Scan rule · RSC-PRV-017
Service not named in the privacy policy
Cross-checks the services your app actually contacts in the browser against the text of your privacy policy.
Why this matters
Art. 13(1)(e) GDPR requires you to name the recipients of your data. A service the user's browser contacts directly necessarily receives their IP address — it is a recipient, even if you only embed it for a font or an error log.
In AI-built apps this gap appears almost systematically: the generator embeds fonts, analytics and AI endpoints, while the privacy policy comes from a template that does not know about them. Each is plausible on its own — together they produce a policy that does not describe what the app does.
We only check services we can name, and only where no spelling of them appears in the text — “Google Fonts” counts as named even if only “Google” is there. This is a hint, not a determination: a policy may also describe recipients as a category. To be sure, walk the list once by hand.
Scan tier
How to fix it
Name every contacted service in the privacy policy — with purpose, legal basis and, for third countries, the basis for the transfer.