Privacy Policy
As of 24 August 2026 · Translation of the German privacy policy, which is the binding version.
Controller
Oliver Welsch
Hackenbroicher Str. 58
50259 Pulheim
Germany
info@oliverwelsch.de
Hosting
This website is hosted by Vercel Inc. (San Francisco, California, USA). When a page is requested, technically necessary data (IP address, time, requested resource, browser and device identifiers) is processed in server logs. Legal basis: Art. 6(1)(f) GDPR (DSGVO) — legitimate interest in running the site securely.
Vercel is a processor; a contract under Art. 28 GDPR is in place. The functions of this
site run in the region fra1 — a data centre in Frankfurt am Main. That is
also where the log lines are written. There is a single exception, and it processes no
data about visitors: the fallback fetch described in the next section. The static files
are delivered by Vercel's worldwide edge network, which answers each request at the
nearest location. Vercel Inc. is based in the USA, so access from there cannot be ruled
out; transfers to the USA rest on the EU Commission's Standard Contractual Clauses
(Art. 46(2)(c) GDPR). The level of legal protection there is not equivalent to the EU's.
The same platform briefly retains the functions' operational messages — say, that a confirmation mail went out, or which third-party page has a badge embedded. In individual cases those lines also contain the email address that has just confirmed. They exist for debugging, are not analysed, and expire with the platform's retention — Vercel keeps runtime logs only for a short window of a few days, after which they are gone. Legal basis: Art. 6(1)(f) GDPR.
The scan
When an address is entered, Botlight fetches that page server-side and evaluates it. The report is generated in that moment, goes to the requesting browser and lives there in the tab — it is not stored. There is no database behind this site, no account and no history. Legal basis: Art. 6(1)(b) GDPR (performance of the requested service).
The same applies to the multi-page scan of one domain, which confirmed recipients can trigger: it fetches up to twelve pages of the same website and evaluates them in a single run. The fetch is made by this site's server; the operators of the checked page see the data centre's address, not the address of whoever started the scan.
The fallback fetch from the USA
Some pages reject requests from European data centres and answer the same request from
the USA. Because the answer engines' crawlers mostly come from there, a measurement from
Frankfurt would in those cases show something different from what an answer engine sees.
If a page responds with HTTP 403 or 451, the scan is therefore repeated once from a data
centre in the USA (Vercel, region iad1).
The only thing sent there is the address of the page being checked. IP address, cookies and any email address stay in Frankfurt, because the fallback fetch is started by the Frankfurt function, not by the browser — the US function sees a data centre as its caller, not a person. Its function log keeps one line with the name of the checked page, the response status and the duration. Legal basis: Art. 6(1)(b) GDPR (performance of the requested service); the transfer rests on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
The report does not hide this: if the measurement came from the USA, that appears as its own finding in the “access” section, together with the note that a European visitor may see something different from the measured version.
Cookies
Botlight sets two cookies of its own, both without audience measurement and without
profiling: bl_scans counts a browser's free scans (day's date and count,
signed, lifetime 48 hours), and bl_pass records that this browser has
confirmed an email address and is no longer counted (lifetime one year). Both are
HttpOnly, valid only for this domain, and contain nothing about the pages that were
scanned. They are necessary for the requested service (§ 25(2) no. 2 of the German
Telecommunications Digital Services Data Protection Act, TDDDG); the processing rests on
Art. 6(1)(f) GDPR.
Report by email and newsletter
The report by email and the newsletter use double opt-in: after signing up, an email arrives with a confirmation link that is valid for seven days. Only the click adds the address to the list — until then it is stored nowhere and travels only inside the signed link. To prove consent, the time and IP address of the confirmation are logged, along with the scanned address and its score so the mail can contain the report. Legal basis: Art. 6(1)(a) GDPR (consent).
Sending and list management run through Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin) as a processor; the data is processed on servers within the EU. Every mail contains an unsubscribe link; consent can be withdrawn at any time with effect for the future.
Providing the address is voluntary and required neither by law nor by contract — without it there is no report by email and no Watcher, everything else keeps working. The data is kept until consent is withdrawn; after withdrawal it is deleted, except for the proof of consent, which is retained for another three years to defend against possible claims (Art. 6(1)(f) GDPR).
The mails are measured: a tracking pixel reports whether and when a mail was opened, and the links inside run through a Brevo redirect that records the click. Both are stored with the contact on the list and answer the question of whether the mails arrive and get read. This measurement is pointed out at sign-up and is covered by the consent — legal basis: Art. 6(1)(a) GDPR, for the tracking pixel additionally § 25(1) TDDDG. It ends when consent is withdrawn via the unsubscribe link. If you want to read the mails without being measured, turn off the loading of remote images in your mail client and copy the link addresses instead of clicking them.
The Watcher
Anyone who has confirmed gets the scanned page re-checked once a day. A mail goes out only when an engine verdict flips or the score moves by at least five points. For this, the state of the last alert is stored with the contact on the list (scanned address, score, state of the engines, date of the last check). Every one of those mails carries a link that turns the checks back off. Legal basis: Art. 6(1)(a) GDPR (consent).
The badge
The badge at /api/badge is an image for third-party pages. When it is
requested, Botlight measures the named domain's score afresh; nothing is stored. The
function log keeps one line with the embedding domain and the measured domain — nothing
about the visitors of that page.
The purchase
The Revenue Shield Report is sold through a Stripe-hosted payment page — a payment link or a server-side checkout session that carries the scanned address so it does not have to be typed in again at checkout (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Payment handling, payment data and the invoice sit entirely with Stripe; Stripe's own processing is governed by Stripe's privacy policy. After payment, Botlight receives a notification with the email address and the website given at purchase, and then sends the mail with the report link through Brevo (see above). Nothing is stored here in the process: address and website travel signed inside the link, which expires after seven days, and the report is generated fresh every time it is opened. As with all functions, the function log keeps one operational line about the delivery. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
For payment processing Stripe is an independent controller, not a processor; in the course of it Stripe also transfers data to its US parent company Stripe, Inc., relying on the EU Commission's Standard Contractual Clauses.
What sits in the Stripe account — purchase date, amount, email address, possibly a name and the website given — is at the same time the accounting record. Those details are kept there for the duration of the retention periods under German commercial and tax law; for accounting records that is eight years (§ 147 German Fiscal Code, § 257 German Commercial Code). Legal basis: Art. 6(1)(c) GDPR (legal obligation).
Contact by email
If you write to info@oliverwelsch.de, your message is processed in order to answer it and stays in the mailbox for as long as the matter is open. Legal basis: Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering). If the message concerns a purchase, the retention periods above apply to the records it produces.
Analytics with Plausible
This site measures visits with Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). The service uses no cookies and no form of personal identifier: the IP address is used only for the time it takes to compute a daily-changing hash that recognises returning visitors, and is not stored afterwards. No profiles are built and there is no cross-device tracking; only aggregated values are stored — page views, referring page, rough location and device data, and funnel events (say, “scan started” or “sign-up confirmed”, with coarse extras like score range, page type, error kind or form position — never an email address and never the scanned domain). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous audience measurement); since no one is identifiable, no consent is required. This site uses no ad trackers, no profiling and no analytics cookies for advertising purposes.
No automated decisions about people
The score rates a web page, not a person. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and withdrawal of any consent you have given, with effect for the future (Art. 7(3)). A message to info@oliverwelsch.de is enough.
Objection: Against processing based on legitimate interest (Art. 6(1)(f) GDPR) — here the server and function logs and the counting cookies — you can object at any time under Art. 21 GDPR on grounds arising from your particular situation.
Complaint: With a supervisory authority, for instance the competent State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.
Changes to this policy
This policy describes what the code does, and it changes with it — if a cookie is added, a recipient or a stored field, it shows up here. The version available on this page at any given time is the one that applies; the date at the top says when it was last edited.