Privacy notice

1. Controller

Wolf-Agents
Proprietor: Eduard Wolf
Vorderhainberg 21
94496 Ortenburg, Germany

Telephone: +49 151 46533415
Email: info@wolf-agents.com

Our public service comprises this website, free security checks and the free report beta. You do not need a user account or an email address for these checks or report downloads. Report sales have not opened.

The former account and monitoring platform is no longer operating. This does not automatically delete remaining account, organisation, beta, log or backup data. Sections 6 to 12 describe these legacy records and their continuing maintenance. The private test email extension is a separate route without an account, available as a free, limited beta through the German and English Email Check (section 4.7). Actual intake depends on the displayed service status and the requirements described there. You can contact the proprietor about privacy using the details above.

2. Hosting, redirects and technical logs

We operate the website, database and cache with Hetzner Online GmbH in Nuremberg, Germany. Our technical scanners run at Hetzner and netcup GmbH; the Netcup server used for this is also in Nuremberg. External backups are held on a Hetzner Storage Box in Falkenstein, Germany.

For DNS and the CDN redirect at www.wolf-agents.com we use BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. The configuration review on 6 September 2026 showed that the main domain wolf-agents.com does not use CDN acceleration. The www address redirects to the main domain through the CDN, retaining the requested path. Europe, North America, Asia, South America and Africa are enabled for this zone. The provider being established in the EU does not restrict the delivery locations involved to the EU.

When you access the site, we process the IP address, time, requested address, referrer where present, browser identifier, volume of data transferred and response status. Requested addresses may include paths and link parameters. These data support delivery, troubleshooting and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are an available and secure website and investigating technical faults.

Daily rotation is configured for the web server access and error logs, keeping 14 completed log files in addition to the current file. This corresponds to roughly two weeks; it does not guarantee complete deletion of all log data after exactly 14 days. IP addresses are not truncated beforehand in these logs. Application logs, stored error cases, provider logs and backups have separate storage arrangements and are not fully covered by this rotation.

Logging and IP anonymisation are enabled in the www CDN zone. This does not automatically remove personal information from URLs or other metadata. Extended logs, log forwarding and additional log storage in our storage zone were disabled at the review mentioned above. Bunny specifies three days for the regular request history and origin error logs; this is not a maximum retention period for all of the provider's security, support or backup copies.

2.1. Former browser diagnostics and remaining security reports

Our pages no longer enable automatic browser submission of network errors or CSP violations. The Content Security Policy protecting against unauthorised resource inclusion remains effective. Previously supplied NEL and Report-To settings are withdrawn on a subsequent visit by setting their lifetime to zero; this neither deletes reports already stored nor guarantees that every former browser profile has connected again.

Existing security reports may contain page and source addresses, security directives, response statuses, short text excerpts, browser family and timestamps. Cleaned URL paths or remaining text may still contain personal data. Article 6(1)(f) GDPR applies to necessary troubleshooting and abuse prevention; our legitimate interest is secure website operation. Late reports from older browser states and ordinary connection logs are distinct from newly enabled browser diagnostics.

The 90-day deletion rule continues to apply to stored individual CSP report examples. Aggregated reports may contain page paths and, if unclassified, are deleted 365 days after their last occurrence; classified cases are excluded from that rule. Daily counters have a 400-day rule. The 90-day period therefore does not apply to every kind of report data. NEL messages identified as network error reports are not stored as CSP reports by the CSP receiver. Disabling browser diagnostics does not mean all legacy records have already been removed.

3. Cookies & browser storage

Usage statistics are collected on the server. We do not set an additional identifier in your browser for this purpose, use statistics cookies, email opening pixels or advertising pixels, or embed an external analytics service. We use the necessary cookies described below for the one-time start of an API check you have deliberately ordered and for expressly requested private test email access. Stored public results and report downloads do not require these cookies.

3.1. One-time API start and private access

After acceptance of a new API order, your browser receives the wolf_api_start cookie. It contains a random start value and applies only to that order's result page path under /tools/api-security-check/results/, without extending to subdomains. It is protected by Secure, HttpOnly and SameSite=Strict. It links the first run, which starts after the contract confirmation is transmitted, to the accepted order; sharing a result link therefore does not grant a new right to run a measurement. If the acceptance response is lost, repeating acceptance of the same order before it has started creates a new start value and invalidates the previous one. The cookie lasts for at most 24 hours and works only while the associated order exists. Once the one-time execution claim has been acquired, the response removes the cookie. Only its verification value and the necessary order and consumption state remain on the server until the original order deadline. It is not a statistics identifier and does not extend any result retention period.

The private test email extension separately uses these access cookies:

These cookies apply only to the particular fixed HTTPS host, intended publicly as wolf-agents.com, with path / and no domain permission for subdomains. They are protected by Secure, HttpOnly and SameSite=Strict: they can be transmitted only over HTTPS, cannot be read by JavaScript and are restricted on requests from other websites. They contain random or cryptographically bound access values, not messages or a statistics identifier. Such values are not necessarily anonymous either. They are not used for marketing or to track your behaviour across services.

The exception under section 25(2), point 2 TDDDG concerns the specific one-time API start or private access you request and its protection. The limited daily private access allows you to work with your own test emails and files; it extends neither an order deadline nor a message retention period. Simply calling something “technical”, or using it for statistics, does not establish this exception. Subsequent processing of personal data is separately governed by the bases in section 4 or 4.7. No additional cookie consent is requested for the storage access described here.

3.2. Voluntarily remembering the light or dark appearance

Without a choice of your own, the appearance follows your device's light or dark setting; the browser reads this setting but nothing is stored. The appearance button switches the open page between Light and Dark. The page then asks whether this browser should remember the choice for later visits. Only if you select “Remember” do you consent to remembering only this choice for later visits in the same browser; we then store light or dim under wa-public-reading-v1 in this website's Local Storage and read it on subsequent page visits. “Just this time” stores nothing. If you change the appearance again later, the remembered value is replaced. This also applies to this privacy notice and the private test email area at the same website address. No such value is written without “Remember”.

The choice contains no identifier, scan, message or access data. It is neither transmitted to our server or third parties nor used for statistics. It has no automatic expiry and remains until you select “Forget choice” (in this section) or “Forget saved appearance” (in the footer of every page), or delete this website's data in your browser. Both buttons appear only while a choice is remembered. Storage and subsequent reading rely on your consent under section 25(1) TDDDG and, to the extent personal data are processed, Article 6(1)(a) GDPR. Either button withdraws consent to future storage and removes the value; the lawfulness of earlier processing is unaffected. Scanners, files and private access remain available independently. If your browser blocks storage, changing appearance still works on the open page.

3.3. Other browser features and former storage

Apart from the appearance choice described in section 3.2, the current scanner and test email flow stores no data of its own in Local Storage, Session Storage or IndexedDB and registers no service worker. The browser processes necessary data in the running page's memory for display, form handling and expressly requested access. Screen width and the system's reduced-motion and light/dark preferences are read to adapt the presentation. These details are not collected as a visitor profile for statistics. Copying a code or downloading a file takes place at your request; you manage the resulting clipboard content or file yourself.

Former account and convenience storage such as wolf.session_token, wolf.session_data, wolf-theme, dash-sidebar-collapsed, wolf-news-last-read or former scan progress as-scan-… is no longer created or read by the discontinued platform. The same applies to the former unlock cookies scan_unlock and scan_report_unlock. Existing browser data may remain until their original expiry or removal in your browser. The new private session uses none of these old values.

Ordinary browser features for HTTPS, security policies and caching public files are distinct from a statistics identifier. Private HTML, API and file responses are delivered with no-store. This does not remove a report file you deliberately saved to your device. Withdrawal of former browser diagnostics is described in section 2.1.

3.4. Changing language in the NIS2 self-assessments

Only when you deliberately switch to the other language of the same NIS2 Scope Check or Readiness Check does the browser store the existing answers and progress once under wolf-nis2-language-transfer in the same tab's Session Storage. The destination page removes the entry when reading it and accepts it only within one minute. There is no continuous saving and these answers are not sent to our server or included in the URL. If navigation is cancelled, an unread entry may remain until you next open one of these tools or the browser session ends; after one minute it is no longer accepted. If browser storage is blocked, you can still change language, without carrying over the answers.

This limited transfer serves only the language change you request with your existing answers (section 25(2), point 2 TDDDG). Where these contain personal data, processing is based on Article 6(1)(f) GDPR; our legitimate interest is enabling you to continue the self-assessment as requested without entering your answers again. The information stays in the browser, is not used for statistics and does not create a lasting profile.

4. Online security tools

The security checks examine the domain, web address or API address you provide through technical HTTP, DNS, TLS and, where relevant, SMTP queries. They analyse publicly accessible configuration and response data; the Web Check also examines technical features of the retrieved HTML. They provide snapshots and do not establish ongoing monitoring. The domain check does not read private mailbox content. If you deliberately use the separate private test email extension, we process the test messages you send to its receiving address as described in section 4.7.

Submitting the form first creates a time-limited offer. It contains the target address, tool, preparation time, version of the terms of use, language and a technical source marker; for the Email Check it may also contain DKIM selectors you supplied and your request for the private test email extension. The offer is stored for at most five minutes for the Web Check, otherwise at most 24 hours from preparation. On acceptance it becomes an order; otherwise it expires unused. The accepted order contains the same details, processing status and, for the Web Check, the measurement start deadline set at acceptance and, where relevant, start authorisation. It is cached until 24 hours after preparation. We store neither your IP address nor your browser identifier in the offer or order; the limits in section 5.3 use their own short-lived counters. Previously accepted orders additionally contained an IP address and browser identifier; they expire no later than 24 hours after storage, while backups follow section 19. Depending on the check, target addresses may also contain a path and query parameters. Please do not enter secret credentials or unnecessary personal information in target addresses.

Stored results include target addresses and target IP addresses, DNS records, certificate details, response headers and technical findings. These may include published contact and reporting addresses, identifying URL paths, excerpts from error messages and retrieved MTA-STS policy texts. For these policy texts, responses of limited length that cannot be analysed may also be stored. Raw headers may remain in the result as well. For new Web Checks we store neither the values of cookies set nor the local parts of published contact addresses (security.txt, CAA); cookie names, attributes, domain parts and findings are retained. Result pages and downloads for all checks display cookie values and the local parts of published contact and reporting addresses as ***. For the Email Check, the full records remain in result storage until the stored result expires because the analysis is calculated from them on each retrieval; older Web results also retain their original values until expiry. Processing is therefore not limited to configuration values without personal data. These details come from your input and the responses of the systems checked and may concern you or other people.

The tools do not provide active protection: they are neither antivirus, a firewall nor a penetration test. See also the scanner usage rules.

4.1. Web Security Check

Purpose: analysing HTTP security headers, TLS certificates, DNS settings and technical features of the specified website.

1. DNS queries normally use our own fully recursive resolver on the scanner server; it queries the authoritative nameservers directly. If it is unavailable or returns a technically truncated response, we fall back to the DNS service of Digitale Gesellschaft (Switzerland). The queried domain name and query type are transmitted, not your IP address. See section 14 for details, including the separate operating system resolver.
2. HTTP header analysis runs through our dedicated scanner server at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The scanner contacts the target website with a browser-like request (curl-impersonate). The target website sees only the IP address of our scanner, not yours.
3. SSL/TLS analysis checks the target website's certificates, TLS versions and cipher suites.
4. Local HSTS list comparison: on our server we compare the checked domain with a fixed, versioned snapshot of the official Chromium reference list. We send no checked name to hstspreload.org or another status service for this purpose; there is no such fallback request. The date and revision of the list used are stored with the finding. If there is no valid snapshot or it is more than 14 days old, the list finding is treated as not collected. This technical freshness limit is not a statutory retention period. Pending inclusion or removal is not checked; a missing match does not establish a lack of protection in every browser. See section 14 for the separate list update.
5. Fallback system: if the main scanner is unavailable, a backup scanner at netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany) is used. Both scanners are located in Germany.

Former database summary: we previously created a row containing the domain, tool, score, grade and time for stored public findings. New checks no longer write such a row. The daily process deletes existing rows according to their previous age rules: after 90 days without either an account link or an email hash link, and after 400 days with either such link. There is no longer any condition relating to monthly statistics. Earlier deletion in a separate step remains possible. The former account deletion flow removed account and email hash links from associated scan rows; where both links have been removed, the 90-day rule applies. While rows remain, the domain and other associations may constitute personal data; privacy requests under section 16 remain possible.

4.2. Email Security Check

The check examines the email configuration of the domain entered, including SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, DANE and DNSSEC. DNS queries particularly concern MX, TXT, CNAME, TLSA, DS and CAA records. MTA-STS policies are retrieved over HTTPS. Published contact or reporting addresses may form part of the responses; result pages and downloads display their local parts as ***.

The SMTP connection test runs through our server at netcup in Nuremberg. It connects to the domain's mail servers on port 25 and checks STARTTLS, the TLS version and the certificate. The mail server sees our server's IP address. No message content is sent and no private mailbox content is read. A stored result may also be produced for a non-sending domain without a mail server.

4.3. API Security Check

The check examines the specified API address for CORS, authentication, rate limiting and header settings. The scanner contacts the endpoint directly. We do not request credentials for this. The address entered may contain a path and query parameters; responses may contain excerpts from error messages. We do not create a separate scan summary for this.

4.4. Stored results, downloads and shared retention periods

Results are normally retained for seven days; technically unreliable results are retained for 15 minutes, each from storage of that result. An ordinary read or request for a result email does not extend this period. A new Web Check order that has not yet run can be started only within five minutes of acceptance. An expired, failed or subsequently missing Web result does not trigger another check of the same order. A short-lived execution counter associated with the scan identifier is retained for seven days from its creation; it contains no email address or visitor IP and reading does not extend it. For the Email Check too, the original order is processed only within its limited execution window; a result that is subsequently missing is not measured again under the same scan identifier. The API Check starts a new accepted order at most once with the associated browser start authorisation described in section 3.1. Its consumed state remains until the original order deadline; even a failed or interrupted execution does not reopen the order. A valid stored API result remains accessible within its own retention period, including after the order ends. A missing result from a consumed order or a legacy order that cannot be safely associated does not trigger a replacement measurement. Without an available result, no report file can be downloaded.

A download itself does not start another check. PDF, CSV and DOCX files are generated from the stored result and delivered for download. This does not create a permanently stored report file. Results of the Web, Email and API Checks, including PDF, DOCX and CSV outputs, are available in German and English where the stored model version supports the requested language. Historical text that cannot be reconstructed remains accessible in the original. Changing language alters neither measurements and ratings nor access rights or deadlines. Current explanations may be applied to stored findings in older results; this does not produce new measurements. The download response is marked private and not to be cached.

The free result page and associated public downloads require neither sign-in nor unlocking. Anyone who knows the result link can access the result while it is available. An instruction to search engines not to index the page is not access protection. Downloaded or shared files remain the responsibility of their respective recipients.

We base preparation and performance of the accepted order, contract confirmation and provision of the result to the person placing the order on Article 6(1)(b) GDPR where their own personal data are processed. Where other people's data are affected, for example those of the owner of the checked domain, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests and those of users are examining the specified technical configuration, presenting findings clearly and improving the security of those systems. Data being publicly accessible does not by itself permit unrestricted use; data subjects retain their rights.

The offer and order deadlines, result retention periods and contract confirmation period (section 5.8) apply to all three tools. Legacy records under sections 4.1 and 4.6 follow their respective age rules. Abuse protection uses an IP-based daily counter valid for 25 hours and a target-based hourly counter in the active cache (section 5.3). Logs follow section 2; backups may retain data beyond the period in active storage (section 19).

4.5. Receiving the result by email (optional)

Scan results and the associated reports (PDF, CSV, DOCX) are accessible in the free beta without registration or an email address. Viewing or downloading a result neither stores your email address nor sends an email; no cookies are set for this purpose (section 3.1).

If you voluntarily request the result link by email, we need your email address. Before sending, we check its format, whether it uses a disposable domain, and DNS information about the reachability of its mail domain. The email contains the result link and details of the checked target and tool, without an attached report file. We obtain the target and tool from the stored result; no email is sent without a matching stored result. It is sent through Scaleway TEM.

We do not create a contact record for this delivery. The address is used only for the checks before sending and for sending itself; the sending service generates sending and delivery data as described in section 5.5. The result link works only for as long as the associated result is available.

Earlier result requests created a contact record with an encrypted email address, a SHA-256 lookup value, the target and tool details associated at creation, creation time and newsletter choice information. Without confirmed newsletter consent, the daily process continues to delete these records 365 days after creation, including where confirmation was requested but not completed. You may also request earlier deletion. This period concerns our contact record; messages, provider data and backups have separate storage arrangements.

Where you have your own service relationship with us, the requested delivery is based on Article 6(1)(b) GDPR. If you act as a company's contact person, the basis is Article 6(1)(f) GDPR; our legitimate interest is handling the communication you request. A result email does not constitute consent to advertising.

If you did not request the email yourself: another person may have entered the address; we do not check whether it belongs to the requester. That entry is then the source of the address. As described above, we use it only to send the result link once and do not create a contact record. The email explains this source, the purpose, our identity as controller and how to object. The legal basis is Article 6(1)(f) GDPR; the requester's legitimate interest and ours is the requested delivery of a check result to an address they specify, for example a responsible colleague or service provider.

You may object to this use of your address at any time (Article 21(1) GDPR), without a prescribed form, by contacting info@wolf-agents.com. We then add the address to our suppression list as a salted SHA-256 lookup value and stop sending result emails to it; a later request for that address is rejected with an explanatory message. We retain the lookup value while the objection remains in force; we do not store the address itself for this purpose.

We no longer request newsletter subscriptions through the result form. For confirmations already requested and existing consents, the following applies: newsletter subscription is completed in a separate confirmation step. The email link initially only displays the declaration; only deliberately pressing the button confirms consent. In the database, we store a random token solely as a hash, its association with the contact, request time and IP, text version and confirmation or withdrawal status. The link is valid for at most 48 hours from the request. The next successful daily process removes expired process data; this does not extend validity. Earlier unsubscription or deletion of the contact association ends outstanding links. Previous links from the old confirmation flow no longer work; a new request cannot currently be made through the website. Subscription and confirmation times, the associated IP addresses and text version are processed as evidence of consent. Our promotional newsletters require your prior express consent (section 7(2), point 2 UWG). The legal basis for advertising is Article 6(1)(a) GDPR; necessary evidence of consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR. You may withdraw consent at any time for the future, without a prescribed form, by contacting info@wolf-agents.com. When marketing emails are sent, they will also include an unsubscribe link.

The newsletter concerns security tips and product updates. It is independent of result delivery; we currently offer no new subscriptions. Old unlock links are valid for seven days; expired entries are removed by the daily process. The free beta flow creates no new unlock links or unlock cookies.

With confirmed newsletter consent, the record becomes due for deletion 24 calendar months after confirmation. After withdrawal, we no longer process it for advertising; the necessary withdrawal evidence becomes due for deletion six calendar months after withdrawal or at the earlier 24-month limit, whichever comes first. For legacy records without a confirmation date, the creation date is used for the 24-month limit. Calculation uses UTC; if the corresponding day does not exist in the target month, its last day applies. Deletion takes place in the daily process after it becomes due. If a process fails, records due for deletion may remain until a successful subsequent run; the due date does not change. Repetitions and further outstanding requests change neither the original consent nor its period. After unsubscription, a deliberately new request may produce new consent evidence; the old evidence retains its first withdrawal and earlier deletion limit. These 24- and six-calendar-month periods are our project-specific retention rules, not a general statutory newsletter period. Limited withdrawal evidence is based on Article 6(1)(f) GDPR; our legitimate interest is honouring and demonstrating unsubscription.

4.6. Usage statistics, operational reports and error data

We count two monthly totals on the server: public checks started and requested downloads of public result reports. A check counts only when measurement of an accepted order actually starts, after “Start check now” or the first visit to its result page; preparations, acceptances, reopening the confirmation view, retrieving the contract confirmation, rejections, rereading results, downloads and result emails do not count for this purpose. A new check of the same target counts again. A report download counts when the server delivers an available result report (PDF, DOCX and CSV combined) in response to a regular GET request; HEAD requests, recognisably marked preload and preview requests (headers such as Purpose or Sec-Purpose), partial requests (Range), rejected requests and contract confirmations do not count. Every further request counts again. The browser identifier (User-Agent) is not read for this purpose; automatic requests without a recognisable preload marker, for example link preview services, may therefore be counted. A counted download proves neither that the file was completely saved nor that it was read, and the totals do not count people. Our own synthetic control runs with server-verified provenance are excluded. There are no opening pixels or measurement requests from the browser.

Only the UTC calendar month, the two totals and the time when a completed month was included in our internal report are stored. The totals contain no target, domain, URL, grade, IP address, browser identifier, email address, scan identifier or time of an individual event, and do not allow a download to be linked to a check or a person. The counting step receives no order data; only the order's technical source class determines whether one of our own synthetic runs is excluded. We retain monthly totals permanently to understand the long-term development of the service. If a counting step fails technically, the total is a lower bound; this does not prevent the check or file delivery.

We previously recorded individual public events with the tool, UTC timestamp, source class and, depending on the event, domain suffix, output format, grade and limited technical quality attributes, together with an association of public scan identifiers limited to eight days to prevent duplicate counting. No new events or associations are created. The enabled daily process deletes existing individual events after 90 days without a condition relating to monthly statistics; the associations expire after eight days.

The former monthly counters derived from these events contain only the month, tool, event type, output format where relevant, source and count, as do former monthly values for stored findings. They remain as totals with their original meaning, are no longer updated, and are neither mixed with nor converted into the new totals. Figures for different periods do not describe unique people.

The separate private service counts actual activations, sending routes and short-lived receiving addresses created, accepted or broadly categorised rejected test emails, completed analyses, fixed revisions, formats provided and repeated retrievals. Separate counts cover contact confirmation, email recovery, successful re-entry, code recovery, capacity classes and necessary error classes. These counts arise from the respective server states and are aggregated early. Route names, contact addresses, receiving aliases, domains, private order or report identifiers, access values and message content do not enter the public statistics store. Private associations needed to avoid counting a state repeatedly remain in the time-limited private access control system. File retrievals may be counted again; this does not create a second report revision.

Aggregated private daily counts remain available for at most 62 days from the start of the relevant UTC day to identify recent bottlenecks and errors. Private monthly counts, including their technical copies in the internal monthly report, remain for the current and previous twelve UTC calendar months; they expire at the beginning of the thirteenth following month. This permits a limited annual comparison without retaining private usage histories. Short-lived associations against duplicate counting follow only the already limited private order and control periods and are removed with earlier deletion. None of these periods is extended by retrieval, a backup or sending a statistics email. Operational emails already delivered to mail providers are distinct from these technical counter copies (section 5.5).

The former domain directory with first and last check times and check count is no longer updated. The daily process continues to delete existing entries 24 months after the last check unless they are removed earlier in a separate step. The internal monthly report contains the two new totals, separately labelled former totals, the private counts described above and counts of existing contact and newsletter records, but no domains, domain suffixes or grades. It is sent through our mail service to the operational address. We no longer send a separate weekly usage report. Earlier reports containing domains and their email copies have the separate copy limits in section 5.5. The former email unlock funnel is historical information only, not a current user flow.

For troubleshooting, error reports also exist with technical details, time and handling or notification status. New error reports and diagnostic output from the scan flow contain neither the checked domain nor the scan identifier. This also applies to our scanner service logs for web retrieval and SMTP checks: the website no longer passes the target to them in the requested address, and their access logs store no query parameters. Older error cases and log entries may contain the affected domain. The website's own access logs may contain a checked address if it appears in the requested address, for example a link to check it again (section 2). Error text may still contain personal information; secret filters do not remove every personal reference. There is still no general automatic age-based deletion for stored public error cases. Web server and service logs follow section 2. Technical notifications and provider mailboxes have the separate copy limits in section 5.5.

Where these processes concern personal data, we base them on Article 6(1)(f) GDPR. Our legitimate interests are planning capacity actually needed, observing usage through broad monthly totals, and identifying and resolving interruptions and faults. We use limited server-side counts rather than usage histories across people; this neither requires nor introduces a browser identifier, links to private email content or personal marketing. Access is restricted to authorised parties entrusted with operations. Objections, deletion requests and remaining copies are described in sections 16 to 19. A statistics or email failure does not suspend private deletion deadlines.

4.7. Private test email extension

Limited free beta: the private test email extension opened through the German Email Check without a Wolf-Agents account on 19 September 2026. The current entry flow and private view are offered in German and English. Intake starts only after a deliberate selection, assignment of roles and recipients, and acceptance of its own service and processing agreement. Only the profiles described there are supported; the interface language does not restrict use by residence or nationality.

Deliberate request and fixed domain baseline: you can expressly request the extension during your regular email scan. Your browser is securely bound to that scan for this purpose (section 3). Only your subsequent deliberate activation creates a private order with a limited fixed copy of the already stored domain baseline: the checked domain, original measurement time, model and assessment versions, and the necessary basic SPF, DKIM and DMARC findings. Private data are not accessible through the public result link. New test messages change neither the historical domain assessment nor existing fixed report revisions.

Role, test instructions and contract copy: before creation, you select a personal private test, an organisation's order, direct representation of a client, or a client order as a service provider in a processing chain. For a personal private test we require no additional name, address or contact fields. For a business order, we record the named commissioning party, the acting person or entity, a reachable instructions and incident contact, and a declaration of authority to represent; for further processing, we also record the client controller, a brief instruction reference and confirmed permission to use a subprocessor. The declaration does not replace authority that is actually required. The test engine processes data under the limited client instructions; our own access, contract, security and statistics purposes remain separate.

Your deliberate acceptance of the service and processing agreement is securely associated with the version, acceptance time, order, target and scope. You receive a TXT copy you can save and can retrieve the same copy again while the order is valid. Personal acceptance and instruction details remain until order deletion or the original deadline; no new multi-year contract archive is created. The non-personal text edition remains available. A business contact does not automatically become an email recovery or newsletter contact. The operator may retrieve it securely for a specific valid order; a working copy created for that purpose is removed immediately after handling. Where we are responsible for associating an order with a personal contract with you, Article 6(1)(b) GDPR applies; necessary details of people acting for businesses are based on Article 6(1)(f), with the interest of traceable instructions and reachable contacts for data protection incidents and rights.

Limited initial profile and actual recipients: personal, purely private, non-professional minimal tests with results returned only to the tester are assessed separately from business orders. For ordinary operational IT tests by private organisations, we record the establishment actually receiving the results and its country, the association of this order, the acting person's relationship and, where relevant, further directly accessing service provider or client entities. Some adequacy decisions additionally require specific territory, entity and purpose details. Supported recipients are identifiable EEA recipients and the applicable adequacy cases specified in the agreement. US DPF cases without a current legal entity and scope check, unresolved Canadian PIPEDA cases and further SCC or individual-instrument cases are not initially accepted. The website has no country-based IP block; browser location and nationality do not determine this classification. The facts and resulting profile version and basis belong solely to the same time-limited acceptance record, not to a permanent recipient register. A statement in the form does not replace authority or a transfer basis that is actually missing.

Your own sending routes and messages: you name the routes from which you send your own test emails and receive short-lived receiving addresses for them. Use neutral names such as “Webmail” or “Application”. The address is not a permanent user mailbox. Please send only new messages with minimal content from routes you are authorised to use: no business correspondence, client data, old message threads, credentials or attachments. Contact confirmation proves neither domain ownership nor authority to represent, nor rights to other people's messages.

Receipt and analysis: the check processes the complete received message bytes, including headers and body, and technical connection details. Raw emails are stored briefly in encrypted form and decrypted only for automated analysis. After a completed full, partial or failed check result, raw material is deleted immediately; one hour from receipt is the maximum period in error cases. Raw emails are excluded from backups. SMTP acceptance is not yet a completed check.

Limited derived findings remain in the private area: particularly the checked domains and DKIM selectors, the submitting mail server's IP address, times, transport and authentication results, route names and associated fixed report revisions. The check concerns this message and the observed final SMTP hop. Mandatory STARTTLS protects that receiving hop but proves neither an encrypted earlier transport chain throughout nor later mailbox delivery. The check does not access your mailbox.

DNS recipients: the private checking service queries public DNS servers for the necessary names and their dependencies. Their operators may be located worldwide; they see the queried name and our checking service's public IP address. Names may themselves contain personal data. DNSSEC may authenticate DNS responses but does not encrypt them. Personal SPF macro exports and reverse DNS queries for the individual sending server's IP are blocked in the guest profile. When technical limits are reached, an analysis is marked incomplete. German hosting alone does not restrict this route to Germany or the EEA (section 14).

Access, contact and recovery: before the first test email, you deliberately secure your access code. Anyone holding it can manage the private area. Providing your own contact address for email recovery is optional; you may expressly continue with the code alternative. Unconfirmed contact details are retained for at most 24 hours. Only deliberate contact confirmation sets up email recovery. A confirmed association ends on removal, confirmed change, order deletion or the original order deadline. It creates no newsletter subscription and is not added to public contact or statistics records.

Confirmation and recovery emails are sent through Scaleway TEM in Paris to the address you provide. They contain an area identifier and a link valid for at most 15 minutes, not a report file. Confirmation or redemption requires a deliberate action on the destination page; merely opening the email or link is insufficient. Provider acceptance and successful re-entry are different events. To resolve an already uncertain email handover, limited encrypted recipient and sending metadata may remain for at most 24 hours from the request; revoked links remain ineffective. Provider and mailbox copies follow their own conditions (section 5.5).

Order deadline, files and deletion: an order whose access code safeguard has not yet been completed is valid for at most ten minutes. After deliberately securing the code, the order ends no later than 30 days later at the fixed time shown. New emails, further report revisions, downloads and recovery do not extend it. Sessions and issued receiving addresses are each valid for at most 24 hours, ending no later than the order deadline; a new deliberate sign-in or address issuance starts only its own short validity period. You can delete the private area earlier or stop further intake. Stopping intake and deletion are separate actions.

Fixed report revisions and their PDF, DOCX and CSV files remain privately available during the original order period. Multiple formats of the same revision represent one report version; downloading again is neither a new measurement nor a new acquisition. No long-term purchase archive is created. Recipients independently retain files they have downloaded or received from others.

Encrypted backups of derived data retain their original expiry date, at most seven days from creation. Current revocations and deletion markers are managed separately from these backups and prevent renewed access from an older state. The limited control state for this expires no later than eight days after the original order deadline; it is not a message archive. Limited private operational events have a seven-day period and a volume cap. Raw emails, private contact associations and valid email access permissions are not restored from an old derived backup. Private deletion does not wait for a statistics email or a monthly close. Our deletion process does not remove copies at a mail or DNS provider you use.

Bases and rights: where we process data necessary for a personal service relationship with you, this serves the service you expressly requested under Article 6(1)(b) GDPR. Necessary access protection, abuse prevention, deadline control and the limited internal operational statistics in section 4.6 are governed by Article 6(1)(f) GDPR; our legitimate interests are secure operation and assessing quality and capacity needs. This is not a basis for arbitrary messages belonging to others. Processing business data on instructions requires the specifically agreed roles and contractual relationship, including Article 28 GDPR, before intake. Reading the privacy notice or confirming a contact address replaces neither this assignment nor any consent that may be necessary.

You can report privacy concerns or misdirected messages to info@wolf-agents.com even without private access. Initially provide only necessary case details, not complete messages or access codes. Rights and information about other people's data are in section 16.

5. Contacting us

5.1. Contact form

For a contact request we process the contact and message details you enter, together with technical information for handling and abuse prevention. Until confirmation, the form stores your details, including the message, any optional fields, IP address, browser identifier, creation time, process language and mail domain validation result, in encrypted form in our cache for at most 48 hours. The confirmation link is sent to the address provided. Opening this link only displays the confirmation page; only deliberate confirmation there forwards your request.

After confirmation, the request and its accompanying technical details, including confirmation time, are forwarded through Scaleway TEM to our operator mailbox at Tuta. After successful acceptance by the sending service, the personal intermediate content is removed; a limited technical confirmation status and process language remain until the original deadline. Where sending has definitely been rejected, the entry may remain until expiry for another attempt. An uncertain sending status does not trigger automatic forwarding again. Deleting the intermediate entry does not delete a message already sent. The legal basis and retention of subsequent correspondence depend on its purpose, as described below.

5.2. Bot and spam protection (proof of work)

Our own bot protection makes the browser solve a computational challenge and verifies a one-time proof. We use no additional external CAPTCHA service or CAPTCHA cookies for this. The associated HTTP requests are nevertheless subject to ordinary connection data processing and IP-based abuse limits. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protection against automated abuse and overload.

5.3. Server-side rate limiting

To prevent mass form requests, we store short-lived counters per IP address and time window in a Redis cache on our own server at Hetzner Online GmbH (Germany). The period depends on the endpoint and ranges from 60 seconds (bot protection) through 60 minutes (forms and emailed result links) to 25 hours (daily scanner allowance). To protect other systems from mass checks, we also count scan requests per target over one hour; this counter contains the normalised target and expires after one hour. Entries are automatically deleted from the active cache when their respective periods expire; no further profiling takes place. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is maintaining service quality, protecting against denial-of-service attacks and ensuring fair use for all visitors. These security interests prevail because only a temporary counter, not personal profiles, is stored, and entries in the active cache expire after at most 25 hours.

5.4. Email address validation

To avoid erroneous or abusive contact, we automatically validate email addresses in the contact and result email flows on our own infrastructure, without an external validation service. Three things are checked: the address's formal validity, whether its domain is on our list of known disposable address providers, and whether the domain can receive email at all. For the last check, we query the domain's MX record through the DNS resolution described in section 14; only the domain part is queried, not the complete address. This query reaches the domain's authoritative nameservers, whose operators may be outside the EU, and, in the fallback described there, the specified DNS service in Switzerland. There is no content analysis, and the address is not stored for this purpose. For an offered email confirmation of withdrawal from a contract, we instead check only the address's form; the associated abuse protection is described in section 5.8. The legal basis for necessary validation is Article 6(1)(f) GDPR. Our legitimate interest is valid communication and preventing abusive sending.

Change on 28 August 2026: we previously used the external service ZeroBounce for this check. It is no longer used. This ends that validation service route; the described DNS queries to authoritative nameservers and, where necessary, the fallback service in Switzerland are unaffected. An earlier version of this notice described the provider as a British company and relied on the adequacy decision for the United Kingdom for the transfer. In fact, it is a company established in the United States (Hertza L.L.C. dba ZeroBounce, Santa Barbara, California), certified under the EU–US Data Privacy Framework; the stated transfer mechanism was therefore incorrect. We disclose this rather than silently replacing the information.

5.5. Mail service, mailbox and delivery data

We send application messages through Scaleway SAS, Transactional Email in the Paris region (fr-par). Scaleway receives the recipient and sender addresses, subject and message content, potentially including links or attachments. Optional result emails and confirmations of public contact form requests are handed directly to this service. We also maintain our own sending queue for necessary public operational messages. Private confirmation and recovery emails follow the separate short sending and clarification flow in section 4.7. Producers and consumers of former platform customer emails are disabled. The queue also stores the data needed for a message. Cleanup ages are configured as one day for successfully completed jobs and seven days for failed jobs. Cleanup depends on further queue activity; these values limit neither waiting or active jobs nor Scaleway's own delivery attempts. Acceptance of a sending job proves neither mailbox delivery nor that the message was read; errors and delays are possible.

Scaleway describes the technical TEM operation as taking place within the EU. This does not automatically cover every support or administrative activity, or your chosen recipient mailbox. Scaleway keeps technical delivery information, including recipient, subject, events and delivery attempts. Temporary delivery errors may trigger further attempts. Suppression lists may prevent repeated unsuccessful sending. Message content, queues, delivery histories and suppression lists are different data sets; a uniform maximum period for them and all copies has not yet been conclusively established.

Ordinary operator correspondence is received and our manual replies are sent through Tutao GmbH, Tuta, in Germany. Private test email receipt under section 4.7 does not use this mailbox route. Message content is stored there in encrypted form; necessary metadata such as addresses and email timestamps are excluded. Ordinary emails to other providers are therefore not encrypted end to end throughout. Tuta specifies at most seven days for mail server logs. Archived messages remain; Trash and Spam are cleared after 30 days in those folders. This is not a period for all correspondence or every remaining provider backup copy.

For the native Cockpit data sources we use at Scaleway, retention is configured as 31 days for metrics and seven days for logs. These values do not apply generally to the separate TEM delivery history. Internal operational and statistics emails may create further copies in the operator mailbox; not every customer email is automatically copied there.

Our application emails contain no opening pixels implemented by us or links rewritten for click measurement. However, opening a link to our website creates the access and, where relevant, confirmation data described here. Your chosen mail provider and further recipients process their copies under their own responsibility, potentially outside the EU.

5.6. Alternative contact methods

If you contact us by email or telephone, we process the communication data provided for the purposes and on the legal bases assigned in section 5.7.

5.7. Business communication and financial records

We process business enquiries, replies and necessary attachments to handle the matter concerned, establish or perform contracts, and retain necessary records. This includes contact details, message content, sending and receipt details and the necessary case association. Where contact information comes from a business partner or is supplied in a message, that is its source.

Communication necessary for a contract with you personally or pre-contractual steps you request is based on Article 6(1)(b) GDPR. For other business communication, for example with a company's contact persons, necessary processing is based on Article 6(1)(f) GDPR. Our legitimate interests are handling business matters and, in a specific dispute, protecting our legal claims. Statutory retention of records is based on Article 6(1)(c) GDPR and the applicable retention provision.

We use Lexware Office for accounting and associating records; the processor is Haufe Service Center GmbH. Necessary invoice, contact, booking and transaction details are processed. Through the existing account connection, transaction information from our business Finom account is associated for accounting. Finom Payments B.V. provides payment services; PNL Fintech B.V. operates the associated platform. For their payment, identity verification and statutory tasks, the Finom companies act as independent controllers or jointly with each other. A separate contract governs instructed processing of entrusted client and counterparty data. This does not create joint controllership between us and Finom for all activities.

Lexware Office is not a general archive of our email correspondence. Selected important original emails and contract records are additionally stored locally. The mailbox, local originals, working copies and backups are separate data sets. Financial records and our business payment transactions exist independently of report sales, which have not yet opened.

A message is not a record subject to statutory retention merely because it arrives by email. For relevant commercial and business correspondence, the statutory period is generally six years; for accounting vouchers, eight years; and for books, records and comparable documents, ten years (section 147 AO). Invoices must generally be retained for eight years under section 14b UStG. Section 257 HGB additionally applies where its personal scope is met. The start of the period depends on the document type: usually after the end of the year in which a business letter was received or sent, an accounting voucher arose or an invoice was issued. For books and financial statements, the respective statutory event determines the start. Outstanding tax periods and necessary evidence for specific claims may extend retention of the affected documents.

For ordinary correspondence, the relevant considerations are whether the matter is still being handled, a specific necessary enquiry remains outstanding, or statutory evidence or substantiated evidence of a claim is needed. A merely conceivable later use does not justify unlimited retention. We cannot handle an enquiry without the information necessary for it; you do not need to send us such an enquiry for a free scan.

A regular process for deleting ordinary correspondence, including all associated mailbox and local copies, has not yet been implemented throughout. Statutory deletion duties and your rights under section 16 are unaffected.

5.8. Electronic withdrawal from a contract and contract copy

Before acceptance, the overview shows the full contract text in advance, without an acceptance time. Selecting “Order free check and save confirmation” accepts the offer; immediately afterwards, we transmit a text file to your browser with the scan identifier, tool, target, preparation and acceptance times, measurement start deadline, result link, and applicable contract and withdrawal information. The view remains open and offers the same file for saving again; measurement begins only with “Start check now”, in this view or on the page behind the result link. Merely opening the link starts no measurement. We store the same unchanged text, with its version, language and timestamps, in our cache so that you can retrieve it through the confirmation link, also on the page behind the result link before measurement starts, and afterwards through the result page, for as long as the order or associated result is stored (order until 24 hours after preparation; confirmation without a result until ten minutes later so that an ongoing measurement retains it; a reliable result for seven days from storage). It is then removed from the active cache; backups follow section 19. No additional persistent browser storage of order details or the contract copy is created. The file contains no visitor identifier for statistics, retrieving it triggers no measurement and does not count as a report download.

In the two-step withdrawal form, we need your name, details identifying the contract or part of it, and your deliberate choice of confirmation channel. The immediate personal text file in this browser requires no email address, newsletter choice or sign-in. Where the form additionally offers email, that choice is voluntary; only for it do we require the destination address you specifically provide. We do not reuse a contact or newsletter address. Before “Confirm withdrawal”, the prepared declaration, including the channel and any destination address, remains encrypted in the form in your browser. After confirmation, we store these immutable details and the language in encrypted form, together with receipt time, case identifier and a hash for repeatable receipt delivery, in our database at Hetzner. The receipt contains your declaration and original receipt time. Retrieval remains possible for at most 24 hours from preparation, including after a lost response; a file already saved remains usable independently.

If email is selected, we pass the receipt with your declaration, channel choice, destination address, case identifier and original receipt time directly to Scaleway TEM in Paris, as a message with the same text file attached. This creates neither a newsletter or lead record nor an additional job in our operational mail queue. For limited repetition, we store sending status, number of attempts and last attempt time with the case. A short-lived counter against the destination address hash limits additional requests to three per hour. At most three deliberately triggered sending attempts per case are possible within the original retrieval period. An uncertain handover may already have triggered a message. Acceptance by TEM does not confirm mailbox delivery. Sending problems change neither receipt of your declaration nor its content or receipt time. Provider and recipient mailbox copies follow the separate conditions described in section 5.5.

The legal basis for acceptance, association and confirmation is Article 6(1)(c) GDPR in conjunction with sections 312f and 356a BGB; necessary handling of your service relationship is additionally based on Article 6(1)(b) GDPR. The provider handles the received declaration without automatically deleting other people's results based on freely entered details. Necessary abuse prevention and briefly repeatable receipt delivery are based on Article 6(1)(f) GDPR. IP-based volume limits and general server logs are separate (sections 2 and 15).

After deliberate resolution and the end of the 24-hour retrieval period, the next daily maintenance run deletes the identifiable case, including any selected destination address and sending states, unless a specific necessary enquiry, a specific claim or an applicable statutory record duty remains. The 24 hours are not a blanket retention period for the received declaration. An exception requires its own purpose or legal provision and a justified end and deletion date; it extends no newsletter, report or statistics period. Open cases are retained for handling and reported as unresolved in the daily operational run no later than after seven days; this is an internal check, not a promised support deadline. Working copies and backups must still be handled separately under section 19. Withdrawal may also be declared by letter or email; such correspondence follows section 5.7.

6. Data from former user accounts

Registration, sign-in, dashboard, device management and account recovery for the former platform are no longer available. Existing profile, sign-in and security data may remain stored: name, email address, password hash, company and billing details, and former session and device details with IP address, browser identifier and timestamps. Discontinuation neither starts new periods nor removes the personal nature of these details.

6.1. Former password security check

The former registration and password change flow queried Have I Been Pwned (Troy Hunt, Australia, delivered through Cloudflare). It transmitted the first five characters of a SHA-1 hash and exposed the server IP, not the password or your email address. The discontinued account application makes no new such query. This does not retrieve any former provider or log copies.

6.2. Legacy session and verification values

The daily maintenance process continues to remove expired sessions and verification values. Their original validity limits remain decisive; discontinuation does not extend them. A previously set browser cookie is not used for the public scanner or private test email access. Remaining device and profile details are separate.

6.3. Rights and remaining purposes

You can request access, rectification, deletion and portability without signing in by contacting info@wolf-agents.com. Removing an account link does not automatically remove organisation data, domains, logs or backups. Each remaining data set must still have a necessary purpose, such as handling an existing personal participation relationship (Article 6(1)(b) GDPR) or specific evidence for security or legal claims (Article 6(1)(f) GDPR). A merely conceivable later use is insufficient. Disabling the interface does not complete cleanup of all records and copies.

7. Former check and notification data

The former ongoing domain monitoring, attack surface analysis and their customer notifications are disabled. Existing domain, DNS, certificate, header, email configuration and availability data, check results, changes and notification evidence may remain stored. These do not generate new checks or invitations.

Existing age-based cleanup continues in public maintenance operations. Its standard period for older check histories is 90 days; in particular, the latest comparison state per domain association and tool, and open availability states, are excluded. A separate termination flow is subject to the original contractual duration and status conditions. Other active legacy associations may prevent it. Former stored platform reports have their own 30-day rule. This does not establish a general maximum of 90 days for all legacy records.

Remaining data must serve the necessary handling, security or specific evidence purpose described in section 6.3. Data no longer needed must be deleted. Continuing periods and your rights apply independently of removal of the old interface; provider and backup copies must be treated separately.

8. Free use

The public scanners and report downloads are free. They require neither a payment method nor a paid subscription. The free report beta is not a time-limited trial with a stored payment method.

9. Remaining organisation and workspace data

Remaining organisation and workspace associations may contain memberships, roles, domains, check configurations and results. The former invitation and administration flows are disabled. Expired invitation entries are removed in the daily maintenance run; existing scheduled deletions for organisations and workspaces retain their original date.

A case due for processing may require separate handling because associated provider obligations still need clarification or a technical deletion error occurred. This does not reset the date. Removing an account does not automatically delete all organisation data. Where an Article 28 GDPR agreement exists for continuing instructed processing, its obligations, including return and deletion, remain applicable. The former contractual relationship is not transferred to the new private test email flow.

10. Payment links and former test associations

Report sales have not opened. A free scan or report download triggers neither a purchase nor transfer of payment data for that activity. Payment and account synchronisation for the former platform are disabled. Business financial records and the existing bank connection are separate and described in section 5.7.

Existing associations at payment service Stripe from earlier account or integration tests do not thereby cease to be personal data or become automatically deleted there. Handling or evidence data still needed and existing provider obligations must be addressed separately. The German Stripe standard agreement names Stripe Payments Europe, Limited (Ireland); instructed data processing and the provider's own statutory tasks differ according to the activity. The Stripe data processing agreement, data transfer addendum and privacy notice describe function-specific recipients, safeguards and retention criteria. They do not establish a uniform EU storage or copy-deletion period for every former test arrangement.

11. Former beta registrations

The old beta waiting list no longer accepts new registrations or invitations. Earlier confirmed registrations may contain an email address, IP address and registration and status details; address and IP address are not stored with field-level encryption in this registration database. Earlier operator notifications may contain additional email copies. Registration was based on consent under Article 6(1)(a) GDPR.

To close the waiting list, the proprietor processes the associations still needed to inform people of its end and handle any enquiries or rights. This involves no new invitations or marketing of other services. Once this is handled, we assess whether a specific purpose or statutory duty remains; otherwise the record and unnecessary operator copies must be specifically deleted. Discontinuation does not start a new blanket retention period. Expiry of an earlier invitation link and disabling the interface do not automatically delete a confirmed registration. No general automatic age-based process is currently configured for confirmed registrations; purposes that have ceased must nevertheless be respected. You can withdraw your registration and request deletion at info@wolf-agents.com. These records are used neither as newsletter consent nor as private test email contact confirmation or evidence of external customer use.

12. Security and activity logs

Earlier security events may be logged with user identifier, action, resource, time, change and context details, and sometimes IP address and browser identifier. Continuing data maintenance may generate new limited evidence of our own deletion processes. The legal basis for necessary evidence is Article 6(1)(f) GDPR; our legitimate interest is investigating security events and demonstrating data maintenance actually performed.

Removing a user identifier does not anonymise all remaining resource, domain or context details. No general automatic age-based deletion exists for the old audit records; no blanket ten-year period is promised. The specific purpose still needed, your rights and existing copies must still be considered. The short-lived private access control in section 4.7 is a separate data set with its own periods.

13. Recipients and processors

Our service providers receive data for the activity described in each case. Data processing agreements exist for the following entrusted data. A provider's own account, billing or statutory tasks must be distinguished from this.

Our domain contract for wolf-agents.com is with Hostinger International Ltd., Cyprus. It concerns registration of our domain and the necessary registrant, contract and billing details. This does not entail passing visitor or report data to Hostinger as a hosting provider. Finom's separate payment and platform roles are explained in the business communication section. Operators of checked targets, DNS and security directories, and mail recipients you choose do not constitute a blanket chain of our processors.

The Finom companies named above are established in the Netherlands. Finom explains its country information, purpose-dependent periods and how to obtain transfer safeguards in sections 6 and 7 of its privacy notice. These details about the provider's own processing are not a general retention period for our correspondence. The appendix to the data processing agreement contains the function-specific subprocessors and transfer rules for Lexware Office.

The HSTS comparison in section 4.1 uses a local Chromium reference list without sending a domain query to a status service. The former request to hstspreload.org transmitted the checked domain and exposed the server IP; local comparison does not remove copies already created there. Have I Been Pwned belongs to the former, now disabled account flow (section 6.1). No processor relationship exists with public security directories. Section 13.1 distinguishes current target queries from former recipient routes.

13.1. Recipients of target queries and former services

Today's HSTS list comparison takes place locally (section 4.1). Earlier external HSTS queries and the former security directories listed below received the checked domain or its IP address from our server; our server's IP address was also visible. Your visitor IP and browser identifier were not forwarded. Current target and DNS queries are described separately below. Where such target details can be associated with a natural person, Article 6(1)(f) GDPR is the basis for the necessary security analysis; information and transfer questions still require separate consideration. No processor relationship exists with these directory operators.

Which queries occur, and when, differs between checks:

• The blocklists below belonged exclusively to the former ongoing monitoring. That query route is disabled. Public scanners and the private test email extension do not query these lists. The list below is retained as information about former recipients.
• crt.sh belonged to the former attack surface analysis. This query route is also disabled.
• HSTS comparison remains part of the public Web Security Check but uses only the local Chromium reference snapshot. Even if it is missing or outdated, no domain query is made to hstspreload.org; details are in section 14.

Blocklist comparison. Former assessment of a monitored domain's email deliverability queried twelve public DNS blocklists. Ten received IP addresses of the domain or its mail servers, and two received the domain name. Name resolution queried the list operators' authoritative nameservers; the paragraph “Former name resolution through public resolvers” below explains which resolvers were temporarily intermediaries. Discontinuation does not remove copies already created there.

“Could not be established” and “not unambiguously established”: on 29 August 2026 we checked each operator's place of establishment against its own publications and, where available, official registers. Six operators publish neither a legal notice nor an address for service, and their domain registration details are hidden or conflict with their own statements. The Spamhaus group has several companies in different countries; its terms of use do not identify which is responsible for free access. We state this openly rather than naming a place of establishment we cannot substantiate.

Certificate transparency. A former, expressly requested attack surface analysis queried crt.sh to identify issued certificates and subdomains. The domain name was transmitted and our server's IP address was visible. This query route is now disabled. The operator is Sectigo Limited, Exmouth House, 3/11 Pine Street, London EC1R 0JH, United Kingdom. A European Commission adequacy decision applies to the United Kingdom (Implementing Decision (EU) 2021/1772 as amended by Implementing Decision (EU) 2025/2574); details are in section 14.

Former name resolution through public resolvers. Until August 2026, name resolution for checks intermittently used other providers' public resolvers. According to our configuration history, the tools' DNS queries were configured to use Cloudflare's DNS-over-HTTPS service (USA) from December 2025. Our own resolver took over in March 2026, and Cloudflare remained configured as a fallback until the switch to the Swiss fallback on 10 April 2026: initially when resolver configuration was missing, and from 9 April also after repeated failures. A Cloudflare DoH route for MX validation of entered email addresses is also documented in source versions from February/March 2026. Only the domain part was queried, not the full address. On 16 March, the code changed this route to our own resolver with the fallback mentioned above. These code dates prove neither the periods of actual deployment nor requests actually sent. From 16 May to 11 August 2026, operating system name resolution was configured for public resolvers from Cloudflare (USA), Quad9 (Switzerland) and Google (USA); among other things, this resolved every checked target before connecting. A measurement on 11 August 2026 before the change is documented: Cloudflare answered the query and received our server's address range. When individual configurations were actually in service, and whether or how often Quad9 or Google received queries, is not established. Each query transmitted the name and our server's IP address or address range, without forwarding the visitor IP or browser identifier. Where a name concerned a natural person, these were personal data; we have not documented a Chapter V GDPR transfer basis for these routes. These former resolver routes are disabled; current name resolution is described in section 14.

The checked domain itself. Depending on the tool, we retrieve the specified web or API address, query DNS records from authoritative nameservers, or connect to the associated mail server. Inputs and responses may concern people (section 4). The IP address of our server becomes visible, not yours.

Recipients you choose. Former platform webhooks and retrieval of customer-supplied logo addresses are disabled. This does not remove recipient copies already created. Optional result delivery and expressly requested private access emails go to the mailbox you choose (section 5.5). Its provider and your own test email sending routes determine further processing locations; choosing an address does not replace any transfer basis that may be necessary.

14. International data transfers

The website and database servers are in Nuremberg, and external backup storage is in Falkenstein. By contrast, the CDN zone for www.wolf-agents.com is configured for worldwide delivery (section 2). Specific edge locations for an individual request were not established in the configuration review. Scaleway TEM is configured for Paris. These details do not restrict every subsequent recipient or copy to the EU.

Checked systems receive the technical requests needed for the check and see the IP address of our executing server. Your visitor IP and browser identifier are not forwarded to them for this purpose. However, queried names, target addresses, permitted URL paths and query parameters may themselves contain personal information. Operators of target systems and authoritative nameservers may be outside the EU or EEA.

DNS resolution for this normally uses our own recursive resolver. For certain security and mail domain queries, a separate fallback to the DNS service of Digitale Gesellschaft in Switzerland applies if the resolver fails or a response is technically truncated. The name and query type are transmitted, and our server's IP address is visible. Where these contain personal data, this is a third-country transfer. Switzerland benefits from a European Commission adequacy decision under Article 45 GDPR. This permits transfers under the decision's conditions; it does not make Switzerland an EU country.

Operating system name resolution and its fallback to Hetzner resolvers in Germany form a different route. Recursive resolvers also query authoritative nameservers; a German resolver therefore does not mean every subsequent DNS query stays in Germany.

The separate private checking service uses two fixed root server addresses of VeriSign, Inc., a US company with root servers distributed worldwide, followed by authoritative nameservers. It sends full permitted query names and types to those root servers already; this private route uses neither a third-party recursive resolver nor a public DNS-over-HTTPS fallback. At the check on 20 September 2026, VeriSign, Inc. was actively listed in the official Data Privacy Framework list for EU–US transfers of non-HR data. Adequacy Decision (EU) 2023/1795 under Article 45 GDPR is therefore assigned to a personal data transfer to that company covered by the framework. This determines neither all subsequent authoritative DNS recipients nor their purposes and retention periods.

HSTS comparison uses a local copy of the official Chromium reference list. The separate update process downloads the list from the official Chromium source repository without transmitting entered target names; the retrieving system's IP address becomes visible. A scan or result retrieval triggers neither a list update nor a domain query to hstspreload.org. The finding remains bound to the stored list snapshot. This does not retrospectively resolve recipient, log or copy questions from earlier status queries to hstspreload.org. Nor does it remove any personal nature of the domain we process.

Storage region statements concern the named service in each case. They do not automatically exclude different recipient mailboxes, support access or further recipients. You can request information about the transfer routes described at info@wolf-agents.com. An adequacy decision or standard contractual clauses must fit the specific recipient entity and processing; a data processing agreement alone is not a general third-country safeguard.

For the global CDN route and target or DNS queries involving personal data, the specific recipient chain and applicable transfer safeguards have not yet been fully mapped. This particularly concerns the private DNS checking route. There are also unresolved historical recipient and copy questions concerning former HSTS status queries and the former recipients with unclear places of establishment named in section 13.1. The supported initial profile for returning private results does not replace this assessment of query and provider routes. Public accessibility and Article 6 GDPR do not replace a Chapter V GDPR basis.

Have I Been Pwned is based in Australia and delivered through Cloudflare; the limited password-prefix query is described in section 6.1. The operator and country limitations in section 13.1 remain relevant to the formerly used blocklists; their query route is disabled. For Sectigo Limited as operator of crt.sh in the United Kingdom, Adequacy Decision (EU) 2021/1772 as amended by (EU) 2025/2574 applies until 27 December 2031. Information on function-specific Lexware and Finom recipients and how to obtain their safeguards is in section 13.

15. Retention periods and deletion processes

This overview distinguishes validity, when deletion becomes due and actual cleanup. Daily runs may remove data after deletion becomes due; failed runs and separate copies do not extend the processing purpose. Statutory deletion rights remain. Special statutory retention or evidence specifically needed for claims concerns only the necessary documents, not all data indiscriminately.

16. Your rights

Subject to the respective statutory conditions, you have the right to:

• Access (Article 15 GDPR) to your processed data
• Rectification (Article 16 GDPR) of inaccurate data
• Erasure (Article 17 GDPR) of your data, including without an account or valid private access, by emailing info@wolf-agents.com
• Restriction (Article 18 GDPR) of processing
• Data portability (Article 20 GDPR)
• Object (Article 21 GDPR) to processing
• Withdraw (Article 7(3) GDPR) consent you have given
• Lodge a complaint (Article 77 GDPR) with a supervisory authority

Practical note: the former account interface is no longer available. You can still exercise your rights through our privacy contact. Personal data with different retention periods arise even without registration: the scan order record no longer contains an IP address or browser identifier and expires after at most 24 hours (orders created before this change contained both and also expire); IP-based abuse counters expire after 25 hours. Logs, scan summaries, the domain directory, voluntary email requests and backups have their own retention periods (sections 4, 15 and 19). Expiry of an order or removal of an account link does not make all remaining data completely anonymous; domain, email, log and backup associations may still permit identification.

You may request access or erasure at any time. Where possible, provide the scan identifier from your result page address, or the checked domain and time. We use the data still available to establish which entries can be associated with your request. If you requested a result by email (section 4.5), the address used helps with this association. Contact info@wolf-agents.com without any prescribed form.

The competent supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. A list of German data protection commissioners is available at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_node.html.

The data described may also come from a requester's input, business correspondence or publicly accessible responses from the systems checked. A person mentioned there may not have used our scanner themselves. These people can also exercise their statutory rights of access, rectification, erasure, restriction and objection. A Wolf-Agents account is not required. Please provide only the details needed to identify the relevant data, such as the affected address, domain or scan identifier with a time. Your rights are not limited to the scan order's lifetime.

Providing an email address for a result link and giving newsletter consent are voluntary. Without an email address we cannot email a result link; the free scan and download remain independent. Technical filters may temporarily reject or limit requests. The security grade assesses a technical configuration and makes no decision about personal legal claims. If you believe a block or association is incorrect, you can contact info@wolf-agents.com.

17. Right to object (Article 21 GDPR)

Objecting to future checks of a domain: if you operate a domain and object to future public checks, state the domain and whether subdomains should be included. We check your authority and the scope, then add the domain to our blocklist. Public checks of this target will then neither be prepared, accepted nor started, including from an already accepted order. This does not block mail, hosting or nameserver services also used by other domains. Existing stored results expire according to their periods (section 4.4); you can separately request earlier deletion. We retain the entry while the objection remains in force; the blocklist contains no reasons for your objection. We block result emails to an address in the same way (section 4.5).

18. Automated decision-making

No automated decision-making, including profiling, under Article 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you. Clarification: our scanning tools' automated security assessments (scores, grades and recommendations) produce no legal effects concerning the people checked or users and do not constitute automated individual decision-making within Article 22 GDPR. Results are solely informational; any resulting action is at the user's discretion.

19. Data security and backups

We take technical and organisational measures to protect against unauthorised access, loss and alteration. These include access controls, cryptographic password hashes, protection of forms and sign-ins, security reports and error handling. The measures and their limits depend on the particular data flow.

Our website is served over HTTPS, and the connection to the sending API is also encrypted. However, security checks may examine unencrypted HTTP, DNS or SMTP communication with the systems checked. There is therefore no blanket encryption promise for all technical queries.

Certain fields in server operations, including the email address for a result request and pending contact form data, are stored in encrypted form. Existing server backup archives are not additionally encrypted as a whole. They are transferred to external storage over an encrypted connection; this differs from encrypting the archive contents. Only data fields already stored in encrypted form during operation therefore remain encrypted in the archive.

The old account application is disabled; maintenance of remaining data is described in sections 6 to 12. The private test email flow uses separate short-lived access control and limited backups under section 4.7. Error filters remove certain secret patterns, but not every personal reference (sections 4.6 and 12).

19.1. Existing server backups

Daily backups of PostgreSQL, Redis and configurations are scheduled for 03:00 UTC. They are transferred over an encrypted connection to external storage at Hetzner (Storage Box, Falkenstein); the backup archives themselves are not additionally encrypted. A 14-day rule is configured for local daily copies and a 30-day rule for external daily copies. Age rounding and daily run intervals allow longer actual lifetimes; these values are not maximum periods precise to the minute. Weekly configuration backups retain four local copies and use a 60-day rule externally. The weekly run interval also applies here.

Records measured on 6 September 2026: local daily copies were up to roughly 14.6 days old, and external daily copies up to 34 days. External weekly copies ranged from 12 July to 6 September 2026. A reference full backup from 19 April 2026 also existed. The WAL archive for point-in-time recovery contained segments with a measured file age of up to roughly 140 days, although 30-day cleanup was intended. File age and archive names prove neither complete nor successful recovery. It is not fully established which historical backlog arose from which cleanup error.

A cleanup correction has been prepared locally; its execution in production has not yet been demonstrated. Reference backups and associated WAL must be assessed together for their recovery chain before cleanup. We therefore cannot currently promise a fixed maximum retention period for these existing legacy records. Backups also contain the cache: short-lived entries such as prepared offers, scan orders and contract confirmations, and for earlier accepted orders also IP addresses and browser identifiers, may remain there longer than in the running system. Backup copies are not edited individually in response to a deletion request; removal there depends on actual expiry of each copy. On restoration, known deletions must be taken into account before data are used again.

19.2. Additional storage and recovery

By contrast, a separate encrypted backup at Hetzner was created and read back for selected additional local email and contract records. This limited action is neither a regular backup of all correspondence nor a complete encrypted project copy. It does not change the described limits of the old server backups.

Backups serve recovery after loss or disruption. Where personal data are involved, necessary processing is based on Article 6(1)(f) GDPR; our legitimate interest is recoverability and integrity of the data needed. Statutory preservation of records remains a separate purpose. Deletion in the active system or mailbox does not automatically remove local working copies or older backup packages. Their actual retention limits and the duty to account for known deletions and restrictions before reusing a restored state continue independently.

Our own administrative access is carried out by the proprietor from Germany. Necessary access and processing by the providers used are separate. These measures do not promise complete security or that new backup and deletion procedures have already been implemented.

20. Business transfer

In a business conversion, merger, division or sale, personal data may be transferred to a legal successor as part of the transfer of the business. The legal basis is Article 6(1)(f) GDPR (legitimate interest in continuing business operations). This also includes a change in the controller's legal form (for example from sole proprietorship to GmbH). Data subjects will be informed of the new controller under Article 13(1)(e) GDPR.

21. Changes to this privacy notice

This privacy notice is updated when necessary, for example following changes to our website, new features or changed legal requirements. The current English version is always available at /en/privacy/. We inform you of new processing purposes before the processing concerned and obtain any necessary consent separately. The earlier commitment to actively inform existing registered users at least four weeks in advance of material changes to their processing remains for legacy relationships actually affected. This does not create a newsletter subscription or activate the private test email service.

As of 6 October 2026. Language statements reflect the service currently offered; changing the view or file language does not change measurements, rights, contract confirmations or original deadlines. Deliberate contact confirmation and the short-lived transfer of answers when changing NIS2 language are described in sections 5.1 and 3.4. Without a choice of your own, the light or dark appearance follows the device setting; a choice is stored only after “Remember”, including for the private test email area (section 3.2). Existing contract confirmations are unaffected. Public free-check orders are stored without an IP address or browser identifier. Usage statistics now consist only of two monthly totals for checks started and report downloads requested; individual events, scan summaries and the domain directory are no longer updated, and legacy records expire under their own rules. Result emails no longer create contact records or request newsletter subscriptions; the target allowance has been added. Submission only prepares the check; section 5.8 describes contract conclusion, contract confirmation, the separate measurement start and repeat retrieval.

Change on 29 September 2026: the result email states the source of the address, identifies us as controller and explains how to object; addresses can be blocked from future result emails after an objection (section 4.5). Domains can be excluded from future public checks following a verified objection (section 17). Cookie values and local parts of published addresses appear as *** in results and downloads (section 4). Scanner service logs no longer contain checked targets (section 4.6). Section 13.1 additionally describes former name resolution through public resolvers until August 2026.

Change on 21 September 2026: HSTS list comparison uses a local, versioned Chromium reference snapshot; regularly sent internal usage reports contain neither individually named domains nor associated last-check times. The free private test email beta is open through the German Email Check for the supported initial profile described. Separate acceptance of roles and instructions, the contract copy and short deletion periods remain unchanged. The older changes dated below document earlier states.

Change on 19 September 2026: private role and instruction acceptance, its TXT copy, contact separation and deletion limit, and blocked reverse DNS queries were added. The then-current statement that public intake was still closed has been superseded by the later opening.

Change on 13 September 2026: one-time SQL newsletter confirmation, expiry of old links and new resubscription, electronic withdrawal from a contract, and closure of the waiting list were added. Details of the website, scans, result delivery, communication and remaining data from the discontinued account and monitoring platform were clarified; the separate private test email flow and its operational statistics were added. Newsletter retention is limited to the earlier of two due dates; the due date and actual deletion run are described separately. This does not assert that every legacy record already due for deletion has been removed.

Change history: 29 August 2026 — new section 13.1 (recipients when checking and monitoring a domain: twelve blocklists, the certificate transparency service crt.sh, the checked domain itself and recipients chosen by you); Have I Been Pwned added to the recipient table; DNS resolution details clarified with the hosting provider's fallback layer; two exclusivity statements removed.

Editorial correction on 31 August 2026: the United Kingdom statement in section 14 said Adequacy Decision (EU) 2021/1772 had expired on 27 June 2025 and an extension had not been checked. Neither was correct; as amended by Implementing Decision (EU) 2025/2574, the decision applies until 27 December 2031. Section 13.1 had already stated this correctly 21 lines earlier; the two passages now agree. Tax retention periods in section 15 consistently stated “10 years (section 147(3) AO in conjunction with section 14b(1) UStG)”; the applicable periods are eight years for invoices and accounting vouchers and six years for commercial and business correspondence. The Tuta entry referred to a data processing agreement that had not yet been concluded. Section 9.3 described tenant separation as impossible by design and referred to “every API query”; that statement was replaced by a description of the technical measure actually effective, as not every platform table relates to a tenant.
Update on 2 September 2026: the Tuta entry in section 13 stated “data processing agreement not yet concluded”; the agreement with Tutao GmbH was concluded on 1 September 2026, and the statement was aligned. The recipient list itself is unchanged; no recipient was added or removed.
Addition on 2 September 2026: new section 10.1 (purchasing a report without an account), separate from the subscription because it concerns people without an account; two new rows in the retention table in section 15 (redemption code verification value, IP address at ordering). This added no recipient.
Update on 6 September 2026: security tools operate as a free beta without email unlocking. Instead of the email gate, section 4.5 describes the optional offer to receive the result link by email (no unlock token, no cookie, legal basis Article 6(1)(b) GDPR); the scan_unlock and scan_report_unlock cookies in section 3.1 are no longer set. Sections 4.2 and 4.3 and the table in section 15 stated that the Email and API Checks had no seven-day result cache and that the API Check had no database row; both statements had ceased to be correct after the result page changes in August 2026 and were corrected. No recipient was added.
Correction on 6 September 2026 following an operational review: lead records without confirmed consent are automatically deleted after 365 days (sections 4.5 and 15; previously “until deletion on request” or “12 months”); scan summaries are deleted in a daily run with a monthly condition (section 4.1); backup archives are not additionally encrypted and external daily copies were at times older than 30 days (section 19; previously “encrypted backups” and a strict 30-day statement); email validation reaches authoritative nameservers (section 5.4; previously “without third-party involvement”); access or erasure requests are not limited to 24 hours, and a domain or result is not necessarily free of personal data (sections 4.1 and 16).
Further correction to reflect actual operation on 6 September 2026: CDN details now distinguish the main domain from worldwide www delivery (sections 2, 13 and 14). The 90-/400-day selection takes account of account or email hash links; order expiry and account deletion do not mean blanket anonymisation (sections 4, 15 and 16). Section 19 states run intervals and the measured stock of older daily, reference and WAL backups; a local repair is not evidence of their cleanup in production.
Earlier: 28 August 2026 (external email validation service removed; scope and usage rules of the free tools added) · 11 August 2026.