Privacy policy

SymbolicLabs UG (haftungsbeschränkt) & Co. KG, Harksheider Str. 3, 22889 Tangstedt-Wilstedt, Germany, represented by SymbolicLabs Verwaltungs UG (haftungsbeschränkt), in turn represented by its managing director Kian Shahriyari. Email: info@symboliclabs.de, phone +49 40 52 47 017 40.

For the rest of our website, our German privacy policy applies.

• You give us the address of a website. Our server reads what is publicly visible on it and returns a result. We need no login and no access to the site.
• We keep the address and the result for 7 days, then delete them.
• Without an account, we do not know who you are. We ask for your email address only if you request the report or a notification yourself.
• We do not receive your ChatGPT conversation, and we do not track you across websites.

What we process: the address you enter, the result of the check and an internal check ID. The result contains only what the website shows publicly, such as the WordPress version, detected plugins and themes, missing security settings and the number of known vulnerabilities. If the site exposes usernames, the result names only how many there are, never the names.

Why: to run the check, show you the result and let you open it again via its link. If the same site was checked in the past ten minutes, we show that result instead of checking again.

How long: 7 days, then the address and the result are deleted automatically. Anyone who has the link to a result can open it during that time.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in offering the check and answering your request.

The checked website receives up to 16 requests from our server, which identifies itself as the SymbolicLabs check service. It does not learn who started the check.

ChatGPT is a service of OpenAI. When you use our plugin, OpenAI processes your conversation under its own privacy policy. We receive only what the plugin needs: the address to be checked and technical details that ChatGPT sends with each call.

• Language setting: so that the result is in your language.
• Anonymous user ID from ChatGPT: to limit each user to five checks in ten minutes. We keep it only as a one-way hash, in memory and for ten minutes, and never write it to disk or logs.
• Country: recorded in our logs together with the outcome of the call, to see where the plugin is used.

ChatGPT also sends a session ID, its version, your time zone and an approximate location (region, city and coordinates). We do not use, store or log any of these.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in providing the plugin and protecting it from misuse.

To protect the check from automated misuse, we use Cloudflare Turnstile and count checks per IP address: at most five in ten minutes. The counter lives in memory only and is gone after ten minutes. We describe Cloudflare in section 9.

We measure how our pages are used with Swetrix, a cookieless analytics tool we host ourselves in Germany. On the result pages, it records whether a result was shown, its rating, the language, whether you see the agency or the international version, and whether you came from ChatGPT or a shared link. It records neither the checked address nor the content of forms.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure service and in understanding how it is used.

On a result page, you can request the detailed report or ask to be notified when ongoing monitoring becomes available. Only then do we process:

• your email address, and your name and company if you enter them,
• the check the request belongs to, whether it started on our website or in ChatGPT, and the version of the consent text you agreed to,
• your IP address, to allow at most five requests in ten minutes. It is counted in memory only and not stored.

If the check was started in ChatGPT, the form also asks for a Cloudflare Turnstile check. Our check service passes the request, together with the full result of the check, to our own customer management system and deletes it from the check service as soon as it has been delivered. We use the data to write the report, send you the report or the notification and contact you about it.

How long: until you withdraw your consent or the purpose no longer applies, at the latest twelve months after our last contact unless it leads to a project.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, for example by email to info@symboliclabs.de.

For every completed check, we keep a statistics record: the month, the score and rating, the detected WordPress, plugin and theme versions and the types of findings. It contains no address, IP address, email or check ID. To count each website only once, the record is keyed by a secret-key hash of the website’s domain. Whoever holds the key could find the record for a known domain, so we treat the records as pseudonymised and use them only for aggregate figures, such as the share of outdated sites.

How long: without a fixed limit, as long as we evaluate the figures.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in evaluating and improving the check.

Our check service writes a log entry for every request: time, path, status and duration. Each check adds the checked domain and its outcome; each ChatGPT call adds the language, country and outcome. The logs contain no IP addresses, emails or ChatGPT IDs. They serve to run and secure the service, based on Art. 6(1)(f) GDPR.

• Cloudflare, Inc., USA: delivers our website and the check service and provides Turnstile. Cloudflare processes your IP address and technical connection data. It is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses apply in addition.
• OVH SAS, Roubaix, France: hosts the server of the check service in its data centre in Gravelines, France.
• netcup GmbH, Karlsruhe, Germany: provides the servers in Germany on which we run our website and our customer management system ourselves.
• OpenAI, when you use the check in ChatGPT. OpenAI is a separate controller for your conversation.
• wordpress.org and Wordfence are data sources only. We ask wordpress.org for the current versions of plugin names and download Wordfence’s vulnerability database. Neither learns which websites are checked or who checks them.

Under the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent at any time. You can object at any time to processing based on our legitimate interest. Write to info@symboliclabs.de.

You also have the right to lodge a complaint with a supervisory authority, for example the one responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de.

The check is not directed at children. Our plugin in ChatGPT is meant for users aged 13 and over.

We update this policy when the check changes. The current version is always on this page.

Last updated: 14 October 2026