Privacy Policy

1. Our role

For your account, billing and this website, we decide how data is used (we are the business or controller). For data your WordPress sites send to the dashboard about their visitors and users, you decide and we process it for you (we are your processor). The Data Processing page sets out that part in detail.

2. What we collect

• Account: name, email, company name, country, language and time zone; the members you invite.
• Billing: plan, invoices and tax details. Stripe holds card details; we see only the card brand, last four digits and expiry.
• Using the dashboard: sign-ins, actions and settings changes in your audit log, with IP address and browser; security emails we send you.
• From connected sites: the site address; WordPress, PHP and plugin versions; security findings (file paths, fingerprints and up to 300 characters of the matching code, never whole files; keys and passwords in it are masked); security events, which can include usernames and IP addresses of people signing in to your site (shortened by default); monthly report figures.
• Free site scan: the address you scan, the results, and your IP address to prevent abuse.
• This website: no cookies and no trackers. Our host, Cloudflare, records IP addresses briefly for security.
• What you send us by email.

3. What we never collect

Your site’s files, posts, pages, customers, orders or passwords. Scans run on your server and send findings only. Backups go straight from your site to storage you own; they never pass through us.

4. Why we use it

We do not sell personal data, use it for targeted advertising, or share it with data brokers.

• To provide the service you signed up for (contract).
• To keep the service and your sites secure, prevent abuse and keep an audit trail (legitimate interests, and legal obligations).
• To bill you and keep accounting records (legal obligations).
• To send service and security emails you cannot turn off while you have an account, and product news only if you opt in (consent).

5. Who we share it with

Only the service providers that run parts of the service for us, listed on the Data Processing page, under contracts that limit their use of the data; and authorities where the law requires it.

6. International transfers

The dashboard and its database run on our own server in Japan (Tokyo), rented from Contabo GmbH. Stripe, Cloudflare, Resend and OpenRouter operate outside Japan and Singapore. When we transfer personal data outside Japan or Singapore, we do so under contracts and safeguards that give it protection comparable to APPI and the PDPA. The United States has no general data protection law equivalent to APPI; the providers we use commit by contract to protect the data and use it only for us.

7. How long we keep it

• Site events: 90 days (an account can choose 30–365).
• Resolved findings: 180 days.
• Remote actions and resolved alerts: 180 days.
• Monthly reports: as long as the site stays connected.
• Disconnected sites and closed accounts: deleted after 30 days.
• Free scan results: 30 days.
• Invoices: as long as tax law requires.

8. How we protect it

Two-step sign-in for every dashboard user, encrypted connections, site secrets encrypted with their own key, signed requests between sites and the dashboard, a tamper-evident audit log, and staff access only with your permission. See the Security page.

9. Your rights

You can ask to see, correct, delete or export your personal data, to stop us using it, or to withdraw consent, by writing to [email protected]. Account owners can also download all of an account’s data and delete the account themselves on the dashboard’s Account page (see Deleting your account). We answer within 30 days (sooner where the law requires) and will not treat you differently for asking. We honour the Global Privacy Control signal.

10. Japan (APPI)

Personal information handling business operator: Novatise. Address and representative: see our commercial disclosure page. For requests to disclose, correct, stop using or delete retained personal data, or about third-party transfers, write to [email protected]; we will confirm your identity first. Complaints can also go to the Personal Information Protection Commission.

11. Singapore (PDPA)

Our Data Protection Officer can be reached at [email protected]. You can withdraw consent at any time; we will tell you what that means for the service. Data breaches are handled as set out in section 14.

12. United States

Residents of California and other states with privacy laws have the rights above to know, correct and delete personal data, and to opt out of its sale or sharing; we do neither. Use [email protected] to make a request; an authorised agent may act for you.

13. Children

The service is for businesses and adults and is not directed at children. We do not knowingly collect personal data from children under 16, except through family protection on phones, which only a parent or legal guardian can set up for their own child. Family protection is not offered to new customers yet; this section says how it will work.

Before a child’s phone is added, the parent must confirm that they are the child’s parent or legal guardian and give their consent, and we will keep a record of that consent. From a child’s phone we receive only the list of installed apps, minutes of use per app, its location if the parent turns location on, safety alerts and security scan results. Messages, typed text, browsing history, notifications and files never leave the phone, and the phone shows the child that their parent can see app use and location.

Parents can see, export and delete their child’s data at any time; removing the child or deleting the account deletes it. We never show advertising to children, track them across other services, build profiles of them, or sell or share their data.

United States: for children under 13 we rely on verifiable consent from a parent, as the Children’s Online Privacy Protection Act (COPPA) requires; if we learn that we hold a child’s data without it, we delete it. Japan and Singapore: where a child cannot yet give valid consent under APPI or the PDPA, we rely on the consent of their parent or legal guardian.

14. Data breaches

If a security breach leads to personal data we hold being lost, disclosed or accessed without authorisation, we contain it, assess it and tell the people affected without undue delay: what happened, which data was involved, what we are doing and what you can do.

Japan: where APPI requires a report (for example when sensitive data or data that could cause financial loss is involved, when the breach may have been deliberate, or when more than 1,000 people are affected), we send the Personal Information Protection Commission a preliminary report promptly, generally within 3 to 5 days of finding out, and a final report within 30 days (60 days where it may have been caused by an act with an improper purpose), and we notify the people affected promptly.

Singapore: we assess whether a breach is notifiable within 30 days of having reason to believe it happened. If it is likely to cause significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission as soon as practicable and no later than 3 calendar days after that assessment; where significant harm is likely, we also notify the people affected.

Business customers: where we process data for you, we tell you without undue delay, within 72 hours where possible, so you can meet your own duties (see the Data Processing page).

15. Changes

We will post changes here and email account owners about material ones. Questions: [email protected].