conformance.report

Privacy policy

Last updated 22 September 2026

Who is responsible

conformance.report is operated by Ramanand Kumar, a sole proprietor based in India, who is the data controller for the purposes of the EU General Data Protection Regulation and the data fiduciary under India's Digital Personal Data Protection Act, 2023. Contact for data-protection matters: privacy@conformance.report.

What we collect

Contact details you give us
Your name, email address, and company, when you request a scan, subscribe, or email us.
Site addresses you submit
The URLs you ask us to scan, and the identity of the person who submitted them.
Scan output
Technical findings about the pages we scan: HTML fragments, CSS selectors, computed colour values, screenshots of public pages, and browser console output. We do not scan authenticated areas, submit forms, or attempt to reach personal data.
Billing records
Subscription status, invoices and payment outcomes. Card details are handled entirely by Razorpay Software Private Limited; we never receive or store them.
Business contact data for outreach
Publicly published business contact details (a company email address on a company website) used to offer a relevant service. See "Marketing" below.

This site sets no cookies and runs no analytics or advertising scripts.

Why we are allowed to use it

  • Performance of a contract: to run scans, produce reports and manage your subscription.
  • Legitimate interests: to contact businesses about a service relevant to their published activity, and to keep our own service secure and working. We have weighed this against your interests and you may object at any time.
  • Legal obligation: to retain tax and accounting records.
  • Consent: where you ask us to send you something specific. You may withdraw it at any time.

Marketing

We contact businesses using contact addresses they have published themselves. Every message identifies us, states why we are writing, and carries a working opt-out. We honour an opt-out on the first request and keep a suppression record so we do not contact you again. We do not buy, rent or scrape contact lists from third-party data brokers, and we do not send marketing to personal addresses.

Who else sees your data

We use a small number of processors and share only what each needs:

  • Razorpay: payments and subscriptions.
  • Vercel: hosting for this website.
  • Hostinger: email.

We do not sell personal data, and we do not share it for advertising.

Where it is processed

Scanning and report generation run on our own equipment in India. If you are in the EEA or UK, this means your data is transferred outside it. India has no EU adequacy decision, so we rely on the EU Standard Contractual Clauses where they apply, and we keep the personal data involved to a minimum. For a scan that is typically only the email address of the person who requested it.

How long we keep it

  • Scan results and screenshots: 12 months, then deleted. Tell us to delete sooner and we will.
  • Account and contact records: for the life of the account, then 12 months.
  • Invoices and tax records: as long as Indian tax law requires.
  • Opt-out suppression records: indefinitely, because deleting them would let us contact you again by mistake.

Your rights

You may ask for a copy of your data, ask us to correct or delete it, object to our legitimate-interest processing, ask us to restrict it, or request it in a portable form. Email privacy@conformance.report and we will respond within 30 days. If you are in the EEA or UK you may also complain to your national supervisory authority; in India, to the Data Protection Board.

Security, stated plainly

Data in transit is encrypted. Access is limited to the operator. We are a small operation and we are not going to claim certifications we do not hold. If a breach affects you we will tell you without undue delay.