Skip to content

This is the Privacy Policy that was in force from October 28, 2026 to October 28, 2026. It no longer applies. Current version · All versions

Privacy Policy

Last updated: 28 October 2026

This policy explains what personal data PageCheck collects, why, how long we keep it and what rights you have. PageCheck is a website audit service at pagecheck.dev, operated by WEBHAUS, SIA.

1. Who is responsible

The controller of your personal data is:

WEBHAUS, SIA
Ziemeļu 7, Valmiera, LV-4201, Latvia
Registration number 44103102859, VAT number LV44103102859
Phone: +371 28440055
Privacy requests: privacy@pagecheck.dev
Support: hello@pagecheck.dev

2. What we collect, why, and on what legal basis

2.1 Website checks

Checks can be run only with an account. When you type a website address on the home page before signing in, we keep the address, the language you use, your IP address (for IPv6, its first 64 bits) and the time for 30 minutes, so that the check can start as soon as you have signed in; a cookie (pc_intent) ties it to your browser. We look the website's name up in DNS but do not visit it until you have signed in.

For each check we record the website address, your account, your IP address, the language and the times, and keep the report. We use your account and IP address to apply the daily limits, including a limit on free checks per network across all accounts.

Legal basis: performing the service you asked for (Art. 6(1)(b) GDPR), and our legitimate interest in preventing abuse of a free service (Art. 6(1)(f) GDPR).

2.2 Protection against automated misuse

Asking for a sign-in code by e-mail, buying a plan at checkout and adding or changing a card are protected by Cloudflare Turnstile, which looks at signals from your browser and device to tell people from automated programs. To stop accounts being created in bulk, we record for each new account the time, the network it was created from (IP address, IPv6 by its first 64 bits) and the domain of its e-mail address, and limit how many new accounts one network and one company e-mail domain can create a day. Legal basis: our legitimate interest in keeping the service available and secure (Art. 6(1)(f) GDPR). See also section 4.

2.3 Accounts and signing in

You can sign in with an e-mail code or with Google, and with Microsoft where the sign-in page offers it; there are no passwords. Every account has one verified e-mail address, and signing in with another method whose verified address is the same joins that method to the same account.

  • Google: we receive your name, e-mail address, whether Google has verified it, and your Google account identifier.
  • Microsoft (where offered; personal, work or school account): we receive your name, e-mail address, an account identifier and, for work and school accounts, whether your organisation has verified the address. If Microsoft does not confirm the address, we send a code to it before we use it for your account.
  • E-mail code: we send a 6-digit code and a sign-in link to the address you enter. We store only a one-way hash of the code and of the link, valid for 10 minutes, together with the time, your IP address and a cookie (pc_login) that ties the code to your browser, so that a code works only where it was asked for. We limit how many codes an address and a network can request.

When you create an account, we record that you accepted the Terms of Service and this Privacy Policy, with their version and the date. If they change materially, we ask you to accept them again. We use your account data to run your account, keep your check history and apply your plan's limits. You can connect and disconnect sign-in methods in your account; the e-mail code always remains available. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).

2.3a Deleting your account and downloading your data

You can delete your account yourself in your account settings, after confirming it is you with a fresh sign-in or an e-mailed code. Your account is then deactivated at once — you are signed out everywhere and no new checks can be run — and deleted for good 30 days later. During those 30 days you can restore it by signing in or with the link in the e-mail we send you. The waiting period protects you if someone else gains access to your account, lets accidental deletions be undone and stops limits being reset by deleting and re-creating accounts; the law allows us one month to act on a request. If you have a paid plan, you choose between deleting the account when the paid period ends (the plan does not renew, the account works until then and we remind you 7 days before) and deleting it now, giving up the remaining days; the paid period is not refunded except where section 8 of the Terms provides otherwise.

When the account is deleted, we delete your account details, your sign-in methods and your e-mail address. Your reports stay available at their links but are no longer connected to you. Copies in our backups disappear within a further 30 days. Your saved card is removed and your customer record at Stripe is deleted. We keep invoices and payment records for as long as accounting law requires, and, for 180 days, a one-way keyed hash of your e-mail address and the network address last used, only to apply the limits on new accounts and free checks (legitimate interest, Art. 6(1)(f) GDPR).

You can also download your data at any time — once a day, after a fresh sign-in or code: a ZIP file with your account details (JSON), the list of your checks (CSV) and the PDF of each report.

2.4 Paid plans and invoices

When you buy a paid plan, we process your name, company name, billing address, VAT number (if any), plan, payment history and invoices. Payments are handled by Stripe; we never see or store your full card number. Card details are entered in Stripe's payment form, which is loaded from Stripe only on the billing pages (checkout, Plan & billing when you add or change a card, and the page for confirming a payment with your bank); there Stripe also receives information about your browser and device to prevent fraud, under its own privacy policy. To apply the correct VAT we record evidence of your location: your billing country, the country of your IP address and the country of your card. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and our legal obligations under accounting and tax law (Art. 6(1)(c) GDPR).

2.5 PageCheck news

We may occasionally send news about PageCheck — new checks, features and offers of our own service — to the e-mail address you used for PageCheck. We never send offers from third parties and never sell or rent your address. Every news e-mail contains a link to unsubscribe in one click, and you can also write to privacy@pagecheck.dev at any time. Legal basis: our legitimate interest in informing users about our own service (Art. 6(1)(f) GDPR), in line with Article 9 of the Latvian Information Society Services Law on communications to existing customers about similar services.

2.6 E-mail delivery log

For every e-mail we send we log the time, recipient, subject, type and whether delivery succeeded — never the message content. We use the log to answer questions such as "I did not receive my report" and to detect delivery problems. Legal basis: our legitimate interest in running a reliable service (Art. 6(1)(f) GDPR).

2.7 Server logs

Our web servers record technical data about each request (IP address, time, requested address, browser identification). We use these logs for security and troubleshooting. Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

2.8 The websites you test

To test a website, PageCheck visits it like a normal visitor and reads what any visitor can see: the pages, response headers, DNS records and similar public information. The report you receive may contain information found there. We do not try to access anything that is not public.

2.9 Visitor statistics (Google Analytics and Microsoft Clarity)

Only if you allow analytics cookies — "Accept all" or the Analytics switch in the cookie notice — we use Google Analytics and Microsoft Clarity to see how PageCheck is used and to make it better. Without your consent neither is loaded and nothing is sent to Google or Microsoft.

  • Google Analytics receives the pages you open, where you came from, your browser, device, screen and approximate location (derived from your IP address, which Google Analytics does not store), a random identifier kept in a cookie, and a few actions on the site — for example that the Check button was pressed, whether you were signed in and which plan you have.
  • Microsoft Clarity records how pages are used — mouse movements, clicks, scrolling and the size of your screen — as session replays and heatmaps, with a random identifier kept in a cookie. All text on the page and everything you type are masked before anything leaves your browser, and account pages are masked as a whole.

We remove report and check identifiers, sign-in and confirmation links and other personal details from the page addresses we send, and pages that name a website you checked send a neutral title instead. We never send your name, e-mail address, account number or the addresses you check, and we do not load either tool on pages whose address contains a one-time link. We have not switched on advertising features, Google signals or data sharing for advertising, and we do not combine the statistics with your account.

Google Analytics keeps the data for 14 months. Clarity keeps session replays for 30 days and summary figures for up to 13 months. You can withdraw your consent at any time through Cookie settings at the bottom of every page: both tools stop at once and their cookies are deleted. Legal basis: your consent (Art. 6(1)(a) GDPR).

2.10 Cookies

See our Cookie Policy.

3. Do you have to give us your data?

You do not have to, but checks can be run only with an account, which needs a verified e-mail address, and without billing details we cannot provide a paid plan.

4. Who receives your data

We use these service providers, who process data on our behalf and under our instructions:

  • Hetzner Online GmbH (Germany) — hosting; our servers are located in the EU (Finland).
  • Cloudflare, Inc. (USA) — content delivery, security, DNS and the Turnstile check.
  • Mailgun Technologies, Inc. (USA) — sending e-mail; we use its EU region.
  • Microsoft Ireland Operations Limited / Microsoft Corporation — sign-in with Microsoft, where it is offered, and Microsoft Clarity visitor statistics, only with your consent (section 2.9).
  • Google LLC / Google Ireland Limited — sign-in with Google, our support e-mail, Google Analytics visitor statistics, only with your consent (section 2.9), and the Chrome UX Report and PageSpeed Insights services, which receive the address of the website being tested.
  • Stripe Payments Europe, Ltd. (Ireland) — payment processing.
  • Our accountant and tax advisers, where invoices and payment records require it.

A report's "Website and presence" card has a button, "Show first saved date". Only when you click it, your browser asks the Internet Archive (USA, archive.org) when it first saved the checked website; like any request, it carries your IP address and is handled under the Internet Archive's own terms and privacy policy. PageCheck does not contact the Internet Archive and keeps nothing of the answer. The link to the Wayback Machine next to it works the same way as any other link.

We disclose data to authorities only where the law requires it.

5. Transfers outside the EU

Some of these providers, or companies in their groups, are based in the United States. Where data is transferred there, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

6. How long we keep data

  • Website addresses typed before signing in: 30 minutes, then they lapse; the record is deleted a day later.
  • Sign-in codes and links: valid for 10 minutes; deleted a day after they lapse.
  • Records of new accounts (network and e-mail domain): the network address is removed after 180 days.
  • IP addresses used for the daily limits: kept for 180 days, then removed from the check record.
  • Completed checks and their reports: kept so that the report stays available; when your account is deleted, they are no longer connected to you.
  • Accounts: until you delete your account; deletion takes effect 30 days after the request (see section 2.3a), backups roll off within a further 30 days.
  • After an account is deleted: a keyed hash of the e-mail address and the network address, for 180 days, for the abuse limits only.
  • Unconfirmed check requests made through a website owner's embedded checking tool (where offered), including the e-mail address: deleted 7 days after the request.
  • Invoices and payment records: for as long as Latvian accounting and tax law requires.
  • News e-mails: we stop as soon as you unsubscribe and keep the address only on a do-not-send list, so that we can honour your choice.
  • Visitor statistics (only with your consent): Google Analytics 14 months; Microsoft Clarity session replays 30 days, summary figures up to 13 months.
  • E-mail delivery log: 30 days.
  • Server logs: 180 days, then deleted automatically.

7. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests — including, at any time and without giving reasons, to news e-mails. Write to privacy@pagecheck.dev; we answer within one month.

You also have the right to lodge a complaint with the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv), or with the authority in your own EU country.

8. Automated decisions

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

9. Security

Data is transferred only over encrypted connections. Sign-in codes, sign-in links and confirmation links are stored only as one-way hashes, so even a copy of our database could not be used to sign in or confirm anything. Access to systems is restricted to people who need it.

10. Changes

We will update this policy when our processing changes and show the date of the latest version at the top. Significant changes will be announced on the site or by e-mail.