Privacy Policy

1. Data Controller

CSP Warden is the data controller for personal data collected through your account registration, platform usage, and direct communications with us.

When processing CSP violation reports submitted by your website visitors' browsers, CSP Warden acts as a Data Processor on your behalf. In this context, you (the CSP Warden customer) are the Data Controller for your visitors' data. See Section 10 for details.

For privacy-related enquiries, contact us at [email protected].

2. Information We Collect

We collect the following categories of information:

Account Information

When you register for an account, we collect:

• Email address
• Username
• First and last name
• Password (cryptographically hashed - never stored in plaintext)

CSP Violation Reports

When your website visitors' browsers detect a Content Security Policy violation, they automatically send a report to our servers. These reports contain:

• Blocked URI (the resource that was blocked)
• Document URI (the page where the violation occurred)
• Effective and violated CSP directives
• The original CSP policy at the time of violation
• Referrer header value
• Source file, line number, and column number (if applicable)
• User agent string (browser identification)
• IP address of the reporting browser
• The full raw CSP report body (JSON)

Note: CSP reports are sent automatically by browsers and may inadvertently contain personal information embedded in URLs, such as user identifiers or session tokens in query strings.

Domain Configuration Data

• Domain names and display names
• Report URI tokens and verification tokens
• Cloudflare API tokens (encrypted at rest)
• Cloudflare zone identifiers
• CSP policies and scan results

Subscription and Billing Data

• Subscription plan, billing cycle, and status
• Stripe customer and subscription identifiers
• Invoice records (amounts, dates, status)

CSP Warden does not store credit card numbers, bank account details, or other direct payment information. All payment processing is handled by Stripe, which is PCI DSS compliant.

Audit and Activity Logs

• Actions performed on the platform (logins, setting changes, domain operations)
• IP addresses associated with each action
• Timestamps

Email Communication Logs

• Recipient email address
• Email subject and template name
• Delivery status (sent, failed, queued)

Technical Data

• Last login IP address
• Device fingerprint hash - a client-side fingerprint is generated for session security purposes. This hash is not stored in our database.

3. How We Use Your Information

We use the information we collect for the following purposes. The lawful basis for each is noted in parentheses.

• Provide, operate, and maintain the CSP monitoring service (contract)
• Process subscription payments and manage billing (contract)
• Send service-related communications such as verification emails, password resets, and subscription notifications (contract)
• Monitor and analyse CSP violation patterns to help you improve your website security (contract / legitimate interest)
• Detect and prevent fraud, abuse, and unauthorised access (legitimate interest)
• Maintain audit trails for security and compliance purposes (legitimate interest)
• Improve and develop our platform (legitimate interest)
• Respond to support enquiries and contact form submissions (legitimate interest)
• Send optional notifications such as weekly or monthly digests and newsletters (consent, where opted in)

4. Lawful Basis for Processing

Under the GDPR, we rely on the following lawful bases for processing your personal data:

• Contract performance - Processing that is necessary to fulfil our service agreement with you, including account management, service delivery, and billing.
• Legitimate interests - Processing that supports our legitimate business interests, including security monitoring, fraud prevention, service improvement, and audit logging. We balance these interests against your rights and expectations.
• Consent - Processing based on your explicit opt-in, such as marketing communications, newsletter subscriptions, and optional notification preferences. You may withdraw consent at any time.
• Legal obligation - Processing required to comply with applicable laws, such as tax record-keeping and billing compliance.

5. Data Sharing and Third Parties

We share personal data with the following third-party processors, solely to provide and operate the Service:

• Stripe - Payment processing. Stripe processes your payment card information directly. CSP Warden does not have access to your full card details. Stripe's own privacy policy governs data they collect.
• Cloudflare - Optional CSP deployment via Cloudflare Transform Rules. Only activated when you explicitly connect your Cloudflare account. Your Cloudflare API token is stored encrypted at rest. Only domain and CSP policy data is shared with Cloudflare - no personal data.
• Email service provider (SMTP) - Email delivery for transactional emails including verification, password resets, and notifications.
• Cloudflare Turnstile - CAPTCHA verification on the contact form only. No tracking cookies are placed.

We do not sell, rent, or trade your personal data to third parties.

We may disclose information if required to do so by law, or if we believe in good faith that such action is necessary to comply with legal proceedings, a court order, or to protect our rights, property, or the safety of our users.

6. International Data Transfers

CSP Warden's infrastructure is hosted in the European Economic Area (EEA). Some of our third-party processors (including Stripe and Cloudflare) may process data in the United States or other countries outside the EEA.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.

You may request further details about international transfers by contacting us at [email protected].

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy. Specific retention periods are:

8. Cookies and Similar Technologies

CSP Warden uses only essential and functional cookies. We do not use advertising, marketing, or third-party analytics tracking cookies.

Device Fingerprinting

A client-side fingerprint hash is generated in your browser for session security purposes. This fingerprint is not stored as a cookie or in our database. It is used solely for request identification and is not used for advertising or cross-site tracking.

9. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data:

1. Right of Access - Request a copy of the personal data we hold about you.
2. Right to Rectification - Request correction of inaccurate or incomplete data.
3. Right to Erasure - Request deletion of your personal data ("right to be forgotten").
4. Right to Restrict Processing - Request that we limit the processing of your data in certain circumstances.
5. Right to Data Portability - Receive your personal data in a structured, machine-readable format.
6. Right to Object - Object to processing based on legitimate interests.
7. Right to Withdraw Consent - Withdraw consent at any time for any consent-based processing, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days of receiving your request.

You may also delete your account at any time through your account settings, which will remove your personal data and associated domains in accordance with our retention policy.

10. CSP Reports and Your Website Visitors

When you configure your website to use CSP Warden as a reporting endpoint, your visitors' browsers will automatically send CSP violation reports to our servers. These reports may contain URLs, IP addresses, user agent strings, and referrer information belonging to your website visitors.

In this context:

• You (the CSP Warden customer) are the Data Controller for your visitors' data.
• CSP Warden acts as a Data Processor, processing this data solely to provide the violation monitoring service to you.

As the Data Controller, you are responsible for:

• Ensuring you have a lawful basis to collect and transmit CSP violation data to our platform
• Informing your website visitors that CSP reports are being collected and sent to a third-party processor
• Including appropriate disclosures in your own privacy policy

Browsers apply cross-origin truncation to CSP reports, meaning the blocked URI is reduced to its scheme, host, and port when the violation originates from a different origin. This partially mitigates the amount of personal data included in reports.

11. Automated Decision-Making

CSP Warden does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. Features such as security scores and readiness scores are informational tools designed to help you assess your website's CSP configuration - they are not automated decisions about individuals.

12. Children's Privacy

CSP Warden is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

13. Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data. These include:

• Encryption of all data in transit (HTTPS enforced)
• Passwords are cryptographically hashed and never stored in plaintext
• Sensitive credentials are encrypted at rest
• Security tokens are stored as one-way hashes
• CSRF protection on all mutating requests
• Secure cookie configuration for session management
• Strict transport security headers enforced

For more details about our security practices, visit our Security page.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

We encourage you to review this page periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

15. Complaints and Supervisory Authority

If you are unsatisfied with how we handle your personal data, we encourage you to contact us first at [email protected] so we can try to resolve the issue.

You also have the right to lodge a complaint with your local data protection supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO).