Privacy Policy

Effective date: 25 July 2026

AI Site Scorer scans public websites and publishes readiness scores. This notice describes exactly what we collect, where it goes and how long we keep it. It is short because we collect very little — there are no accounts, no logins and no tracking.

PWN-ALL Auditing, Reviewing & Testing Cyber Risks CO. L.L.C is the data controller for the processing described here. This notice covers the AI Site Scorer product at ai-friendly.pwn-all.com only; the pwn-all.com website has its own privacy notice, and data processed under a signed engagement is governed by that engagement instead.

1. What we collect

When you run a scan

• The domain you submit and the results of the checks we ran against it: scores, grade, per-check pass/fail, observations and the timestamp.
• Your IP address and a counter, stored as one row per address per UTC day, used only to enforce the daily scan limit. It is stored in plain form and deleted as described in section 4.
• No page content. We fetch your homepage and a handful of well-known paths to run the checks, then discard the response bodies. We do not archive, index or republish your pages.

When you buy a report

• The Stripe Checkout session identifier, the email address Stripe provides for delivery, the plan, the amount, and the domain you asked us to audit.
• Card details never reach our servers. Payment is handled entirely by Stripe; we only ask Stripe whether a session was paid and where to send the report.

Automatically

• Standard web server logs — IP address, timestamp, requested path, status, user agent — kept for operational security and troubleshooting.
• Your theme choice (light/dark/auto) is stored in your browser's local storage. It never leaves your device and is not a cookie.

2. Why we process it, and on what basis

• To deliver the scan you requested and to publish public scores — performance of a contract, and our legitimate interest in operating a public measurement service.
• To enforce rate limits and prevent abuse — legitimate interest in keeping the Service available and not overloading third-party sites.
• To deliver and support paid reports — performance of a contract.
• To meet accounting and legal obligations — legal obligation.

3. Who else sees the data

Three third parties are involved, each for one purpose:

• Stripe — payment processing and verification. Stripe receives your payment details directly and tells us only whether a session was paid and where to send the report.
• Our email provider (Proton Mail) — delivering a report you paid for to the address Stripe supplied.
• A third-party AI search service (duck.ai) — during the optional AI-visibility step, the domain name being scanned is sent to that service as part of a question about it, so we can observe what an AI system says about the site. Only the domain is sent — never your IP address, your email or any content of your pages. These requests are routed through the Tor network by default and are not attributed to you.

We do not sell, rent or trade personal data, and we otherwise disclose it only where legally required. Our servers and service providers may be located outside the UAE; where personal data is transferred internationally we rely on the safeguards offered by those providers.

4. How long we keep it

• Scores and scan results — kept as a public historical record until you ask us to remove them.
• Daily IP scan counters — meaningful only for the current UTC day and routinely cleared; never used for anything except rate limiting.
• Web server logs — rotated and deleted automatically after roughly two weeks.
• Purchase records — retained while needed for delivery, support and accounting obligations.

5. Public by default, private when paid

A free scan is public: its score appears on public score pages, in comparisons, in our sitemaps and through our read-only agent interfaces. Do not submit a domain if you do not want its score to be public.

A scan produced by a purchase is stored as private and is excluded from public score pages, the recent list, comparisons, our MCP tool and both sitemaps. It exists only to build the report we email you.

6. If we scanned a site you operate

Our scanner identifies itself as AI-Site-Scorer and makes a small number of ordinary HTTP GET requests to public paths. It executes no JavaScript, submits no forms, attempts no authentication and follows the rate limits above.

If you would rather your domain were not scored, tell us and we will delete its stored scores and refuse future scans. You do not need to prove ownership to have a score removed.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent where processing relies on it — including under EU/UK GDPR, the UAE Personal Data Protection Law, and US state privacy laws.

To exercise any of these, or to have a domain's scores removed, write to legal@pwn-all.com. You may also lodge a complaint with your local data protection authority.

8. Security

The site is served over HTTPS. The database is not reachable from the public internet. The scanner refuses private, internal and loopback addresses by design. To report a security issue see /.well-known/security.txt. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Children

The Service is a tool for website operators and is not directed at children.

10. Changes and contact

If this notice changes, the effective date at the top of this page changes with it. Privacy enquiries: legal@pwn-all.com. See also our Terms, which explain that we promise no result and that payments are not refundable.