Paraaf
Privacy
https://paraaf-psi.vercel.app/en/privacy
Privacy
Privacy
In short: this site doesn’t track you and loads nothing from advertising or analytics companies. Without an account it sets no cookies, asks for no email address and your answers in the business check stay on your device. An account is voluntary. What we keep is set out below.
Last updated on 14 October 2026 (follow-up with Paraaf+ and Pro).
Who is responsible?
Neal Van de Velde (nealvdv), reachable via contact@nealvdv.be.
The business check: in your browser, unless you choose otherwise
What you answer in the business check is kept in your own browser (local storage), so you can continue later. Without an account it is not sent to us. If you sign in and choose to, we also keep the file in your account (see below). If you clear your browser data, the copy in that browser is gone.
What we keep from a website scan
The address of the scanned website, the results of the checks and the time. No copy of the page itself. Every scan is deleted after 30 days. If you run the scan while signed in, we remember that it belongs to your account; your latest three scans are then kept for as long as your account exists. With Paraaf+ or Paraaf Pro all your scans are kept while the subscription runs; after that, the latest three again.
Your IP address
To prevent abuse we count the number of website scans and sign-in links per visitor, and the sign-in links per email address as well. For that we keep an irreversible fingerprint (hash) of your IP address and of that email address, for at most two days. We don’t keep the IP address itself.
An account: voluntary
An account is never needed. If you make one, we keep: your email address, the language you made it in, the business check’s file if you move it into your account yourself (and every change after that), which website scans you made while signed in, and for each signed-in browser when you signed in and last visited. Sign-in links and sign-ins are kept only as an irreversible fingerprint (hash). No name, no password. We use this only to give you the account you asked for (GDPR art. 6(1)(b)), send you only the emails you ask for, and pass nothing on. If you take a subscription, Mollie receives what it needs for the payment (see Paying).
How long we keep account data
A sign-in link works for 15 minutes, once, and is deleted a day later. A sign-in expires after 30 days, or at once when you sign out. Your account, the file in it and the list of your scans are kept until you delete the account.
Take your account with you or erase it
On the account page you download everything we keep about your account as a JSON file (GDPR art. 20), and you delete your account in one confirmed click (art. 17): the account, the file in it, the list of your scans and all your sign-ins are gone at once. The scans themselves then fall back to their usual 30 days. Signing out or deleting leaves the copy in your browser; you erase that on your file’s page. If a subscription is still running, we cancel it at Mollie first. Invoices are kept as the law requires (see Paying).
Paying for Paraaf+ or Paraaf Pro
If you take a subscription, you pay through Mollie B.V. in Amsterdam (the Netherlands), which processes the payments on our behalf. You enter your card or account details at Mollie; we neither see nor store them. We keep: which plan you chose, the amount, the state of the subscription (including the period and when you cancelled), Mollie’s references to your customer record, your payments and your subscription, and the billing details you enter yourself (name, address and, if you have one, VAT number). Mollie receives your name and email address for this. Legal basis: the contract (GDPR art. 6.1.b). We keep invoices for seven years, as VAT law requires (art. 6.1.c), even if you delete your account. As a payment institution, Mollie also has legal obligations of its own for the payment itself.
Follow-up with Paraaf+ and Paraaf Pro
With Paraaf+ or Paraaf Pro we scan, every month, the website you confirm for your business (without a confirmation: the website of your latest scan). We only read public pages, as with any website scan, and keep the new scan in your account. Per website and month we record whether the scan worked and whether we e-mailed you. We only write when something changes, and when a rule change affects a rule that, according to your file, applies to your business; we record which change we sent you so we never send it twice. You turn both e-mails off in your account or with the link at the bottom of each e-mail. With Paraaf Pro we also keep the name and logo (PNG) you provide, to show them on your file and shared scans; anyone with the link to such a scan sees them. Legal basis: the contract (GDPR art. 6.1.b). Everything goes with your account; your logo also earlier, if you remove it.
Who can read a website scan
Anyone who has the link. The link can’t be guessed and search engines may not include scans. If you share it, you share the scan.
Someone else’s site
A website scan is about a website, not a person, and contains only what is publicly visible. Do you own a scanned site and want the scan gone? Email the link to contact@nealvdv.be and it will be deleted.
Processors
The site runs on Vercel; the database on Neon, in their European region in Frankfurt. The e-mails (sign-in links and, with Paraaf+ or Pro, the follow-up e-mails) are sent by Resend. They process data only on our instructions. They are American companies; where data leaves the European Union, this happens under the EU standard contractual clauses. Payments are processed by Mollie B.V. in Amsterdam (the Netherlands), within the European Union.
Your rights
You may ask what we keep about you, and have it corrected or deleted. With an account you do most of it yourself on the account page. Without an account we have no name or email address, so in practice it means a website scan: send us the link. Questions are welcome at contact@nealvdv.be. Complaints can go to the Data Protection Authority (dataprotectionauthority.be).