Privacy policy

1. Controller and scope

Andre Melsbach
Hasenhof 7A
24963 Tarp
Deutschland
info@admin-tools.de

admin-tools provides free and, where applicable, paid functions for Windows and Linux system diagnostics. This policy describes processing by the website, user account, diagnostic and demo functions. The data processed depends on the function used, the selected operating system and the checks selected.

2. Website access, sessions and cookies

When accessed, the application starts a PHP session for CSRF protection, login state and language. The session cookie has HttpOnly and SameSite=Lax attributes; Secure is set when HTTPS is used. The technically necessary “syscheck_language” cookie may store the selected language. The application code does not set analytics, advertising or tracking cookies.

3. Visit log and technical logs

For a new session accessing an existing page, the application stores a visit entry in the site_visits table of the configured MariaDB/MySQL database. The static example result, the account deletion confirmation page and configured excluded IP addresses are exempt. It contains the IP address, a local-address flag, requested path including any URL parameters, referrer, user agent or browser data, time and, when logged in, the account ID. IP addresses already recorded for the calendar day are not recorded again. This data supports technical monitoring, security, troubleshooting and page statistics; the legal basis is Article 6(1)(f) GDPR.

When non-production timing diagnostics are enabled, timing values may also be written to the PHP/server error log. Errors when deleting diagnoses are also sent to PHP error logging. CLI scripts write processing and error messages to standard output or standard error; server-side redirection may create additional log files.

The site_visits visit log has a maximum retention period of 90 days. On each run, the existing daily cleanup cron deletes records whose creation time is more than 90 days in the past. Technical removal takes place during the next daily run after this period has been exceeded; deletion errors are logged and affected entries are considered again on the following run. The storage destination and retention of PHP/server error logs and any redirected CLI output depend on the hosting server configuration and operation. The application sets no fixed period for these logs; a specific period cannot be verified from the application code.

4. Registration and login

During registration, the username, email address, password hash, confirmation-token hash, token expiry time, registration time and email-confirmation time are stored. The password is not stored in plain text. The email address is used for activation and account-related messages. Activation links are valid for 24 hours. The legal basis is Article 6(1)(b) GDPR.

During login, the submitted credentials are processed for verification. After successful login, the account ID and language setting are used in the session; the session ID is renewed at login.

5. Use of the user account

The account is associated with selected diagnostic checks, user-entered diagnostic targets, upload mode, retention period, assignment records for generated batch files, uploads and results. Ownership checks restrict access to results assigned to the account.

Registered users can request deletion of their account in their profile. A confirmation link valid for 24 hours is sent to the registered email address. Deletion is triggered only by explicit final confirmation on the linked page; simply opening the link is not sufficient. This confirmation is intended in particular to prevent accidental or unauthorised deletion. A newly requested link replaces the previous one; expired or already used links cannot be used for deletion.

Successful account deletion removes the user account, its saved settings and diagnostic configurations, and all diagnostic data assigned to the account from the application’s production database and associated file storage. This includes batch records even without a prior upload, stored diagnostic files, raw logs and structured result data. Visit records directly assigned to the account are also removed. Deletion cannot be undone within the application. If deletion fails, successful completion is not confirmed; another attempt may be necessary.

This process does not delete batch or diagnostic files already downloaded to users’ devices, previously sent emails, technical server or mail logs, or existing hosting backups. The application cannot directly control deletion of individual copies from existing Hostinger backups. Visit records not assigned to the account and technical session and abuse-prevention data are not completely removed by account deletion. Statutory retention obligations remain unaffected where they apply in an individual case. Privacy requests may still be sent to info@admin-tools.de.

6. Running a Windows diagnosis

The batch file runs the selected diagnostic checks and targets within the intended technical process. It also contains technical process elements such as variables, token handling, a temporary log file, status and error handling and, when enabled, a PowerShell call. Depending on the selection, it may collect the computer name, Windows username, domain, operating-system and hardware data, processes and process users, window titles, drivers, mapped drives, network adapters, IP and MAC addresses, DHCP, DNS and routing data, active connections, target and remote addresses, DNS cache, ARP table, proxy information, ping and traceroute results, SSIDs, BSSIDs, visible Wi-Fi networks, Wi-Fi profile names, and technical errors and raw log data. User-entered targets may contain internal hostnames and IP addresses.

The diagnosis runs on the end user’s selected Windows or Linux system. admin-tools.de receives diagnostic data only through the automatic HTTPS upload or manual upload.

7. Transfer, storage and evaluation

Automatic uploads are sent via HTTPS to upload-diagnostic.php; manual uploads use the upload form. The batch token is checked for assignment against a SHA-256 hash stored on the server. The generated batch file and submitted raw log also contain the upload token in plain text. Registered batch files are reusable; the demo upload token is single-use and valid for 24 hours from creation. Raw logs are stored in diagnostic_results and may be accepted up to 16 MB. Structured values are stored in related result tables. The file is stored under a server-side path outside the public web root.

For uploads, the IP address and user agent may be passed to the server-side upload notification. For non-local uploads, this notification is sent to the configured recipient address.

8. Demo diagnosis

The public example result displays static, fictitious sample data. The demo also offers a batch file that collects actual diagnostic data from the examined Windows system and uploads it automatically. These uploads are not assigned to a registered account. Anyone with the valid access link can view the result and download the log without signing in; the link expires 24 hours after the batch file is created. Uploadeded demo diagnostic data has a retention period of 7 days from upload. After expiry, it is deleted by the next cleanup run; execution depends on server operations. The static sample data is not subject to this upload deletion period.

9. Retention and deletion of diagnostic data

For registered users, the default retention period is 90 days. Profilee settings allow 1 to a maximum of 300 days; the setting may apply retroactively. Due diagnostic batches, associated database records and stored files are deleted by the cleanup script; its regular execution depends on server operations. Individual results can be deleted through the available function. During manual deletion and cleanup, the database record is removed only after the associated file has been deleted or confirmed absent; related result data is removed through the intended database cascades. If an error occurs, the record remains available for follow-up. File and database deletion are not atomic: if database deletion fails after file deletion, database data may remain until a successful retry.

The stated diagnostic retention periods apply to uploaded diagnostic batches, including their upload metadata, stored files and associated result data. Diagnostic cleanup does not cover generated batches without an upload, user accounts including unconfirmed registrations or saved account settings. It also does not delete previously sent upload notifications, external server logs or hosting backups. Diagnostic cleanup sets no retention periods for these data. This is distinct from user-confirmed account deletion under section 5, which also includes batch records without uploads and saved account settings assigned to the account.

10. Emails and external services

When account deletion is requested, the registered email address is used to send deletion information and the time-limited confirmation link. To validate the confirmation process, the application stores a verification value for the link and its expiry time with the account. The deletion confirmation email contains no diagnostic content. This processing serves the secure termination of the account; the legal basis is Article 6(1)(b) GDPR.

The application sends activation emails during registration and, where applicable, again when an unconfirmed user logs in. It may also send a diagnostic-upload notification to the configured recipient. The application uses the PHP mail function available on the server.

No automatic external analytics, advertising or tracking services are integrated. The optional Perplexity analysis is used only for the selected diagnosis after explicit user action. Operational information about Hostinger, server locations and backups is described in the data processing agreement. The application itself does not control or technically verify this hosting information or the backup retention stated there.

If the user explicitly starts the optional AI analysis for a completed diagnosis, summarised structured diagnostic values are sent to the external Perplexity service. Raw logs, uploaded files and credentials are not sent.

The analysis generated by Perplexity is stored as an additional technical note for the selected result and does not replace an independent technical review. Data is sent only after the user explicitly clicks the AI analysis button.

11. Roles in the B2B case

Where a business customer has diagnostic data of employees, customers or other end users processed, the customer determines the purpose, checks, targets and authorisation for the examination and informs data subjects. The end user runs the batch file on the examined system. admin-tools.de provides the technical application and processes submitted diagnostic data under the specific agreement and instructions. Whether a processor relationship exists depends on the individual case.

12. Rights, complaints and updates

Subject to statutory requirements, data subjects have rights including access, rectification, erasure, restriction, data portability and objection. In the B2B case, the customer is generally the first contact. Requests may be sent to info@admin-tools.de; there is also a right to lodge a complaint with a supervisory authority. This policy will be updated when functions, processing or legal requirements change.