PHP SITE AUDIT · EFFECTIVE OCTOBER 23, 2026

Privacy notice

PHP Site Audit is a service provided by Synorb Inc., the service provider. Contact reports@phpsiteaudit.com about this service or your data.

Information we process

We process the domain you submit, public website responses needed for the requested checks, your email address, the authorization and terms versions you accept, your report, payment and refund references, and operational security data. Request IP addresses are used for rate limits; we do not store an IP address as a receipt for your terms acceptance. Do not submit website passwords, SSH keys, payment card numbers, private code, or other secrets. Stripe collects payment details directly and provides us payment status and transaction references.

How we use and share information

We use information to run the authorized public checks, create and deliver the report, process payment or refunds, prevent abuse, provide support, and meet applicable obligations. AWS provides hosting and storage for the service and its report database. Stripe processes checkout and payment information. Depending on configuration, Mailgun or Amazon SES processes the delivery email, including its recipient, delivery metadata, and private report link. Each provider processes information needed for its role under its own terms and privacy practices. We do not sell reports or publish findings.

Private report links and saved copies

Your online report is available through a private link: anyone who has the link can read it. Do not post or forward it except to people authorized to help with your site. Reports are excluded from search indexes and public sitemaps. We retain the online report for 30 days, then delete its contents and redact the associated email, domain, and access token from the service. Email providers may retain delivery records or copies under their own retention practices. If you print or save a report as a PDF, that file is stored outside our service; we cannot revoke, delete, or control copies you or recipients keep.

Retention

Unpaid lookup data expires after 24 hours. Online paid reports remain available for 30 days. Refunds that still need resolution retain the information necessary to resolve them. Encrypted service database backups are kept in AWS for a rolling period of about 30 days after each backup snapshot. Since a snapshot can contain data already deleted from the live service, deleted report or customer data may remain in a backup for up to about 31 additional days. If a backup is restored, scheduled retention cleanup runs before the restored service is returned to use. Minimal transaction, consent-version, and accounting references may be retained for legal, fraud-prevention, refund, and financial recordkeeping obligations. Contact us to request access, correction, or deletion; requests remain subject to records we must keep.

Browser, analytics, and checkout data

The audit flow may keep temporary progress information in your browser. We use the request IP address to make a local DB-IP country lookup that decides whether the analytics consent notice is required; we do not send the address to a geolocation API or return the country lookup result. DB-IP Lite provides the local database and is credited below. If location is unavailable or uncertain, the notice is shown. In Europe, optional Google Analytics remains off until you choose Allow analytics. Outside Europe, it is enabled by default unless you decline in Cookie preferences or your browser sends a Global Privacy Control or Do Not Track signal. You can change your choice at any time in the footer. When enabled, analytics measures public page views and generic action counts. We configure it not to send query strings, entered website addresses, lookup results, email addresses, report details, payment references, or checkout URLs. We do not require analytics to use the service. Stripe may use its own cookies and security technologies during checkout; checkout is provided by Stripe and is subject to its own privacy information. Accepting the service terms and confirming website authorization are separate choices from analytics preferences.