Privacy Policy

Last updated: 31 October 2026

What we collect

• Your order details, through the HolicAudit order page or email: tier, domain and hostnames, any extra pages you list, your hosting platform, your delivery email, and your confirmation that you're authorised to have the site checked.
• Verification data: the token we issue and the result of checking your DNS TXT record or /.well-known/holicaudit.txt file.
• Payment information: order number and exact amount; for USDT, the transaction hash and the address you paid from; for PayPal, the details PayPal shows us about your payment, such as your name, PayPal email address, the amount, the date and your note.
• Emails you send us and our replies.

We never ask for logins, passwords, API keys, server access or source code. Please don't send them.

What the audit collects about your site

The audit collects public information about the hostnames you verified: response headers, TLS certificate details, public DNS records, software versions the site announces, and yes/no results for well-known sensitive file paths. We never download or keep the contents of sensitive files. All of this is printed in your report.

How we use it

Only to verify ownership, produce and deliver your report, run any re-checks in your tier, and handle your revision or refund. We don't sell, rent or share your information or findings, and we don't add you to a mailing list.

How long we keep it

We delete your order details, the scan data and the report file we keep 90 days after delivery, or after your last included re-check if that's later. We may keep a minimal payment record (date, amount, transaction hash or PayPal transaction ID) for bookkeeping. A USDT transaction is permanently public on the Tron blockchain, and no one can delete it. PayPal keeps its own records of PayPal payments.

Free headers check

The free security headers check runs on our HolicAudit server. It loads the address you enter once, like a browser would, and looks up your domain's public SPF and DMARC records through Cloudflare's public DNS. We keep the checked address and its results for 7 days, count checks per IP address to limit abuse (those counters delete themselves within 2 hours), and get a short private Telegram notification with the checked domain, its grade and your country, at most once an hour per domain. If you ask us to email you the report, we store your email address, the checked address and its results for 90 days, only to send that report and answer your reply. No mailing list. Details are in the HolicAudit privacy policy.

This website

This site uses no cookies, analytics or trackers. The only script is our own on the free headers check page, which sends the address you enter to our checker and stores nothing in your browser. Our hosting provider, Cloudflare Pages, may keep standard server logs, such as IP addresses, for security and operations under its own privacy policy. Ordering happens on audit.huutran.dev, which is covered by the HolicAudit privacy policy.

Service providers

We use Cloudflare to host our sites and store order records, an email provider to send and receive email, and Telegram for private notifications about orders and free-check use. During an audit we query public services: NVD and OSV.dev with software names and versions only, Google Public DNS-over-HTTPS for DNS lookups, hstspreload.org, and for Plus, public certificate-transparency search with your domain name.

If you pay with PayPal, PayPal processes the payment and receives your payment details (such as your card or bank details and PayPal account information) directly; we never see your card or bank details. PayPal handles that information under its own privacy statement.

Your choices

You can ask at any time to see or delete the information we hold about you. We'll do so unless we must keep a payment record. Email holicaudit@mail.grokbot.com.