WebVitalist
Verificação grátis

Privacy policy

Last updated 20 September 2026.

Information we process

  • The website address you ask us to analyse.
  • The email address you provide at payment, so we can send you the report, and the email you use to sign in with a magic link.
  • Account data if you use those features: credits, subscription status, and monitor schedules.
  • Support messages you send via the contact form (email, optional name, topic, message, and any order id or URL you include).
  • Payment status and Stripe’s reference for the payment. Card details are handled only by Stripe.
  • Content of the public website you ask us to analyse (publicly available HTML and text), which is sent to a language model for analysis.
  • Technical logs (IP address, timestamp) for up to 30 days for operations and abuse prevention.

Purpose and legal basis

Processing is necessary to fulfil the contract with you (GDPR art. 6(1)(b)). Logs and server-side product events (scan, checkout, purchase) are processed on the basis of contract performance and our legitimate interest in operating and securing the service (art. 6(1)(f)). We do not enable session replay.

Processors

  • Stripe – payments.
  • Cloudflare – hosting, queues, D1 database, and report storage.
  • Resend – sending email.
  • Cloudflare Workers AI and the selected model – analysis of the website’s content. We do not send your personal details to the model, only the content of the site being analysed.
  • Google PageSpeed Insights – performance measurement of the URL.
  • PostHog (EU Cloud) – optional product analytics. The browser SDK and its cookies load only after you accept. Scan, checkout, and purchase events may also be sent from our server without an email address (a daily visitor hash or your account id) so we can run and secure the service. Session replay is off.

Some providers process data outside the EEA. Transfers are based on the European Commission’s standard contractual clauses.

Retention

The report and order details are stored for 12 months so you can reopen the report, then deleted. Accounting records are kept for five years.

Cookies

We do not use third-party ad or retargeting cookies.

  • Session cookie — set only if you sign in. Necessary to keep you logged in.
  • Stripe cookies — set on Checkout so payment can complete. Necessary for payment.
  • Referral cookie — set if you arrive via an invite link, so we can credit the referrer. Functional, not advertising.
  • First-touch attribution cookie (wv_utm) — set when you land with utm_* in the URL so we can attribute a later free scan, checkout, or purchase to that campaign. First-party only, 90 days, never overwritten by a later campaign. Declining analytics clears it; a new landing with UTM may set it again. Campaign parameters may also be attached to first-party funnel events (and server-side PostHog captures for scan/checkout/purchase) so we can measure acquisition.
  • Optional product analytics — PostHog (EU) for product analytics. The browser SDK and any PostHog cookies load only after you accept in the consent banner. The default is deny; declining keeps the SDK off. Client page views and button clicks are not sent to PostHog unless you accept.

We also record some first-party operational counts (a daily rotating hash, no raw IP stored) to run the service. That does not load a third-party advertising SDK.

Your rights

Write to the contact form or hello@webvitalist.com. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Controller

Contact: hello@webvitalist.com.