Data and privacy
Email to access results
At the end of the check, an email address is required to display results. It is stored in Resend in a group dedicated to diagnostic requests. It is not added to a newsletter and entering it does not constitute consent to marketing emails. New addresses are excluded from marketing sends; existing contact preferences are not changed. Results appear on the site and a PDF report is emailed to this address via Resend. The PDF contains the domain and summarized findings, without secret values or inspected files. Resend processes the email and attachment under its retention policy. To request deletion of this address, contact hello@mcia.io.
Free check
We inspect one public page and selected scripts in memory. Secret patterns are masked and never used. For certain identified Supabase projects, bounded HEAD requests examine metadata without downloading rows. The report lists scope and limitations. No private repository or user account is connected.
Your browser
Language and scanned domains are stored locally for an indicative five-free-project limit per browser. Your check authorization expires after two minutes. To prepare a purchase, an encrypted copy of observations and builder choices is held in the tab’s session storage. The purchase token expires after 24 hours. Closing the tab or clearing site data removes this storage according to your browser. Downloaded files remain under your control.
Purchase and delivery
When checkout is open, Stripe processes payment information and the email address entered. A limited encrypted diagnostic summary is temporarily attached to the order so delivery does not depend on your return to the site. It contains no inspected files or secret values. The webhook removes this summary from active metadata after delivery, expiration or definitive payment failure; provider logs and backups follow their own policies. Transaction information and a report fingerprint remain for order handling. A seven-day HttpOnly technical cookie protects receipt access in the purchasing browser.
Emails and requests
Resend processes transactional emails and attachments to deliver the report. A purchase does not subscribe you to a newsletter. The contact form prepares a draft in your email client and sends nothing automatically. Do not include secrets or user personal data.
Hosting and access
Vercel hosts the site and measures traffic. Application code does not log diagnosed URLs, secrets or reports. Providers’ technical metadata, logs and transfers depend on their configuration and terms. Local repeated-request protection temporarily holds an IP fingerprint. Private-code analysis and its AI providers are not enabled in this beta.
Your rights
Leny Moncy, sole proprietor trading as MCIA (SIRET 98830500900017), operates WeakSpot AI. For questions, access or deletion requests for data processed on your behalf, contact hello@mcia.io. Certain transaction data may need to be retained for legal obligations. You may also contact the competent data protection authority.