Terms of Service - Crocky Audit

Version 2.2, in force from 15 October 2026

The Romanian version of these terms prevails. This English text is provided for information.

In short

• Crocky Audit checks a public website and gives you a report. It is free without an account. Accounts, an API, an MCP server and paid plans add limits and features.
• Use it for websites you own or manage, or that you have a legitimate reason to check. Never use it to attack, overload or get around access controls.
• Each request the scanner makes is an ordinary one, of the kind a browser makes, but an audit makes many of them in a short time: it loads the page about seven times in a real browser and sends around a hundred smaller requests, among them probes for well-known exposed files. It is more than one visit. Section 7.2 says exactly what it does and how much that is. A site owner can stop audits with one entry in robots.txt.
• Whoever holds a report link can open the report. Treat the link as you would a public one.
• The AI check is an automated estimate, not a statement of fact about a site or its authors. Do not present it as fact.
• If you own a website that was audited and you want the reports deleted, write to audit@crocky.host (section 8.5).
• Paid plans are ordered from https://audit.crocky.host/pricing and paid by card through NETOPIA Payments; CROCKY S.R.L. issues the invoice. They never renew by themselves.
• The law of Romania applies. Consumers keep every right the law gives them (section 18).

1. Who provides the service

Our role. CROCKY S.R.L. sells the Crocky Audit plans in its own name, as provider and merchant. We are not a marketplace, an intermediary or an agent for anyone else. CROCKY S.R.L. also issues the invoice, through its billing system at https://crocky.host.

This information is given under Article 5 of Law 365/2002 on electronic commerce.

2. What these terms cover

2.1. These terms govern your use of Crocky Audit: the website https://audit.crocky.host, the report links, the PDF and HTML exports, accounts, the API (/api/v1), the MCP server (/api/mcp), monitors and webhooks. Together they are "the Service".

2.2. They form a contract between you and CROCKY S.R.L. You accept them by using the Service. A line under the audit form says so, with links to these terms and to the Privacy Policy. To sign in to an account you tick a box saying that you accept these terms, including the clauses listed in 2.7, and that you have read the Privacy Policy; we record the version you accepted and when.

2.3. The Terms and Conditions (https://crocky.host/legal/terms-and-conditions), Acceptable Use Policy (https://crocky.host/legal/acceptable-use-policy) and Domain Registration Agreement (https://crocky.host/legal/domain-registration-agreement) apply to our hosting and domain products. They do not apply to Crocky Audit unless you also buy those products. In particular, the ban on port and vulnerability scanning in that Acceptable Use Policy is meant for hosting customers and does not apply to the checks Crocky Audit runs itself, which are described in section 7.2.

2.4. How we handle personal data is in the Privacy Policy (https://audit.crocky.host/privacy).

2.5. Who may use it. The free tool is open to anyone. An account requires you to be at least 16. If you use the Service for a company, you confirm that you can bind it. The paid plans are sold to individuals and to businesses (section 6).

2.6. How the contract is made (Law 365/2002, art. 8).

• One audit: you type the address, choose the options and press the audit button. Until you press it you can change or clear every field. After that you can cancel the audit from its report page until it finishes.
• An account: you enter your email address, tick the box described in 2.2 and open the sign-in link we send. Nothing is created until you open it, and you can ask for a new link at a corrected address.
• A paid plan: you pick the plan and the period on https://audit.crocky.host/pricing, sign in with the account linked to CrockyHost, say whether you buy as a business or as a consumer, check the details on the invoice, tick the box accepting these terms and press the “Order with obligation to pay” button. Until you press it you can change any choice or give up. The contract is made when you receive the order confirmation by email, which we send at once (Law 365/2002, art. 9; section 6.2).
• We do not keep a separate copy of the contract for each user. The version in force is always at https://audit.crocky.host/terms (Romanian: https://audit.crocky.host/termeni), and you can save or print it from your browser. Earlier versions are available on request.
• The contract can be made in Romanian or English. The Romanian text prevails (19.5).

2.7. Clauses to note. Some clauses limit our liability or let us suspend or end the Service, and some set the applicable law and the courts: 4.3, 5.8, 8.7, 12.1, 12.2, 13.2, 13.3, 14.2, 14.3, 18.1 and 18.3. We list them here so that you read them before you accept these terms (Article 1203 of the Civil Code).

3. What the Service does

3.1. You give us the address (URL) of a public web page. Our scanner fetches it, renders it in a browser, and checks performance, SEO, security headers and exposed files, hosting and DNS, TLS, email DNS, accessibility, carbon estimate, technology, and links. It produces a report with scores, findings, evidence and recommendations.

3.2. The AI check runs by default; untick its box on the form if you do not want it. It estimates whether the site looks built by a website builder or a coding agent (section 9).

3.3. A deeper mode reads up to 25 internal pages. On paid plans the AI check can also cover 5, 10 or 20 crawled pages.

3.4. The Service does not fix anything, host your site, give legal, security or other professional advice, or guarantee that a site is secure, compliant or fast.

4. Using it without an account

4.1. You can run audits from the web form without an account. We limit this to 10 audits per IP address per hour.

4.2. If you asked for the same URL in the last 10 minutes (with the same account, or, without an account, from the same IP address), you receive your existing report instead of a new audit (section 8.2).

4.3. We may refuse, delay or stop a request, for example when the queue is full, when the target is unreachable or when we suspect abuse. We may switch the Service into maintenance mode.

4.4. Audits run in the order they arrive, paid plans first. While an audit waits, its page shows roughly how long it will take and, when the wait is long, offers to send you the link by email. When 20 or more audits are waiting, a free audit runs in fast mode: it measures performance on a phone only and takes two screenshots instead of four; everything else runs as usual, and the report says that it ran in fast mode. Audits on a paid plan always run in full.

5. Accounts, API keys, MCP, monitors and webhooks

5.1. Sign-in. You sign in by email: we send a link that works once for 20 minutes. There is no password. You are responsible for your mailbox. The first successful sign-in creates the account. You can also sign in with your CrockyHost account (crocky.host, also CROCKY S.R.L.'s): the first time, we email a link to the address of the CrockyHost account so that you confirm the address. An account that already exists is linked to a CrockyHost account only after you confirm it on the account page, and you can unlink it at any time.

5.2. API keys. A key (ca_live_…) is shown once. Keep it secret, use it only from servers and tools you control, and revoke it on the account page if it leaks. Keys belong to your account and may not be shared outside your organisation. Anything done with your key counts as done by you.

5.3. Limits. Limits in force today (they may change under section 16):

Every key is also limited to 60 requests per minute. Months are calendar months in UTC. The web form without an account has no monthly quota but has the hourly limit in 4.1.

5.4. MCP server. The MCP tools (check_site, get_result) use your key and count against the same quota. You are responsible for what the AI assistant you connect does with our answers, including keeping the legal line in section 9.3 attached to any verdict it shows to people.

5.5. Verdict reuse. If you ask for the verdict on a public site that someone else checked recently, we may answer with that recent verdict instead of starting a new scan. Through MCP you also receive its evidence and scores. You do not receive the other person's report link or scan number.

5.6. Monitors (paid plans) re-audit a page on a schedule you choose (every 1 to 30 days) and email you when the overall score moves by 10 or more or the AI verdict changes. Each run counts as one scan.

5.7. Webhooks. If you give an https webhook_url, we send the result once when the scan finishes, signed with X-Crocky-Signature. We wait 3 seconds and do not retry. You must verify the signature and secure your endpoint.

5.8. Fair use. Do not get around limits (for example with many accounts, keys or addresses). Do not automate the web form; use the API. We may slow down or block traffic that harms the Service.

5.9. Deleting your account. You can delete the account on the account page. The Privacy Policy says what is deleted.

6. Paid plans, prices and billing

6.1 Who can buy

The paid plans (Solo, Team, Partner) are sold to businesses, freelancers and individuals. If you are under 18, you need the consent of a parent or guardian to buy a plan. Some rules differ depending on whether you buy for your trade, business or profession or as a consumer; sections 6.7, 6.8, 13 and 18 say where.

6.2 How to buy and pay

A paid plan is bought from an account linked to a CrockyHost account, because that is where the billing details are kept (5.1). Free use needs no CrockyHost account. You order from your account, starting at https://audit.crocky.host/pricing (2.6). Before you press the “Order with obligation to pay” button, the page shows what the plan includes, the details on the invoice, the price before VAT, the VAT, the total and the currency, the period, how you pay and, for a consumer, the right of withdrawal (Government Emergency Ordinance 34/2014, art. 6(1)).

When you press it, the order is placed: we issue the invoice in the billing system at crocky.host and you pay its total by card on the NETOPIA Payments page (NETOPIA Financial Services S.A.), where you type the card details and do the 3-D Secure check. Card details never pass through our servers. You pay in your CrockyHost account’s currency, lei or euro. The paid invoice is emailed to you and is in your CrockyHost account. The order confirmation, with its number (in the form CA-2026-0001) and the withdrawal form, comes by email.

If the card payment cannot start because of us or NETOPIA, the page offers to try again or to pay the same invoice on crocky.host.

6.3 Delivery: duration and start

A plan is a digital service, delivered in your account: we switch it on the moment NETOPIA confirms the payment, usually within seconds, and it lasts a month or a year, the period you picked. If you buy as a consumer and did not ask for an immediate start when ordering, the plan starts once the 14 days of withdrawal are over (6.7). A plan does not renew by itself. When the paid period ends, the account returns to the Free limits, unless you have ordered a new period in the meantime. Your keys and reports stay, but monitors stop running because the Free plan has none. If a plan is already running:

• an order for the same plan extends it: the new period starts when the current one ends;
• a bigger plan starts when its payment arrives and replaces the current one; the value of the days left on the old plan, before VAT, comes off the price of the new one, on its invoice (a day begun counts as left);
• a smaller plan starts when the current one ends.

6.4 Changes

A change of price or of plan limits does not affect a period you have already paid for. A new order is made at the prices and limits shown on the pricing page when you order.

6.5 If we end a plan

If we end a paid plan without any fault on your part, we refund the unused part of the paid period in proportion.

6.6 Prices and taxes

The prices on https://audit.crocky.host/pricing are before VAT. VAT is computed by our billing system from the country in your CrockyHost account: 21% in Romania; for a consumer in another EU state, that state’s rate; a business in another EU state with a valid VAT number pays no VAT (reverse charge); no VAT for a buyer outside the EU. The checkout page and the confirmation show the VAT and the total exactly as they appear on the invoice. You pay in your CrockyHost account’s currency (lei or euro). You pay any other taxes that apply to you.

6.7 Right of withdrawal (consumers)

If you buy as a consumer, you may withdraw from the contract for a plan within 14 days of its conclusion, without giving a reason (Government Emergency Ordinance 34/2014, art. 9). Tell us on https://audit.crocky.host/withdraw (“Withdraw from contract here”, then “Confirm withdrawal”), from your account, or at audit@crocky.host with a clear statement or the form at the end of these terms (art. 11 and 11¹). We confirm by email at once that your withdrawal has reached us, with the date and time. If you have not paid yet, the order is cancelled, with its invoice. Otherwise we refund what you paid within 14 days of hearing from you, to the card you paid with, at no cost to you (art. 13). The plan starts during the withdrawal period only if you expressly choose that when ordering and confirm that you know you lose the right of withdrawal once the contract has been fully performed (art. 8(8)). If you then withdraw, you pay an amount in proportion to the days of the plan you have had (art. 14(5)).

6.8 Conformity (consumers)

For a consumer, a paid plan carries the legal guarantee of conformity for digital services (Government Emergency Ordinance 141/2021): if the Service does not work as these terms and the pricing page describe it, you may ask us to bring it into conformity and, if we do not, ask for a price reduction or end the contract.

6.9 Cancelling an order

While you have not paid, you can cancel the order from your account at no cost: we cancel its invoice too. An order left unpaid for 48 hours is cancelled by itself, with its invoice, and we tell you by email. Once paid, an order is no longer cancelled: as a consumer you have the right of withdrawal (6.7), and if we end a plan, 6.5 applies. If a payment still arrives after a cancellation, the money is yours: we start the plan as if the order had not been cancelled.

7. Acceptable use

7.1 Which sites you may audit

7.1.1. Use the Service only for websites that you own or manage, or that you have a legitimate reason to check, for example the public website of a prospective client. By submitting a URL you confirm that this is the case.

7.1.2. Never use the Service to attack, overload or disrupt a system, to bypass access controls, or to break into anything.

7.1.3. Do not submit addresses of private, internal or non-public systems. Our scanner refuses private, loopback and link-local addresses anyway.

7.1.4. Do not put secrets in the URL. The whole URL, including any query string, is stored and shown in the report, the PDF, the share image and the API.

7.2 What the scanner does to the audited site

So that you and the site owner know:

• It sends requests from our server with the user agent CrockyAudit/<version> (+https://audit.crocky.host/bot). The headless browser sends Mozilla/5.0 (CrockyAudit/0.5; +https://audit.crocky.host/bot) AppleWebKit/537.36, and the requests made in a browser's form (Lighthouse, the AI check) end with CrockyAudit/<version> (+https://audit.crocky.host/bot). That page explains the scanner to site owners.
• It first requests the page and the site's robots.txt. If robots.txt contains a group User-agent: CrockyAudit with Disallow: /, the scanner stops there: it runs none of the probes, browser tests or mail checks described below, and it does not retry. A general User-agent: * rule does not stop it, because an audit is one visit that a person asked for, not crawling.
• It loads the page in a browser (so the page's own scripts and third-party resources run), at four screen widths, and runs Lighthouse (mobile and desktop) and an accessibility test.
• It requests sitemaps and common files such as /.well-known/security.txt.
• It probes about 85 well-known paths with HEAD requests, at most 10 at a time. They are paths that should not be public, such as .env, .git/, database dumps, backup files, phpinfo.php, phpmyadmin/, server-status, API-doc pages, and the working files of a coding assistant (CLAUDE.md, .claude/, .mcp.json, session transcripts). When a path answers positively, it reads up to the first 64 KB to confirm it is a real file and not a "catch-all" page. It does not keep the contents.
• It makes one exception: if phpinfo.php or another of its usual names answers with a real phpinfo() page, it reads the page in full and keeps what that page publishes, because that is the finding. It never keeps the values of environment variables, only their names. The privacy policy, sections 3.3 and 6, says what is kept and who sees it.
• For WordPress sites it checks the REST API user list and ?author= redirects. This can reveal author user names; they appear in the report, masked (for example "d*") for everyone except the account that ran the audit.
• It connects to the site's mail servers on port 25, reads the greeting, says EHLO, checks whether STARTTLS is offered and quits. It sends no mail.
• It asks DNS and public registry services about the domain (for example DNS-over-HTTPS, RDAP, DNS blocklists).
• In the AI check it also asks for a few files that coding tools leave behind (CLAUDE.md, .cursorrules, AGENTS.md and backups of CSS/JS files).
• In deeper mode it follows internal links and honours the Disallow rules of robots.txt for that crawl.
• How much traffic an audit is. Each request on its own is ordinary, but there are many and they come close together. The page is loaded about seven times in a real browser (four screen widths, Lighthouse on mobile and on desktop, the accessibility test), and each load pulls everything the page itself asks the server for. On top of those come around a hundred smaller requests of ours, mostly HEAD. All of it happens within a few minutes. It is not a load test, we do not repeat requests in a loop and we are not measuring what your server can take, but it is more than a visitor makes, and a site or a CDN with a rate limit may answer 429 Too Many Requests. When that happens we wait and try once more; whatever still gets no answer appears in the report as not checked, not as checked and fine.
• Bot checks. If a site's protection asks a browser to wait while it checks it, our browser waits, as any browser does, for at most 15 seconds, with the same user agent that names us. If it is let through, the audit carries on with the cookie it was given, sent only to that site and kept only for that audit; getting through costs at most four more loads of the page. We never solve anything meant for a person, such as a CAPTCHA, a checkbox or a press-and-hold, we do not click and we do not hide that the browser is automated: if the protection asks for that, the audit stops. Before carrying on we read robots.txt again with the same cookie, so a rule asking us not to audit the site is not missed just because the protection hid it.
• It uses the credentials you give only to open the site for that audit (7.4).

7.3 What you must not do

• Use the Service to find and exploit weaknesses in systems you are not authorised to test.
• Submit credentials you are not authorised to use.
• Go around rate limits, quotas, the app-token check or the same-origin rules.
• Use the web form through scripts. Use the API.
• Resell or offer the Service or its API results as your own product, or remove the Crocky Audit branding or the legal line from reports. You may use reports in your own consulting work, for example to show a client.
• Use contact details found in reports (email addresses, phone numbers) to send unsolicited commercial messages. Law 506/2004 and the GDPR restrict that.
• Use the Service to harass a person or to publish personal data.
• Break the law, or ask us to.

7.4 Passwords for protected sites

You may enter a username and password so our scanner can open a protected site (HTTP authentication, a Shopify password page, a staging site, and similar). Only enter credentials you are allowed to use. Use a temporary or read-only password. We store it encrypted until our scanner takes the job, and delete it when the audit starts, ends or is cancelled. We do not log it. Everything the scanner sees behind the login can appear in the report (text, screenshots, findings), and anyone with the report link can read it. Do not use this feature on a site whose content must stay private.

7.5 Reports about other people's sites

If a report shows a weakness (for example an exposed file) in a site you do not run, tell the owner and give them time to fix it before you publish the report. You are responsible for what you publish.

8. Reports and sharing

8.1. The link is the key. A report is at /report/<32 characters>. Whoever holds the link can open the report, its PDF, its HTML copy and its data. We never publish links, robots.txt tells search engines to stay away from /report/, and every report page says "noindex". But we cannot control where you send the link. Treat it like a public link. Do not post a report that contains data you would not publish. A link-preview card made for a shared link shows the website name and the scores, never the AI verdict.

8.2. Reuse. A repeat request for the same URL within 10 minutes returns your existing report only to the same account, or, without an account, to the same IP address. Anyone else gets a new scan with a new link. Section 5.5 describes verdict reuse in the API and MCP, which never includes another person's link.

8.3. Sharing and branding. You may share a report, forward its link or its PDF, and show it to clients. Keep it unchanged, with the Crocky Audit branding and the legal line.

8.4. Personal data inside reports. Reports can contain what the audited site publishes: contact emails and phone numbers, addresses, author names, screenshots. WordPress user names and cookie values are masked for everyone except the account that ran the audit, and always in the PDF and the HTML copy. If you receive such data through a report, use it only to understand and discuss the audit. See the Privacy Policy, section 6.

8.5. Website owners: removal and opt-out. If you own or run a website that was audited:

• Opt out in robots.txt. Add User-agent: CrockyAudit and Disallow: /. The scanner stops before any probe (section 7.2).
• Have the reports deleted. Write to audit@crocky.host with the domain or the report link. Prove you control the site: write from an email address at that domain, or add a DNS TXT record that we tell you. Within 7 days we delete every report of your domain (records, PDF, share image and cached images). If you ask, we also add your domain to a list of sites that we refuse to audit.
• We may keep a minimal record of the request and of the domain so that we can honour it.

8.6. Illegal content and notices. Anyone can tell us about content in a report that they believe is illegal, at abuse@crocky.host. This is also our single point of contact for authorities and users under Articles 11 and 12 of the Digital Services Act, in Romanian or English. Give: why you think it is illegal; where it is (the report link); your name and email address; and a statement that you act in good faith. We confirm receipt. A person reviews every notice; we do not decide notices automatically. We tell you and the person concerned what we decided and why, and how the decision can be challenged, including in court.

8.7. Retention and removal. A report stays at its link, so that you can come back to it and we can improve our checks. Its PDF, share image and HTML copy are kept for 30 days and made again when someone asks for them; its screenshots are kept for 30 days; after 12 months we remove from it the personal data found on the audited site. The Privacy Policy gives the details. We may remove reports earlier that break these terms or the law, or on a valid request, without notice if the law requires or the risk is serious.

9. The AI check

9.1. It is an estimate. The AI check is an automated assessment from public signals on a page: build fingerprints, stock-component patterns and design measurements. It places the site in one of five bands: Confirmed, Likely, Possibly, No evidence found, Not measured. It is not a statement of fact about a site or about the people who made it. No person reviews a verdict before it is shown.

9.2. It can be wrong. We publish measured error rates at https://audit.crocky.host/ai and https://audit.crocky.host/methodology. A "No evidence found" verdict is not proof that a site was made by a person; the check never says a site is "human-made". "Possibly" and "Not measured" mean the check could not decide. The rates were measured on sites whose origin we know; on other sites they can be higher or lower.

9.3. The legal line. In the report, every verdict carries the line "Automated estimate from public signals, not a statement of fact about this site or its authors." In the API, the MCP answers and webhooks it is sent in English: "Automated estimate from public signals, not a statement of fact about a site or its authors." Keep this line with any verdict you pass on.

9.4. How you may use it. You may use a verdict to guide your own review of a site. You may not present it as established fact; use it as the sole basis for a decision about a person (hiring, firing, contract, grade, accusation); or say that a named person or company "used AI" because of it. If you quote a verdict about a third party, you are responsible for how you present it.

9.5. Disputes. If you own a site and disagree with a verdict, write to audit@crocky.host. A person reviews the dispute within 7 days. We may correct, annotate or remove the report, and we log every correction.

9.6. Feedback and our own use. The "Looks right" and "Wrong" buttons send us the report, the band, your answer and a code derived from your IP address, to improve the check. Verdicts and feedback feed only our internal evaluation; we publish no results about individual sites. See the Privacy Policy.

10. Accuracy of audits; no advice

10.1. Scores and findings are measurements and heuristics taken at one moment, from one location, with the settings we use. They can be incomplete, outdated or wrong. A finding can be a false positive, for example when a host answers every path with a page. A site that scores well is not thereby secure or compliant.

10.2. Reports are information, not legal, security, accessibility or SEO advice. You decide what to do with them.

10.3. We may change how scores and findings are calculated at any time. The method is described at https://audit.crocky.host/methodology.

11. Rights in the Service and in your content

11.1. The Service, its code, text, design, trademarks (including "Crocky Audit" and "crocky.host") and the method belong to CROCKY S.R.L. or its licensors. You get a limited, non-exclusive, non-transferable right to use the Service as these terms allow.

11.2. You keep your rights in what you submit (URLs, labels, account data). You give us permission to use it to run the Service, make reports and, in anonymised or aggregate form, to measure and improve the Service and the AI check.

11.3. Reports contain facts, short excerpts and screenshots taken from the audited sites. Rights in that material stay with its owners. We use it only as evidence for the audit, inside the report and its exports, and we remove it when the site's owner asks (8.5). You may use it only to understand and discuss the audit.

11.4. The Service uses open-source and third-party components under their own licences, such as Lighthouse, axe-core, Playwright and dompdf, and the Geist and JetBrains Mono fonts (SIL Open Font License). IP geolocation uses DB-IP Lite data, with the attribution "IP geolocation by DB-IP.com (CC BY 4.0)" shown in the footer of the site.

12. Availability and changes to the Service

12.1. The Service is provided without a service-level agreement. It may be slow, unavailable, interrupted for maintenance, or change. Some checks may be skipped when a site blocks us or a runner fails. The report says so when it happens.

12.2. We may add, change or remove features. For a paid plan, we will tell you in advance if a change removes something material, and you may end the plan and receive a proportional refund of the unused period.

13. Warranties and liability

13.1. What cannot be limited. Nothing in these terms excludes or limits our liability for intent or gross negligence, for harm to life, bodily integrity or health, or for anything else that Romanian law does not allow to be excluded or limited (including Article 1355 of the Civil Code). For consumers, nothing limits the rights they have under mandatory law, including Law 193/2000 on unfair terms, GEO 34/2014 and GEO 141/2021 on digital content and digital services.

13.2. Free service. Within what Romanian law allows, the free Service is provided "as is" and "as available", without warranties about accuracy, completeness or fitness for a purpose, and we are not liable for loss arising from your use of it. This never excludes liability for intent or gross negligence.

13.3. Paid plans. We provide paid plans with professional care. To the extent allowed by law we are not liable to a business customer for indirect losses, loss of profit or goodwill, for decisions made on the basis of a report or verdict, for third-party services we depend on, for harm caused by your use against these terms, or for events outside our control. Our total liability to a business customer for all claims relating to a plan is limited to the fees you paid for that plan in the 12 months before the claim. The limits in this section do not apply to what section 13.1 says cannot be limited.

13.4. Your responsibility. You are responsible for submitting only URLs you may submit, for credentials you provide, for the confidentiality of your keys and links, and for what you publish. As a business customer you will cover losses we suffer from third-party claims caused by your breach of sections 7 or 9.4. If you are a consumer, this applies only to harm you cause with fault.

13.5. Reports about third parties. We run audits on your request. We do not check that the requester is entitled to audit a site. Section 8.5 describes how owners stop and remove audits.

14. Suspension and ending

14.1. You may stop using the Service at any time and delete your account.

14.2. We may suspend or end your access, or remove reports, if you break these terms or the law, if you abuse the limits, if an invoice for a paid plan stays unpaid after its due date, or if we must by law. Where possible we tell you why and give you a chance to fix the problem first. For serious abuse we may act at once.

14.3. We may end the free service, or a plan, for good reason with 30 days' notice. If we end a paid plan without fault on your part, we refund the unused part of the period you paid for (section 6.5).

14.4. When access ends, sections that by their nature should survive do (for example 8, 9, 11, 13, 18).

15. Personal data

The Privacy Policy explains what we process and your rights. For reports about websites, we are the controller of the report. If you use the API to send us data about other people's websites, you are responsible for having a lawful reason to do so.

16. Changes to these terms

We may change these terms for a valid reason: a change in the law or in how an authority or court applies it, a change in how the Service works or in what it offers, security or abuse prevention, or to make the text clearer. The version in force is at https://audit.crocky.host/terms, with the date it applies from. If you bought a plan as a consumer and a change is to your disadvantage, we tell you in advance by email and you may end the plan before it applies (Government Emergency Ordinance 141/2021, art. 19). If you do not accept a change, you may stop using the Service. Using the Service after the date it applies from means you accept the new version.

17. Contact and notices

• General requests, removal requests, privacy requests and complaints: audit@crocky.host (privacy requests also: gdpr@crocky.host). We acknowledge a message within 2 business days and answer within 30 days. Removal requests for audited websites are answered within 7 days.
• Notices about illegal content, and the single point of contact for authorities and users under the Digital Services Act: abuse@crocky.host.
• Contractual notices to you go to the email address of your account. Notices to us go to audit@crocky.host, or to our registered office for formal notices.

18. Governing law, courts and consumer disputes

18.1. These terms are governed by Romanian law. If you are a consumer in another EU country, the mandatory consumer rules of your country continue to apply (Regulation (EC) 593/2008, art. 6).

18.2. We try to settle disputes amicably first. Write to audit@crocky.host.

18.3. Business customers: disputes not settled are for the courts at our registered office (Judecătoria Băilești or, as the case may be, Tribunalul Dolj), the same as in the crocky.host Terms and Conditions.

18.4. Consumers: the competent courts are determined by the Romanian Code of Civil Procedure. You may also bring a claim before the court of your domicile (art. 113 alin. (1) pct. 8 Code of Civil Procedure; Regulation (EU) 1215/2012).

18.5. Consumer complaints and alternative dispute resolution.

• National Authority for Consumer Protection (ANPC): https://anpc.ro ; complaints: https://reclamatii.anpc.ro
• Alternative dispute resolution (SAL), Government Ordinance 38/2015: https://reclamatiisal.anpc.ro ; dsal@anpc.ro
• The EU online dispute resolution (ODR) platform no longer exists. Regulation (EU) 2024/3228 repealed Regulation (EU) 524/2013 with effect from 20 July 2025. For cross-border disputes you can use the European Consumer Centres Network (ECC-Net) and the ADR bodies of your country.
• Using these routes does not stop you going to court.

19. General

19.1. If a clause is invalid, the others stay valid, and the invalid one is replaced by the nearest valid clause with the same purpose.

19.2. These terms, the Privacy Policy and, for a paid plan, the order confirmation are the whole agreement for the Service.

19.3. We may assign our rights and duties to a company that takes over the Service. You may not assign yours without our consent.

19.4. If we do not enforce a right right away, we do not give it up.

19.5. The language of this contract is Romanian. The Romanian version prevails and this English text is provided for information.

Withdrawal form

Fill in and send this form only if you want to withdraw from a contract for a paid plan (section 6.7). The Romanian model in the annex to Government Emergency Ordinance 34/2014, part B, prevails.

• To: CROCKY S.R.L., Str. Drăgaica nr. 5, sat Balasan, mun. Băilești, jud. Dolj, 205101, Romania, audit@crocky.host
• I hereby give notice that I withdraw from my contract for the provision of the following service:
• Ordered on:
• Name of consumer:
• Address of consumer:
• Signature of consumer (only if this form is sent on paper):
• Date:

Version 2.2, 15 October 2026

Questions about this document: audit@crocky.host