I started building a GDPR scanner. It slowly turned into a compliance platform.
A few months ago, I started building a simple GDPR scanner.
The idea was straightforward: enter a website URL, scan it, and get a simple report showing potential GDPR and privacy risks.
I wanted something much simpler than the typical compliance tools.
No huge dashboards. No complicated setup.
Just:
“Here’s what we found. Here’s why it might be a problem. Here’s what you can do about it.”
I launched GetGDPRScan and started getting people to try it.
Then the product started evolving.
As I worked on the scanner, I kept finding things that didn't really fit into a narrow “GDPR scanner” box.
So I added cookie and tracking detection, consent banner analysis, privacy policy checks, and eventually started expanding into other areas.
Today, the platform also covers AI Act, accessibility and website security checks.
At some point I realized I wasn't really building a GDPR scanner anymore.
I was building a website compliance platform.
And interestingly, this wasn't really planned.
It happened by following the problems I was seeing and the feedback I was getting.
There have been some humbling lessons along the way too.
One post in a Slovenian developer community resulted in around 150 scans.
Paid conversions?
Zero.
Google Ads have brought traffic and people actually using the scanner, but I'm still figuring out how to turn that into a sustainable acquisition channel.
I've also changed some of the checks after people challenged whether certain things should be flagged as actual “issues” or just potential risks.
That was an important lesson.
Compliance isn't always black and white, and I don't want the product pretending that it is.
So for now, I'm experimenting with a broader idea:
A simple compliance checkup for your website.
I'm still very early, still figuring out the business model, and definitely haven't “figured it out”.
But that's probably the most interesting part of building this.
The product I have today is quite different from what I thought I was going to build when I started.
You can check it out here if you're interested: getgdprscan.com
I'm curious how other indie hackers experienced this.
Did your product also slowly evolve into something completely different from the original idea?
And how did you decide whether to follow that evolution or stay focused on the original niche?