Every site PrivacyLens has scanned.

This Facebook domain presents severe compliance and transparency risks. All critical legal documents—Privacy Policy, Terms of Service, and Cookie Policy—are linked from the homepage but return 'Not found' when accessed, indicating broken routes or improperly configured pages. This constitutes a catastrophic failure to meet GDPR Article 12 transparency requirements, CCPA disclosure obligations, and basic user contract formation. Users cannot meaningfully consent to data processing or understand their rights. While no third-party trackers were detected on the homepage scan, the absence of accessible policies means users have no way to verify what data is collected, how it's used, or their legal protections. This represents an existential legal risk for any data controller.

GOG Unlocked presents severe legal and privacy risks. The site distributes copyrighted GOG games for free download without authorization, which exposes users to potential malware, legal liability, and data collection without safeguards. No privacy policy, terms of service, or cookie policy exists despite deploying Google Analytics tracking. The site lacks any legal framework to inform users how their data is collected, used, or shared. The 'cookie policy' link discovered on the homepage actually points to a game download page (Cookie Cutter game), not a legitimate policy document. Users have no visibility into data practices, third-party sharing, or GDPR rights. The business model itself—unauthorized game distribution—creates fundamental trust and safety concerns beyond typical compliance issues.

Airbnb presents several critical privacy and compliance issues. Both the privacy policy and terms of service links return only navigation fragments and brief summaries rather than full legal documents, effectively leaving users without access to comprehensive policy text. No cookie policy was found despite the presence of tracking technologies (Facebook Pixel). While a consent banner is present and the site references region-specific privacy supplements (US, Brazil, China, Korea, Colombia, Türkiye), the lack of accessible full documentation creates significant GDPR Article 12 and CCPA transparency risks. The site appears to be a major platform handling payment and sensitive user data, making these documentation gaps particularly concerning.

PAOKFC.NET is a Greek sports news site about PAOK football club. It deploys Google Analytics tracking without a cookie consent banner, violating the ePrivacy Directive. The Privacy Policy is labeled 'Android App' and only covers the mobile application, leaving website visitors without proper notice. No standalone Terms of Service or Cookie Policy exist for the website. The site lacks GDPR-required elements such as a legal entity name, data controller contact, data retention periods, and rights request mechanisms. No payment processing is detected. The site appears to be a content aggregator with embedded third-party advertising services (AdMob, Firebase Analytics) mentioned only in the app policy, but not disclosed for the website itself.

This website presents severe privacy and legal compliance risks. No privacy policy, terms of service, or cookie policy could be found despite copyright claims suggesting active operation. The site demands 'human verification' before revealing content, a common pattern in link-shortening or file-sharing schemes that may expose users to malicious redirects or deceptive advertising. The warning to 'ignore any download windows' is a major red flag suggesting the site knowingly exposes visitors to potentially harmful third-party content. Without any legal documentation, users have no insight into data practices, liability limitations, or dispute resolution. This configuration creates high legal exposure for both the operator and users.

JobLeads.com appears to be a job-board aggregator operated by JobLeads GmbH (Germany) and JobLeads US (USA). The site has comprehensive Privacy and Terms documents that demonstrate GDPR awareness, including Standard Contractual Clauses, Transfer Impact Assessments, and detailed third-party disclosures. However, several high-severity issues significantly undermine compliance: (1) Google Analytics is deployed on the homepage without a cookie consent banner, violating ePrivacy Directive and GDPR consent requirements; (2) No standalone Cookie Policy exists despite numerous tracking partners listed in the Privacy Policy and active tracking technology; (3) The site processes data for multiple AI/ML partners (OpenAI, Anthropic, Cohere, Google Gemini) without clear user notification or separate consent mechanisms; (4) Co-registration with third parties (Lensa) for marketing purposes lacks transparent opt-in flows. The legal documents are attorney-grade in structure but operational practice lags behind policy commitments.

This website presents severe privacy and compliance risks. The homepage is blocked or inaccessible, and all three core legal documents—Privacy Policy, Terms of Service, and Cookie Policy—are completely absent. No cookie consent banner was detected, and no trackers or payment processors were identified. The lack of foundational legal documentation creates significant liability under GDPR, CCPA, and consumer protection laws. Users have no visibility into data practices, legal rights, or liability limitations.

Stripe demonstrates strong privacy practices overall with comprehensive policies, transparent data processing disclosures, and robust GDPR/CCPA compliance frameworks. The company maintains detailed documentation about data controller/processor roles, international data transfers, sub-processors, and individual rights. However, several issues prevent a higher score: the Privacy Policy is extremely lengthy (potentially violating GDPR Article 12's requirement for clear, concise information), cookie consent mechanisms may not fully satisfy ePrivacy Directive requirements for all use cases, and the site deploys advanced fraud detection tracking that requires careful scrutiny. As a payment processor handling sensitive financial data, Stripe's transparency is commendable, but the complexity and volume of legal documentation may overwhelm users seeking to understand their rights.

This website presents severe privacy and compliance risks. The site appears to be a Cloudflare security challenge page rather than functional content, with no discoverable privacy policy, terms of service, or cookie policy despite the domain suggesting it may be related to Lithuanian tax authority (VMI). The complete absence of legal documentation, combined with no cookie consent mechanism and unclear site purpose, creates high regulatory exposure. Users cannot meaningfully assess data practices or legal rights. The site requires immediate remediation before it can be considered minimally compliant with EU data protection law.

This website presents severe privacy and compliance risks. No functional privacy policy exists despite the site deploying Google Analytics tracking, which creates potential GDPR and ePrivacy violations. The 'Terms' and 'Cookie Policy' links appear to be broken or mislabeled, pointing instead to unrelated game download pages. The site offers copyrighted game downloads for free, raising significant legal and intellectual property concerns. With active tracking, no privacy disclosures, no cookie consent mechanism, and broken policy links, users face substantial data protection risks. The site's entire business model may violate copyright law, further compounding trust issues.

This website presents severe privacy and compliance risks. No privacy policy, terms of service, or cookie policy could be located despite the site requiring JavaScript rendering to display content. The domain appears to be a third-party affiliate or download portal (softonic-id.com) using paid advertising campaigns with tracking parameters, yet provides zero transparency about data collection, user rights, or legal obligations. The complete absence of foundational legal documentation creates substantial GDPR, CCPA, and ePrivacy Directive violations. Users have no way to understand what data is collected, how it's used, or how to exercise their rights.

This website presents severe privacy and compliance risks. It claims to contain adult content yet displays a security check barrier with no discoverable privacy policy, terms of service, or cookie policy. The absence of foundational legal documents, combined with the sensitive nature of the content, creates extreme GDPR Article 13/14 transparency violations and potential legal exposure. The site collects user interaction data (captcha submission) without any disclosed data processing practices, retention periods, or user rights mechanisms. No evidence of age verification, consent management, or lawful basis documentation exists. This configuration represents a high-risk posture for both operators and visitors.

This website presents severe privacy and compliance risks. There is no privacy policy, no terms of service, and no cookie policy, despite deploying Google Analytics tracking. No cookie consent banner is present while non-essential tracking cookies are active, creating immediate GDPR and ePrivacy Directive violations. The login functionality handles user credentials without published data processing terms, creating significant legal exposure. Users have no visibility into how their data is collected, used, or protected. This configuration represents critical gaps that could result in regulatory enforcement action.

This Venezuelan government transport authority website (INTT) presents severe privacy and compliance risks. The site completely lacks a privacy policy, terms of service, and cookie policy despite operating online user accounts and citizen transaction services. While no third-party trackers were detected on the homepage, the absence of fundamental legal documentation means users have no information about data collection, processing, retention, or their rights. For a government entity handling citizen data including driver's license applications and vehicle registrations, this represents a critical transparency failure and potential violation of data protection principles.

This Islamic boarding school website presents severe privacy and legal compliance risks. No privacy policy, terms of service, or cookie policy exist — each is a foundational requirement under GDPR, CCPA, and modern web best practices. The site collects personal data through registration forms ('Daftar Sekarang' / 'Info PSB') without disclosing processing purposes, legal bases, data retention periods, or user rights. No cookie consent mechanism is present, though the scope of tracking is unclear. The absence of legal documentation exposes the institution to regulatory complaints, parental concerns about student data protection, and reputational harm. For an educational institution handling minors' data, this is particularly concerning.

PayDrop is a creative file handoff platform that collects payments and handles personal/financial data, yet operates without any discoverable Privacy Policy, Terms of Service, or Cookie Policy. This creates severe GDPR Article 13/14 transparency violations, potential liability under CCPA, and significant contractual risk for both creators and clients. The absence of legal documentation for a payment-enabled platform handling encrypted files and client data represents a critical compliance gap that exposes the business to regulatory enforcement and user trust erosion.

REWU.org.rw, a trade union site for Rwanda's extractive industry workers, presents severe privacy and compliance risks. The site completely lacks a Privacy Policy, Terms of Service, and Cookie Policy despite deploying Google Analytics tracking. No cookie consent banner is present, meaning non-essential cookies are likely being set without user consent—a clear violation of ePrivacy Directive and GDPR Article 6. The absence of foundational legal documents creates significant liability for an organization handling member data (120,000+ members claimed). While the site's mission is commendable, its legal infrastructure is critically deficient and exposes both the organization and its members to regulatory and reputational risk.

Notion demonstrates strong privacy infrastructure with comprehensive GDPR compliance mechanisms, including Standard Contractual Clauses, data processing agreements, and transparent sub-processor lists. However, several accessibility and clarity issues reduce trustworthiness: the primary privacy policy and terms documents are served entirely in Spanish despite the English homepage, creating a significant language barrier for English-speaking users. The Cookie Notice references cookies not being used in mobile apps but doesn't clarify web-app cookie practices. No cookie consent banner was detected despite the use of Analytics and Marketing cookies, which may violate ePrivacy Directive requirements for EU visitors. The Terms document appears to be Marketplace-specific rather than the main service terms, leaving core contractual obligations unclear. Payment processing details are absent despite enterprise billing mentions.

Notion.so demonstrates a mature privacy and compliance framework with comprehensive GDPR documentation, data processing agreements, Standard Contractual Clauses, and detailed policies. However, the site presents several notable concerns: all discovered legal documents are served in Spanish (es-es locale) rather than English, which may indicate localization issues or incorrect content delivery; the Terms of Service link points to a Marketplace-specific document rather than the core user agreement; the Cookie Notice was last updated September 26, 2023 (nearly three years old); and no cookie consent banner is deployed despite the use of marketing and analytics cookies from multiple third parties (Amplitude, Facebook, Google, LinkedIn, TikTok, etc.), which is a potential ePrivacy Directive violation for EU visitors.

This website presents severe privacy and compliance risks. No privacy policy, terms of service, or cookie policy could be located, despite the URL containing extensive Google advertising tracking parameters. The landing page appears to be a user cabinet or registration area that requires JavaScript rendering to display content, raising accessibility concerns under GDPR Article 12. The complete absence of foundational legal documents combined with evident tracking infrastructure creates major liability exposure for GDPR, ePrivacy Directive, and consumer protection violations.

This site presents severe compliance and transparency risks. No privacy policy, terms of service, or cookie policy could be located despite being legally required for a platform processing user data. Google Analytics is deployed without any visible cookie consent mechanism or disclosure, creating immediate GDPR Article 6 and ePrivacy Directive violations. The domain roblox.com.mu appears to be an unofficial or potentially fraudulent mirror of the legitimate Roblox platform (roblox.com), raising serious brand impersonation and data security concerns. Users have no clarity on who controls their data, how it is processed, or what rights they possess. This configuration exposes both the operator and users to substantial legal and privacy risks.

GitHub.com presents significant privacy and compliance gaps despite being a major platform. The privacy policy page appears to be a placeholder GitHub organization page rather than an actual privacy statement, raising a critical issue. The cookie policy links to a user profile, not a legitimate policy document. While a comprehensive Terms of Service exists (effective April 27, 2026), the absence of functional privacy and cookie policies constitutes high-severity risks under GDPR Article 13-14 transparency requirements. The site deploys a cookie consent banner, but without accessible policy documents, users cannot make informed choices. No payment processors or third-party trackers were detected in the homepage scan, which partially mitigates risk. These gaps are particularly concerning for a platform processing millions of developers' personal data daily.

This website presents critical compliance and trust issues. No privacy policy, terms of service, or cookie policy could be located despite Google Analytics tracking being active on the homepage. The domain roblox.com.mu appears to be an unofficial or potentially fraudulent variant of the legitimate Roblox platform (roblox.com), raising immediate red flags about user safety, data handling, and legal accountability. The absence of fundamental legal documentation combined with active third-party tracking creates severe GDPR, ePrivacy Directive, and consumer protection violations. Users have no way to understand what data is collected, how it's used, or what rights they possess.

GitHub presents significant privacy and compliance concerns despite being a major technology platform. The privacy policy link returns only a GitHub organization page with no substantive privacy documentation—effectively making the policy unavailable. The cookie policy similarly resolves to a user profile page rather than actual policy content. While a comprehensive Terms of Service exists with detailed provisions including AI/ML data usage terms (effective April 27, 2026), the absence of accessible privacy and cookie policies creates substantial GDPR Article 12-13 transparency violations. The site detects a cookie consent banner, suggesting some compliance effort, but without readable policies users cannot make informed choices about their data.

Stripe demonstrates strong privacy practices with comprehensive, multi-jurisdictional privacy disclosures, detailed data processing agreements, and robust GDPR/CCPA compliance infrastructure. The company maintains extensive documentation across privacy policies, terms of service, cookie policies, and international data transfer mechanisms. However, the sheer complexity of its legal framework—spanning dozens of jurisdiction-specific agreements and multiple Stripe entities—may create comprehension challenges for average users. The privacy policy contains forward-looking AI training disclosures and detailed sub-processor lists, though some policies reference dates in 2025 (past) and 2026 (current year context). Minor issues include potential over-complexity for non-legal audiences and the need for clearer plain-language summaries for certain technical processing activities.

GitHub.com presents significant privacy and compliance concerns despite being a major platform. The privacy policy link resolves to an organizational page rather than an actual policy document, constituting a critical deficiency. The cookie policy similarly redirects to a user profile page instead of substantive policy content. While a Terms of Service document exists and appears comprehensive (effective April 27, 2026), the absence of accessible privacy and cookie policies creates substantial GDPR Article 12-13 transparency violations. No third-party trackers were detected on the homepage, which is positive. However, the broken policy infrastructure, lack of clear data processing disclosures, and missing GDPR-specific mechanisms (DPA, data subject rights procedures) represent serious compliance gaps for a platform processing millions of users' personal data.

This site presents severe compliance and transparency risks. The homepage requires JavaScript verification to access, which appears to be a security gate or anti-bot measure, but all three core legal documents—Privacy Policy, Terms of Service, and Cookie Policy—are completely missing. No cookie consent mechanism is present, and the site's content is entirely hidden behind JavaScript, making it impossible to assess data practices or user rights. The domain detect.ac suggests a detection or authentication service, yet provides zero legal framework for how user data is handled. This configuration may violate GDPR Articles 12, 13, and ePrivacy Directive requirements.

This website presents severe compliance and transparency risks. It deploys Google Analytics tracking without any privacy policy, cookie policy, terms of service, or consent mechanism. The complete absence of legal documentation combined with active user tracking creates high liability under GDPR, ePrivacy Directive, and CCPA. Users have no information about what data is collected, how it's processed, their rights, or how to exercise them. This configuration exposes the site operator to regulatory enforcement action and user complaints.

This Facebook page appears to be a shared content URL rather than a complete business website, yielding only login form content instead of substantive privacy or terms documentation. The privacy policy and terms of service links resolve to the same generic Facebook login page with footer links, providing no actual policy text. No cookie policy was found, no cookie consent banner is present, and no trackers were detected on this specific URL. This configuration presents severe transparency and compliance risks, as users cannot access meaningful information about data practices, user rights, or legal terms before engaging with the platform.

This website presents severe transparency and compliance risks. It completely lacks a Privacy Policy, Terms of Service, and Cookie Policy — all fundamental legal documents required under GDPR Article 13, CCPA, and consumer protection laws. The site identifies itself as 'Webull Markets' and appears to be a decentralized finance application requiring wallet integration, yet provides zero information about data processing, user rights, liability, or contractual terms. Without these baseline disclosures, users cannot make informed decisions about their data, and the operator faces significant regulatory exposure in the EU, California, and other jurisdictions with privacy mandates.

Stripe demonstrates strong privacy and compliance infrastructure with comprehensive policies, clear processor/controller delineation, transparent sub-processor lists, and robust data transfer mechanisms (SCCs, DPF certification). The site deploys a cookie consent banner and limits tracking. However, several issues reduce the score: the analyzed Terms document is for a narrow beta product (Payout Card) rather than the main Services Agreement, creating uncertainty about whether general users receive adequate contractual protection; the Privacy Policy lacks a clear 'last updated' timestamp in the analyzed excerpt (though other policy documents show recent 2025/2026 dates); AI model training disclosures, while present, may not be prominent enough for average users; and the sheer volume of policy links (19 privacy, 80+ terms variants) creates navigation complexity that could hinder practical transparency under GDPR Article 12.

Amsterdajoias.com.br presents severe privacy and compliance risks. The site links to Google's generic privacy policy and terms of service rather than publishing its own policies tailored to this Brazilian e-commerce jewelry business. The cookie policy link returns a 404 error. There is no GDPR Article 13/14 data controller information, no Brazilian LGPD compliance disclosure, no cookie consent banner despite potential third-party trackers, and no visible payment processor disclosures for a site accepting transactions. These deficiencies create significant legal exposure and user trust issues.

Facebook.com presents severe compliance and transparency risks. Despite being a major platform that processes vast amounts of personal data, all core legal documents—Privacy Policy, Terms of Service, and Cookie Policy—are either completely absent or their links are broken, returning only the homepage shell. The site deploys Google Analytics tracking without a cookie consent banner and without accessible documentation explaining data practices. This creates substantial GDPR Article 5, 12, 13, and ePrivacy Directive violations. Users cannot make informed decisions about their data, and the platform appears to operate without enforceable user agreements or visible privacy commitments.

Fix Condo is a Philippine-based condo services marketplace that collects user data (booking forms, customer chat, payment info) but operates with zero published privacy policy, terms of service, or cookie policy. This creates severe legal and consumer protection risks. Users have no visibility into how their personal or payment data is handled, stored, or shared. The site advertises professional services including in-person visits to private residences, yet provides no contractual framework, liability clauses, or data protection disclosures. For a platform facilitating paid transactions and dispatching workers to customer homes, these omissions represent fundamental compliance and trust failures under Philippine Data Privacy Act and international norms.

MyCountry.News presents a minimalist privacy approach with a brief but reasonably transparent privacy policy effective May 1, 2026. The site claims zero retention of IP addresses and uses only a single essential cookie for country preference. However, critical compliance gaps exist: no dedicated cookie policy document despite promising one, no GDPR-specific rights language (access, erasure, portability, objection), no Data Protection Officer contact, and a Terms of Service that attempts a broad liability shield which may not be enforceable in all jurisdictions. The platform's franchise model creates complex data controller relationships that are not adequately explained. For a news platform operating globally and processing EU user data, these omissions represent meaningful legal and operational risks.

This Australian cannabis edibles e-commerce site presents significant legal and regulatory risks. While privacy and terms policies exist and cite Australian frameworks (APPs, ACMA spam rules), the site sells THC products that appear to conflict with Australia's heavily restricted cannabinoid regime. The TGA and ACCC strictly control therapeutic goods and misleading claims; Delta-8, Delta-9, and THCA gummies marketed for 'sleep, anxiety, and high-intensity recovery' with labels like '22500mg high-potency' trigger therapeutic goods and advertising violations. The Terms reference the US 2018 Farm Bill (irrelevant in Australia) and incorrectly cite 'State of Sydney' as governing law. The Cookie Policy link leads to a product landing page, not a policy. Age verification is mentioned but enforcement mechanisms are unclear. Payment processors are undetected, raising fraud and consumer protection concerns. No GDPR compliance is needed (Australia is outside the EU), but cross-border data transfers lack detail. No cookie consent banner exists, though trackers were not detected. Overall, the site's regulatory posture appears to misalign with Australian controlled substances, therapeutic goods, and consumer law.

This website presents severe privacy and legal compliance risks. It claims to unlock paid OnlyFans content without authorization, which likely violates multiple laws including the Computer Fraud and Abuse Act, DMCA, and potentially sex work trafficking laws. There is no privacy policy, terms of service, or cookie policy despite a 'Privacy Policy' link in the navigation. The site collects OnlyFans usernames and likely processes personal data without any disclosed legal basis. The business model itself appears designed to circumvent OnlyFans' paywall and access controls, exposing users to potential legal liability, malware, phishing, and data harvesting. The 'anti-bot verification' step is a common vector for affiliate fraud schemes. No GDPR compliance mechanisms exist whatsoever.

Chelenger.com presents severe compliance and transparency risks. The site operates an eSports platform with paid tournaments, subscriptions, and prizepool handling, yet completely lacks a Privacy Policy, Terms of Service, and Cookie Policy. No consent banner was detected, and no trackers were observed in this scan. The absence of foundational legal documents for a platform processing user registrations, payments, and competitive gaming data creates HIGH exposure under GDPR Article 13/14 (information obligations), CCPA transparency requirements, and contractual enforceability concerns. Users have no visibility into data practices, dispute resolution, refund policies, or liability terms. This is not compliant and poses significant legal and reputational risk.

This is a political campaign website (National Party NZ) that collects user data through an interactive game and leaderboard without any privacy policy, terms of service, or cookie policy. The site stores usernames and scores, which constitutes personal data processing under GDPR/Privacy Act 2020, yet provides zero transparency about data handling, retention, or user rights. No legal foundation exists for data collection, no consent mechanism is present, and users have no way to exercise their rights. This represents severe non-compliance with New Zealand and EU privacy law.

This Greek sports news site (PAOK24.com) presents several significant privacy and compliance concerns. While a privacy policy exists and covers many GDPR-required topics, the site deploys Google Analytics tracking without a cookie consent banner, which is a serious ePrivacy Directive violation. The Terms of Service link appears broken (returns homepage content rather than actual terms), creating legal exposure. No separate cookie policy exists despite the privacy policy referencing one. The privacy policy itself lacks critical detail on data retention periods, third-party sharing specifics, and cross-border transfers. For a content site with ad-supported revenue and third-party trackers, these gaps create moderate to high regulatory risk.

Athletiko.gr is a Greek sports news site with significant privacy and compliance gaps. While a privacy policy exists and references GDPR, the site lacks Terms of Service entirely and has no Cookie Policy despite deploying Google Analytics tracking. The privacy policy link from the homepage appears functional but the absence of a cookie consent banner while tracking users is a serious ePrivacy Directive violation. Additionally, no Terms of Service were found despite typical user-generated content features (comments, newsletters). The site uses third-party analytics without explicit user consent mechanisms, creating potential regulatory exposure under both GDPR and Greek data protection law.

Athletiko.gr is a Greek sports news website that has taken some initial steps toward GDPR compliance—it provides a basic privacy policy (dated April 2025, which is past relative to the September 2026 analysis date) covering data collection, cookies, user rights, and a DPO contact. However, significant gaps remain: the site deploys Google Analytics tracking without a visible cookie consent banner, the Terms of Service link appears to be broken (returning no content), and there is no separate cookie policy despite explicit mention of cookies in the privacy document. The absence of a consent mechanism for non-essential analytics cookies is a substantial ePrivacy Directive issue. The privacy policy itself is relatively brief and lacks detail on third-party data sharing, international transfers, and data retention schedules. For a content site serving EU visitors, these omissions create moderate to high legal and reputational risk.

BizTech Resource Analyst demonstrates reasonable privacy compliance efforts with comprehensive Privacy Policy, Terms, and Cookie Policy documents all effective April-May 2026. The site transparently discloses use of Google Analytics, Google Ads, and third-party processors including Stripe for payments. However, several compliance gaps exist: no functional cookie consent banner is present despite deployment of non-essential tracking (Google Analytics), which violates ePrivacy Directive requirements for EU visitors. The Privacy Policy mentions Google Consent Mode v2 and CookieYes/Cookiebot but no banner was detected on the homepage. GDPR-specific mechanisms like data processing agreements for B2B clients and explicit legal bases under Articles 6 and 9 are not documented. The Terms lack dispute resolution procedures and jurisdiction is vaguely stated as 'United States' rather than specific venue. Payment processing via Stripe is mentioned but PCI-DSS compliance attestation is absent.

Krooko demonstrates above-average privacy practices with a genuinely detailed GDPR-compliant privacy policy, transparent terms of service, and a no-tracking cookie approach. The site is operated by a private individual in Greece and processes data within the EU. Significant strengths include strict data minimization (no phone numbers, addresses, or payment data), automatic content deletion after 30 days, and honest disclosure of third-party AI processing. However, critical weaknesses exist: missing Standard Contractual Clauses for US data transfers (FormSubmit and NVIDIA), future-dated policy effective dates that create legal uncertainty, no formal DPO despite potentially systematic monitoring at scale, reliance on legitimate interests for several consent-appropriate purposes, and insufficient guidance on user responsibilities when sharing voice recordings and files outside platform controls.

AI Text Watermark Remover presents a mixed privacy posture. The site offers a Privacy Policy and Terms of Service that are recent (August 14, 2026), clearly disclose local vs. server-side processing for free vs. Pro tools, and name third-party processors (Stripe, Google, AI providers). However, the Privacy Policy lacks critical GDPR components: no legal bases for processing, no data retention periods, no user rights (access, deletion, portability), no DPA or processor details, and no EU representative or supervisory authority information. The Cookie Policy is entirely missing despite the Privacy Policy referencing cookies, creating a compliance gap under the ePrivacy Directive. Terms disclaim all guarantees and liability broadly, and refunds require manual email requests with no self-service option, raising consumer-protection concerns. No trackers were detected and no consent banner was observed, which is appropriate if only essential cookies are used, but the absence of a Cookie Policy leaves this claim unverified. Overall, the site demonstrates transparency about data flows but falls short of full GDPR/CCPA compliance and consumer protection standards.

SceneGenerator.io demonstrates moderate privacy practices with comprehensive legal documentation covering privacy, terms, cookies, and a detailed AI content-moderation policy. The privacy policy addresses GDPR rights (access, export, delete) and clearly explains data practices. However, the site lacks key GDPR infrastructure: no cookie consent banner despite analytics cookies mentioned in the cookie policy, no Data Processing Agreement for B2B customers, and the privacy policy does not identify the data controller entity or cite specific GDPR legal bases. The terms include an unusually robust AI acceptable-use policy with pre-screening enforcement. Payment handling is delegated to third parties with no card storage. The site appears to lack third-party trackers at present, which is positive, but the cookie policy references analytics cookies that may be deployed conditionally.

This website presents severe compliance and transparency risks. Despite claiming to have privacy and cookie policies via footer links, both documents are completely inaccessible—the URLs either return the homepage shell or are broken. This constitutes a high-severity violation of GDPR Article 13 transparency requirements and potential breach of good faith under Article 5. The complete absence of Terms of Service creates unaddressed legal liability for the business. While no third-party trackers were detected on the homepage (mitigating immediate consent banner concerns), the broken policy infrastructure suggests systemic neglect of privacy obligations. Organizations handling any EU/EEA data must immediately remediate these foundational failures.

This website presents severe compliance and transparency risks. All core legal documents—Privacy Policy, Terms of Service, and Cookie Policy—are completely absent, with no discoverable links on the homepage. This creates immediate exposure under GDPR Article 13 (transparency obligations), potential CCPA violations, and leaves users with zero understanding of how their data is collected, used, or protected. The lack of any cookie consent mechanism, while not immediately actionable without detected trackers, suggests no privacy framework exists. Without foundational legal documentation, the site cannot demonstrate lawful processing of personal data and exposes the operator to regulatory enforcement, user complaints, and reputational harm.