Privacy policy
Updated November 3, 2026. Short version: we keep what the test needs, and your findings are private to your link.
What we collect
- The domain you scan and the results: the checks, findings and evidence (requests and responses, with secrets redacted).
- A one-way hash of your IP address, to limit how many scans one person runs. We don’t keep the address itself.
- When you buy: the email address Stripe gives us with the payment, the amount and the payment’s ID. Card details go to Stripe and never reach us.
- Basic visit counts (pages viewed, scans started, reports bought) through Towers’ analytics, without advertising cookies.
What we do with it
We use it to run the test, show you the report, take payment, answer support and keep the service from being abused. We don’t sell it and we don’t share findings with anyone.
Who processes it
Towers hosts the site and database. Stripe takes payments. Anthropic’s Claude writes the report’s summary from the findings; we send it the findings, not your email. OSV.dev receives the names and versions of JavaScript libraries we find, to look up vulnerabilities.
How long we keep it
Free scan results: 90 days. Paid reports: as long as you may need them for an audit, up to three years, or until you ask us to delete them.
Your rights
Write to hello@pentrail.thetowers.ai from the email you paid with (or with your report link) to get a copy of your data or have it deleted.