-readable format.
Right to object (Art. 21 GDPR): You can object to the processing of your data where it is based on Art. 6 (1)(f) GDPR.

To exercise your rights, please email the address given in section 1. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Retention periods

Account data: stored until you delete your account. After deletion, all personal data is removed within 30 days.
Crawl and analysis data: results (scores, evidence) are kept for 90 days. Temporary HTML content is deleted once the analysis is complete.
Server logs: kept for 30 days and then deleted automatically.
Reports: stored until deleted by the user or until the account is deleted.
Contact requests: unconfirmed ones once the confirmation link has expired (48 hours), completed ones twelve months after completion, all others no later than 24 months after receipt (see section 6).

11. Data security

We use extensive technical and organizational measures to protect your data:

Encryption: all data is transmitted exclusively via TLS 1.3 (HTTPS). Data is encrypted in transit and at rest.
Row Level Security (RLS): Supabase RLS ensures that users can only access data of their own organization.
Password hashing: passwords are hashed with bcrypt. The plain-text password is never stored.
Service key separation: the Supabase service role key is used only on the server and is not accessible in the frontend.
Input validation: all user input is validated on the server with Zod schemas.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy to reflect changes in the law or in the service. The current version is always available on this page. We inform registered users of material changes by email.