Privacy policy.
This policy explains how personal data is collected, used, and protected when you use CSP Logger (the "Service") at csplog.io and app.csplog.io. We aim for plain language over legalese; if anything is unclear, email privacy@csplog.io.
1. Who is responsible for your data
The data controller is Lova Labs, a sole proprietorship (eenmanszaak) established in the Netherlands, registered with the Dutch Chamber of Commerce under KvK 42103900. Lova Labs operates CSP Logger.
We have not appointed a Data Protection Officer, as we are below the thresholds that require one. For any data-protection matter, contact privacy@csplog.io.
2. What personal data we collect
2.1 Account data
Your email address, a hashed password, and the IP address recorded at registration.
2.2 Violation report data
When your website's browser sends a Content Security Policy violation report, we receive fields including document-uri, blocked-uri, referrer, violated-directive, and source-file.
We discard the query string. document-uri and referrer name pages on your own site, and page URLs commonly carry session tokens, password-reset tokens and email addresses in their query string. Everything after the first ? or # is stripped before the report is stored, so https://example.com/account?session=… is retained as https://example.com/account. We keep the path, because "which pages does this violation fire on" is the question the product exists to answer — so please keep secrets out of your URL paths as well as your query strings.
Reports may also include a sample field: a short snippet (up to about 40 characters) of the inline script or style that was blocked. This is the most sensitive data we handle, because a snippet can incidentally contain text from your page. You control what your pages emit, so we recommend scoping CSP monitoring away from pages that render payment details or other personal data. See "Your responsibilities" below.
2.3 End-user IP addresses
When a violation report is received, the end-user IP address is visible to Cloudflare, which sits in front of our reporting endpoint, and to Hetzner, which hosts it in Germany. It may appear briefly in Cloudflare's edge logs, retained only for the limited period set by Cloudflare's log-retention policy. We do not retain end-user IP addresses in our own systems beyond the raw-report processing window (24 hours).
2.4 Billing data
A Paddle customer ID and your subscription state. Payments are handled by Paddle as Merchant of Record, so card and bank details never reach our systems.
3. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service (collect violations, generate policies) | Performance of a contract (Art. 6(1)(b)) |
| Service and security emails (account, billing, incidents) | Legitimate interests (Art. 6(1)(f)) |
| Billing via Paddle | Performance of a contract (Art. 6(1)(b)) |
| Improving our shared filter rules (aggregated, no per-user data shared) | Legitimate interests (Art. 6(1)(f)) |
| Analytics on the marketing site | Consent (Art. 6(1)(a)) |
4. Who we share data with
We do not sell personal data. We share it only with the sub-processors that run parts of the Service, such as hosting, payments, email, monitoring, and the LLM used for policy generation. The full, current list, with each party's role, location, and transfer basis, is on our sub-processors page.
5. AI-assisted policy suggestions
When you commit a Policy, we send to Anthropic (US): (a) your project's registrable domain, (b) the existing CSP header you provided, if any, and (c) an aggregated table of blocked origins per directive with event counts and counts of distinct pages affected. These are counts only, never the URLs themselves.
We do not send: the URLs of pages where violations occurred, end-user IP addresses, the sample field of violation reports, or any other personal data. Anthropic's standard Commercial Terms apply: Standard Contractual Clauses are in place, and Anthropic does not train on data submitted through the API.
This is advisory only. The policy header itself is assembled from the origins you approved, not written by the model; what the model contributes is the identification of unfamiliar origins and the plain-English explanation, both of which are suggestions for you to review. It is not an automated decision that produces legal or similarly significant effects about you, so the automated-decision-making rules in Art. 22 GDPR do not apply.
6. International transfers
Some sub-processors are located outside the EEA (Anthropic, Resend, Sentry, Cloudflare, and Google in the US). These transfers rely on the EU Standard Contractual Clauses in each provider's data-processing terms. Paddle (United Kingdom) is covered by the UK adequacy decision. Details are on the sub-processors page.
7. How long we keep data
- Raw violation reports are deleted within 24 hours of processing.
- Processed violations are kept for your plan's retention window: 30 days on Trial and Starter, 90 days on Professional.
- Account data and generated policies are kept for as long as your account is open, and deleted after you close it (subject to any short audit record of the deletion).
8. Your rights
If the GDPR applies to you, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You can exercise most of these in-app (including deleting your account) or by emailing privacy@csplog.io. We aim to respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Cookies
Our use of cookies and similar technologies, and how to control them, is described in our Cookie Policy.
10. Your responsibilities
You decide which of your pages send violation reports to us. To minimise the personal data that reaches the Service, scope your CSP monitoring away from pages that render payment information, health data, or other sensitive personal data, so such content cannot appear in a report's sample field.
11. Children
The Service is not directed at anyone under 18, and we do not knowingly collect personal data from minors.
12. Changes to this policy
We may update this policy from time to time. The version and date at the top reflect the current version; we will notify you by email of material changes at least 14 days before they take effect.
13. Contact
Questions about this policy or your data? Email privacy@csplog.io.