Privacy policy

1. Controller

Controller within the meaning of the GDPR:

Erle-IT
Owner: Lennart Erhard
Obere Bahnhofstraße 9
85604 Zorneding
Phone: +49 8106 928 9493
Email: security@plugthebug.de

For questions about data protection, requests for information and objections, you can reach us directly at security@plugthebug.de.

2. The key points at a glance

• This website does not set any cookies and does not store anything in your browser.
• We do not use any tracking, analytics or marketing services and do not embed any third-party content (no external fonts, maps or videos).
• Form data is not collected in a database on the website but is sent to us by email. Exceptions (confirmation links, records of consent, protection against misuse) are described below.

3. Hosting and server logs

This website is operated on a dedicated server rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. Hetzner only provides the server infrastructure and, as a data centre service provider, is a processor within the meaning of Art. 28 GDPR. The server is located in Germany.

When you access the website, your browser automatically transmits the following data to the server:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Referrer URL (previously visited website)
• Browser and operating system used

This data is stored in server log files and automatically deleted after 14 days at the latest. Form contents are not logged; error logs of the forms do not contain any personal data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operational security and error diagnosis).

4. SSL/TLS encryption

For security reasons and to protect the transmission, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar begins with “https://”.

5. Contact form and email contact

If you contact us via the contact form or by email, we process the data you provide (name, company, email address, website, optionally phone number, subject and message) in order to handle your enquiry. The message is transmitted in encrypted form and forwarded by email to our mailbox (see section 12); it is not stored on the website itself.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns our services (pre-contractual measures), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The data is deleted as soon as it is no longer required to achieve the purpose, at the latest after the statutory retention periods have expired.

We do not send you an automatic acknowledgement of receipt. If you have also ticked a consent to marketing in the contact form, we send you a confirmation email solely for that purpose, without the content of your message (see section 10).

6. Check request with double opt-in

You can submit a non-binding request via the check form “Get your website checked for free”. In doing so, we process: website address, company, name, email address, optionally the desired package and phone number, as well as information on which agreements and consents you have ticked.

After you submit the form, we send you a confirmation email (double opt-in). It only contains the domain to be checked, a confirmation link and, where applicable, the wording of the consent to marketing you have given. Until confirmation, we store your details in a protected area of our server outside the public web directory. The link is valid for 48 hours and can only be used once. If you do not confirm, the details are deleted once the 48 hours have expired; nothing is then forwarded and no consent is stored.

After confirmation, we forward the request by email to our mailbox and place it in an internal queue on our server for processing. In addition, as a record we store the time of the request and of the confirmation, your email address, the boxes ticked, the version of the consent text and of the General Terms and Conditions, and your IP address in pseudonymised form (as an HMAC with a secret key, not in plain text).

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). We store the record of the confirmation and of the accepted General Terms and Conditions on the basis of Art. 6(1)(f) GDPR (legitimate interest in being able to document the process). If no contract is concluded, we delete the request data as soon as it is no longer required; for records of consent, see section 10.

7. Protection against misuse and limiting requests

To prevent automated misuse of the forms, we use a field that is invisible to humans (honeypot) and a time check: a small script notes in the form when the page was loaded and discards requests that are submitted in less than three seconds. Nothing is stored in your browser in the process.

We also limit the number of requests per IP address and per domain checked. For this purpose, we do not store your IP address in plain text but only as an HMAC value with a secret key that changes daily. These entries are deleted after 24 hours. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of our service and in preventing misuse).

8. Performing the checks and reports

If you commission us, we regularly access the website you have named from the outside and only evaluate publicly accessible content and configurations. This may also involve processing personal data that is publicly available on the website (for example, names and contact details in the legal notice). From the results, we create findings and reports, which we send to the agreed email address.

The reports are created with the help of AI.

AI service: For the AI-supported evaluation (our systems “Prüfy” and “Meldy”), we use the Grok language model via the application programming interface of SpaceX Super Intelligence LLC (“SpaceXSI”, formerly xAI), USA. Its representative in the EU under Art. 27 GDPR is Lionheart Squared (Europe) Ltd, 2 Pembroke House, Upper Pembroke Street 28-32, Dublin, D02 EK84, Ireland. The data processed includes the content and measurement results of the checked website, the domain and the email address to which the report is to be sent, as well as personal data that is publicly available on the website. The provider processes the data as a processor on the basis of a contract under Art. 28 GDPR. Processing takes place in the USA; the transfer is safeguarded by the Standard Contractual Clauses of the EU Commission (Module 2) under Art. 46(2)(c) GDPR. According to the provider’s contractual terms, the content transmitted is not used to train AI models and is deleted no later than 30 days after processing.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We retain invoices and tax-relevant documents under Art. 6(1)(c) GDPR within the scope of the statutory retention obligations. We store reports and check data for the duration of the contractual relationship and delete them afterwards, unless statutory retention obligations apply.

9. Notice emails to businesses

If we notice significant security findings on a publicly accessible company website, we send the business operating it a one-off notice email without advertising (sent by our notification system “Meldy”). We provide the following information in accordance with Art. 14 GDPR because we have not collected the data from you directly.

• Which data: domain and name of the business, the contact email address and, where applicable, a name given there, as well as the findings concerning the website.
• Source: the address comes from publicly accessible sources on the checked website itself, namely from the security.txt (a file in which website operators provide a contact address for security reports) or from the legal notice (Impressum).
• Purpose: a one-off notice of significant security findings. If you reply, we will re-check the website free of charge.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and that of the business, lies in drawing attention to recognisable security risks before they are exploited.
• Objection: you can object to further notices at any time under Art. 21 GDPR, by replying to the notice email or by writing to security@plugthebug.de. We will then put the domain and the address on a block list so that you do not receive any further notices. We store the block list for as long as it is necessary for this purpose.
• Recipients: we evaluate the findings using the AI service named in section 8.
• Storage period: we store notice emails and the associated findings for 12 months after sending and delete them afterwards. If you have objected, only the entry on the block list is retained.

More on this, including for recipients of such an email: Received a notice email?

10. Marketing by email or phone with consent

If you have ticked a consent to marketing in the check form or in the contact form, we will inform you by email or by phone about the PlugTheBug check packages, Consulting services and IT security and website services from Erle-IT. The consent is voluntary and not a prerequisite for a check. It only takes effect once you open the link in the confirmation email and submit the confirmation (double opt-in).

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 7 UWG (German Act against Unfair Competition). You can withdraw it at any time with effect for the future, via the unsubscribe link in every marketing email or by email to security@plugthebug.de. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Marketing ends immediately upon withdrawal. We then retain the record of consent (time of request and confirmation, email address, wording version “einwilligung-v2”, pseudonymised IP address) and the date of withdrawal for a further three years in order to be able to prove that the marketing was lawful and to defend against claims. The legal basis for this is Art. 6(1)(f) GDPR.

11. Marketing to existing customers

If you take out a paid package, we use the email address obtained in this context to occasionally inform you about further PlugTheBug check packages and Consulting services (§ 7(3) UWG). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is informing existing customers about similar services of our own. You can object to this at any time without incurring any costs other than the transmission costs at the basic rates: via the unsubscribe link in each of these emails or by email to security@plugthebug.de.

12. Sending and receiving emails

We send automatic emails from this website (double opt-in confirmation emails, forwarding of confirmed requests to our mailbox) via an email mailbox of Erle-IT at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, using an encrypted connection. Hetzner processes the data as a processor under Art. 28 GDPR.

For receiving emails to addresses @plugthebug.de and for reports and correspondence, we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data as a processor on the basis of a contract under Art. 28 GDPR. A transfer to Microsoft Corporation in the USA cannot be ruled out; it is based on the EU-US Data Privacy Framework and, additionally, on Standard Contractual Clauses of the EU Commission. The legal basis is Art. 6(1)(b) or (f) GDPR (legitimate interest in secure, reliable email communication).

13. Your rights

You have the right:

• under Art. 15 GDPR, to request information about your personal data processed by us,
• under Art. 16 GDPR, to request the correction of inaccurate data or the completion of your stored data,
• under Art. 17 GDPR, to request the erasure of your personal data stored by us,
• under Art. 18 GDPR, to request the restriction of processing,
• under Art. 20 GDPR, to receive your data in a structured, commonly used and machine-readable format (data portability),
• under Art. 7(3) GDPR, to withdraw consent you have given at any time with effect for the future.

To exercise your rights, please contact: security@plugthebug.de

14. Right to object under Art. 21 GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. You can object to processing for the purpose of direct marketing (including marketing to existing customers) at any time without giving reasons; we will then no longer process your data for this purpose. An informal objection to security@plugthebug.de is sufficient.

15. Right to lodge a complaint with the supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach
Phone: +49 981 180093-0
Web: www.lda.bayern.de

16. Currency of this privacy policy

This privacy policy is dated November 2026. We will adapt it if our services or the legal situation change.