The URLs you submit are public web addresses, not secrets. We fetch each page once over HTTPS, scan the returned HTML in memory, and return the findings. Nothing about the pages themselves (their content, HTML, or our findings) is written to a database or log. For the paid scan, the URLs you enter are stored only as Stripe Checkout Session metadata (Stripe's own systems) so the report page can regenerate your results after payment — we keep no separate copy.
An email address is optional on the free check and is used only to notify you if we flag something serious; it is sent to a private alert channel, not added to any mailing list.
Payment details for the $29 charge are processed by Stripe; we do not handle or store card numbers. See Stripe's privacy policy.
Questions: use the contact details you provided at checkout.