Privacy Policy

Last updated: 31 October 2026

In short: we collect only what the audit needs and never ask for passwords. This site has no tracking or analytics. Scan data and order details are deleted 90 days after delivery.

What we collect

Your order details, through the HolicAudit order page or email: tier, domain and hostnames, any extra pages you list, your hosting platform, your delivery email, and your confirmation that you're authorised to have the site checked.
Verification data: the token we issue and the result of checking your DNS TXT record or /.well-known/holicaudit.txt file.
Payment information: order number and exact amount; for USDT, the transaction hash and the address you paid from; for PayPal, the details PayPal shows us about your payment, such as your name, PayPal email address, the amount, the date and your note.
Emails you send us and our replies.

We never ask for logins, passwords, API keys, server access or source code. Please don't send them.

What the audit collects about your site

The audit collects public information about the hostnames you verified: response headers, TLS certificate details, public DNS records, software versions the site announces, and yes/no results for well-known sensitive file paths. We never download or keep the contents of sensitive files. All of this is printed in your report.

How we use it

Only to verify ownership, produce and deliver your report, run any re-checks in your tier, and handle your revision or refund. We don't sell, rent or share your information or findings, and we don't add you to a mailing list.

How long we keep it

We delete your order details, the scan data and the report file we keep 90 days after delivery, or after your last included re-check if that's later. We may keep a minimal payment record (date, amount, transaction hash or PayPal transaction ID) for bookkeeping. A USDT transaction is permanently public on the Tron blockchain, and no one can delete it. PayPal keeps its own records of PayPal payments.

This website

This site uses no cookies, analytics, trackers or scripts of any kind. Our hosting provider, Cloudflare Pages, may keep standard server logs, such as IP addresses, for security and operations under its own privacy policy. Ordering happens on holicaudit.pages.dev, which is covered by the HolicAudit privacy policy.

Service providers

We use Cloudflare to host our sites and store order records, an email provider to send and receive email, and Telegram for private order notifications. During an audit we query public services: NVD and OSV.dev with software names and versions only, Google Public DNS-over-HTTPS for DNS lookups, hstspreload.org, and for Plus, public certificate-transparency search with your domain name.

If you pay with PayPal, PayPal processes the payment and receives your payment details (such as your card or bank details and PayPal account information) directly; we never see your card or bank details. PayPal handles that information under its own privacy statement.

Your choices

You can ask at any time to see or delete the information we hold about you. We'll do so unless we must keep a payment record. Email holicaudit@mail.grokbot.com.