Privacy policy.
This policy explains how personal data is collected, used, and protected when you use CSP Logger (the "Service") at csplog.io and app.csplog.io. We aim for plain language over legalese; if anything is unclear, email privacy@csplog.io.
1. Who is responsible for your data
The data controller is Lova Labs, a sole proprietorship (eenmanszaak) established at Rietoever 60, 2371 JL Roelofarendsveen, the Netherlands, registered with the Dutch Chamber of Commerce under KvK 42103900, VAT number NL005496650B29. Lova Labs operates CSP Logger.
We have not appointed a Data Protection Officer, as we are below the thresholds that require one. For any data-protection matter, contact privacy@csplog.io.
2. What personal data we collect
2.1 Account data
Your name, your email address, and a hashed password. Alongside these we hold your plan, your trial and subscription state, your notification preferences, and the date and time you accepted our Terms of Service and this policy when you created your account.
2.2 Sign-in session data
While you are signed in to the dashboard, each request updates a session record holding your IP address and browser user-agent string, alongside a session identifier and the time you were last active. This is how the sign-in is kept secure and how unusual access can be recognised. Session records are removed when the session expires, and in any case when your account is closed. We do not record your IP address at registration.
2.3 Violation report data
When your website's browser sends a Content Security Policy violation report, we receive fields including document-uri, blocked-uri, referrer, violated-directive, and source-file.
We discard the query string. Every address in a report is cut before it is stored: document-uri and referrer (pages on your own site), blocked-uri (the resource that was blocked) and source-file (the script that made the request). Page URLs commonly carry session tokens, password-reset tokens and email addresses in their query string, and a tracker or pixel URL can carry a user ID or a hashed email address. Everything after the first ? or # is stripped before the report is stored, so https://example.com/account?session=… is retained as https://example.com/account. We keep the path, because "which pages does this violation fire on" is the question the product exists to answer — so please keep secrets out of your URL paths as well as your query strings.
Reports may also include a sample field: a short snippet (up to about 40 characters) of the inline script or style that was blocked. This is the most sensitive data we handle, because a snippet can incidentally contain text from your page. You control what your pages emit, so we recommend scoping CSP monitoring away from pages that render payment details or other personal data. See "Your responsibilities" below.
2.4 End-user IP addresses
When a violation report is received, the end-user IP address is visible to Cloudflare, which sits in front of our reporting endpoint, and to Hetzner, which hosts it in Germany. It may appear briefly in Cloudflare's edge logs, retained only for the limited period set by Cloudflare's log-retention policy. We do not retain end-user IP addresses in our own systems beyond the raw-report processing window (24 hours).
2.5 Billing data
A Paddle customer ID and your subscription state. Payments are handled by Paddle as Merchant of Record, so card and bank details never reach our systems.
2.6 Site-verification data
To confirm a policy is actually live, we fetch a small set of your own pages: the domains and URLs you register, and the pages your violation reports reveal as ones that matter. We read the HTTP response headers and the page content from that fetch, to check the live header against your latest policy. See "Site checks" in our Terms of Service.
3. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service (collect violations, generate policies) | Performance of a contract (Art. 6(1)(b)) |
| Verifying policy deployment | Performance of a contract (Art. 6(1)(b)) |
| Service and security emails (account, billing, incidents) | Legitimate interests (Art. 6(1)(f)) |
| Billing via Paddle | Performance of a contract (Art. 6(1)(b)) |
| Improving our shared filter rules (aggregated, no per-user data shared) | Legitimate interests (Art. 6(1)(f)) |
| Analytics on the marketing site | Consent (Art. 6(1)(a)) |
4. Who we share data with
We do not sell personal data. We share it only with the sub-processors that run parts of the Service, such as hosting, email, monitoring, and the LLM used to identify unfamiliar origins. The full, current list, with each party's role, location, and transfer basis, is on our sub-processors page.
Paddle is different: it is our Merchant of Record for payments, and for the billing data it handles (your email, billing address, payment details) it acts as an independent controller, not our sub-processor. It decides how that data is used for its own regulatory, tax, and fraud-prevention obligations as the seller of record. See Paddle's own privacy notice for how it handles that data.
5. AI-assisted origin identification
When you ask us to identify the origins on a project, we send to Anthropic (US): (a) the domains configured for that project, and (b) an aggregated table of blocked origins per directive with event counts and counts of distinct pages affected. For each origin the table also gives how many other origins still waiting for your decision were seen on the same page, on how many days it was seen, and how many days ago it was first seen, and the request says once how many days the project has been collecting. An origin is a scheme and a host with no path, the pages are counted rather than named, and time is given in whole days: we never send the URLs themselves or the times of individual reports.
We do not send: the URLs of pages where violations occurred, end-user IP addresses, the sample field of violation reports, or any other personal data. Anthropic's standard Commercial Terms apply: Standard Contractual Clauses are in place, and Anthropic does not train on data submitted through the API.
This is advisory only. The policy header itself is assembled from the origins you approved, not written by the model; what the model contributes is the identification of unfamiliar origins, a suggestion for you to review. It is not an automated decision that produces legal or similarly significant effects about you, so the automated-decision-making rules in Art. 22 GDPR do not apply.
6. International transfers
Some sub-processors are located outside the EEA (Anthropic, Resend, Cloudflare, and Google in the US). These transfers rely on the EU Standard Contractual Clauses in each provider's data-processing terms. Paddle (United Kingdom) is covered by the UK adequacy decision. Details are on the sub-processors page.
7. How long we keep data
- Raw violation reports are deleted within 24 hours of processing.
- Processed violations are kept for your plan's retention window: 30 days on Trial and Starter, 90 days on Professional.
- Account data and generated policies are kept for as long as your account is open, and deleted after you close it (subject to any short audit record of the deletion).
- Verification records and registered key-page URLs are kept for the life of the project, and deleted when your account is closed.
- The registrable domain of a Trial you have used is kept indefinitely after account closure, on its own, with no link to you or any other account data. This is anti-abuse: it is how we recognise that a domain has already had its one free trial, so closing an account cannot be used to trial the same domain again.
- Backups. A full copy of the database is taken nightly and stored in the European Union for 30 days, then deleted. So data you delete can survive in a backup for up to 30 days after it leaves the live database, which is the ordinary trade for being able to recover from a failure at all.
8. Your rights
If the GDPR applies to you, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You can exercise most of these in-app (including deleting your account) or by emailing privacy@csplog.io. We aim to respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Cookies
Our use of cookies and similar technologies, and how to control them, is described in our Cookie Policy.
10. Your responsibilities
You decide which of your pages send violation reports to us. To minimise the personal data that reaches the Service, scope your CSP monitoring away from pages that render payment information, health data, or other sensitive personal data, so such content cannot appear in a report's sample field.
11. Children
The Service is not directed at anyone under 18, and we do not knowingly collect personal data from minors.
12. Changes to this policy
We may update this policy from time to time. The version and date at the top reflect the current version; we will notify you by email of material changes at least 14 days before they take effect.
13. Contact
Questions about this policy or your data? Email privacy@csplog.io.