Privacy notice
Written from the database schema rather than from a template, so it describes what is actually stored. Where something is unusual — and two things here are — it says so.
Last updated .
Who we are
Skiplink is operated by ThirteenTabs LTD (“we”), the controller for the personal data described below. Registered in England & Wales, company number 17326399 — our registered office and filing history are on the public register at Companies House.
For anything in this notice, including a request to exercise your rights, email hi@skiplink.dev.
Two different roles, and the distinction matters
We handle personal data in two capacities, and your rights differ between them.
- As a controller, for your account: your email address, your password, your API keys, what you were billed for. This notice covers that.
- As a processor, for what a scan returns. When we scan a page, the result includes fragments of that page's markup — and a page can contain personal data. If you scan a profile page, a review, or anything with a name on it, that name may end up in the scan result we store for you. You decide what to scan; we hold the result on your instruction. The data processing addendum governs that, and it forms part of your contract with us automatically — you do not need to sign anything.
What we hold, and why
Your account
| Data | Why | Lawful basis | Kept |
|---|---|---|---|
| Email address | Identifies the account, receives verification and sign-in links, and is how we tell you about an incident. | Performance of a contract | Until you delete the account, then 30 days |
| Password | Signing in. Stored as an argon2id hash, never as the password. | Performance of a contract | As above |
| Session tokens | Keeping you signed in. Stored as a SHA-256 hash of the token — no IP address and no browser fingerprint. | Performance of a contract | 30 days, or until you sign out |
| API keys | Authenticating your CI. Stored as a hash plus a short prefix so we can tell you which key it was. | Performance of a contract | Until you revoke the key |
| Usage records | Counting scans so we can bill correctly and show you your quota. One row per scan: which account, when, whether it was billable. | Performance of a contract, and legal obligation for the accounting records | 7 years, to satisfy statutory accounting retention |
| Verification and reset tokens | Confirming your email and resetting your password. Stored hashed. | Performance of a contract | Deleted on use. Otherwise they expire on their own: 15 minutes for an email verification, 30 minutes for a password reset or a sign-up link. |
What you ask us to scan
| Data | Why | Lawful basis | Kept |
|---|---|---|---|
| The URL you submitted | Running the scan and showing you its history. | Performance of a contract | 13 months, then deleted automatically |
| Violations, including markup fragments | Telling you what is wrong and where. Each finding carries a snippet of the offending element, truncated, because “img has no alt” is useless without knowing which one. |
Performance of a contract. We act as your processor for anything personal inside those fragments. | 13 months, then deleted automatically |
| Monitor webhook URLs | Telling you when a monitored page regresses. | Performance of a contract | Until you delete the monitor |
| Report PDFs and their branding | The white-label reports agencies generate. Includes the branding you configured and your client's name if you supplied one. | Performance of a contract | Until you delete the report or the workspace |
The free scanner
You can scan a URL on the public page without an account. That runs against a shared internal account with a monthly ceiling, and it is rate limited per IP address.
We do not store IP addresses
The rate limiter keeps a counter in Redis keyed on your IP with a two-minute expiry, and that is the only place an IP address exists. It is never written to the database, never logged alongside a scan, and there is no table it could be joined against. Two minutes after your last request there is no record that the address was ever here.
Our lawful basis for that brief processing is legitimate interests — specifically, not letting one visitor exhaust a free service for everyone else. The alternative is requiring an account to scan anything, which would collect more, not less.
Analytics
There are none. No Google Analytics, no product analytics, no session recording, no heatmaps, no advertising or conversion pixels, no third-party fonts or CDN. The cookie notice is short for the same reason. This is verifiable rather than a promise: the site's Content Security Policy blocks every external connection except our own API, so a tracker could not load even if one were added by mistake.
Who else touches it
Five companies, each doing one job. The current list, with what each one can see, is on the sub-processors page, which is the version we keep updated — we will not maintain two copies of it.
We do not sell personal data, we do not share it for advertising, and we do not use it to train machine-learning models.
International transfers
Our servers and database are in the EU. Some sub-processors are US companies that may process data outside the UK and EEA; where they do, transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, as set out per provider on the sub-processors page.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing based on legitimate interests. You can also ask for your data in a portable form — for an account, that is a JSON export.
Email hi@skiplink.dev. We will respond within one month. There is no charge, and we will not ask you to justify the request.
Deleting your account removes the account, its users, its keys, its scans, its monitors and its reports from the live database within 30 days. Backups age out on their own cycle, so the data is gone from those within a further 14 days. The usage ledger is the exception: those rows are financial records and are kept for 7 years, reduced to the account identifier, a date and a count — no URLs, no scan content.
If you think we have got this wrong, you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA. We would rather you told us first, but you do not have to.
The 13 months is enforced, not aspirational
A background job on the API deletes scans past that age every hour, in batches. It is part of the same maintenance loop that requeues lost jobs rather than a scheduled task somebody has to remember to install, because a retention commitment that depends on a separate deployment step is one that quietly stops happening. There are tests that insert rows either side of the boundary and assert which ones survive.
How it is protected
Passwords are argon2id hashes; API keys, session tokens and email tokens are stored hashed; everything travels over TLS. The database is reachable only from the machine it runs on — not from the internet, and not even from the box that renders scanned pages, which holds no credentials at all. The security page has the detail, including how to report a vulnerability.
Automated decision-making
There is none. Nothing about your account, your access or your billing is decided by an algorithm without a person, and we do not profile you. The scanner analyses web pages; it does not analyse you.
Children
Skiplink is a developer tool sold to businesses. It is not intended for anyone under 16 and we do not knowingly collect their data.
Changes
If we change this notice in a way that affects you, we will email account holders before it takes effect rather than quietly updating a date. Previous versions are in the repository's history.