01Scope and contact
This policy covers personal data processed when using SitePulse at stats.wedev.bg. The controller is the platform operator. For privacy enquiries, use Contact with the subject “Personal data” and include the account email where the request concerns an account.
This policy describes the platform and does not cover independent processing by websites you analyse. Do not submit another person’s data or secret information unless needed and you are entitled to do so.
02Account information
To create and maintain an account, we process your name, email, password hash, account type and status, language and theme. Sign-in uses session records and technical data such as IP address, browser and activity time. Passwords are not stored as readable text.
When Google sign-in is available and you choose it, the identification data needed to link an account is processed, including email and a Google identifier. We do not receive your Google password.
03URLs, reports and integrations
We process submitted URLs, associated domains, findings, scores, technical responses and check times. A URL can itself contain personal data; use a public address without access parameters, tokens or sensitive values.
When the WordPress plugin is connected, we process the site address, connection code and technical diagnostics such as WordPress and PHP versions and HTTPS status. The plugin is not designed to send passwords, database keys or customer order content.
04Messages and transaction records
The contact form collects your name, email, subject and message. We process this information to investigate, respond and follow up on your enquiry. Identity documents, passwords, medical information and other sensitive data are not needed.
Demonstration payments record the order, amount, currency, status and simulation flag. Card numbers and CVV values are processed only for the test response and are not stored in the database. Do not use actual payment details in DEMO checkout.
05Purposes and legal grounds
Providing accounts, requested analyses and purchased access is based on performing the service or taking steps at your request before a contract. Responding to an enquiry serves that enquiry, while abuse prevention and error investigation support the legitimate interest in a secure, working platform.
Where a legal obligation applies, processing is based on it. Where an optional purpose requires consent, consent is requested separately and can be withdrawn. Accepting the terms and reading this policy do not constitute blanket consent to advertising or all future processing.
06Recipients and external services
Information may be accessible to authorised support and technical staff and to hosting and email providers to the extent needed. We do not sell personal data. Disclosure to a competent authority may occur where supported by an applicable legal ground.
When PageSpeed is enabled, the checked URL is sent to Google. When AI is enabled, technical finding codes, severity and confidence are sent to the configured AI provider; this module does not need your password. Google sign-in and Google Fonts also involve the browser connecting directly to Google when used.
External processing may involve infrastructure outside the European Economic Area. Applicable grounds and safeguards for international transfers depend on the provider and service used. You can request details about active recipients and applicable safeguards through Contact.
07Retention and deletion
Active account data and report history are retained to provide the service. On a deletion request, we assess which records can be erased and which must remain for legal obligations or the establishment, exercise or defence of legal claims. Pressing “Delete account” submits a request rather than immediately erasing data automatically.
Retention for technical logs, correspondence, cache and backups is determined by the relevant purpose, security needs, incident investigation and applicable legal requirements. A backup may retain information until replaced under its backup cycle. You can request specific information about your data through Contact.
08Your rights
Subject to applicable law, you may request access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests and withdraw consent for future processing. Some rights have exceptions; for example, deletion does not override mandatory legal retention.
Submit a request through Contact from your account email where possible. We may seek proportionate identity verification to avoid disclosing data to another person. Responses follow the applicable statutory deadline, generally one month, with legally permitted extension for complex requests.
You may complain to Bulgaria’s Commission for Personal Data Protection through cpdp.bg or another competent supervisory authority. Contacting us first may help resolve the issue, but is not a condition for exercising this right.
09Security and report sharing
Technical measures include HTTPS, password hashing, form protection and access controls. No online service can promise absolute security. Notify us of suspicious activity and do not share integration codes or session details.
Reports have unique links. A link holder can view public information, and an unlocked report may expose additional detail. Treat the link as shareable information and send it only to appropriate recipients.
10Automation, required information and updates
Scores are automated technical website assessments. They are not decisions about individuals producing legal or similarly significant effects. Without a required email or URL, we may be unable to create an account, run an analysis or respond to an enquiry.
Material policy changes are reflected in an updated date with additional information where needed. Read the separate Cookie Policy for cookies and local preferences.