This policy explains which personal data we process when you visit pwspeed.com, use the PWSpeed plugin, ask for a license or buy a subscription. It is written to be read, not just to be there.
- This website uses no cookies and no tracking scripts.
- Every copy of the plugin sends us its site address and version when it checks for updates. Nothing about your visitors or your content.
- For a license we keep your name, email address, plan and the domains you activate.
- Payments are handled by Paddle. We never see your card.
1. Who is responsible
The data controller is Ploy Web Studio, sole proprietorship of Fabrizio Bestoso, Strada Piangrande 7, 17051 Andora (SV), Italy. VAT number IT01826400093.
For anything about your data, write to privacy@pwspeed.com.
2. Visiting this website
The site is a set of static pages served by Cloudflare. To deliver and protect it, Cloudflare processes technical data of each request, such as the IP address, the browser and the page requested.
We measure visits with Cloudflare Web Analytics: it uses no cookies, does not fingerprint your device and gives us only totals (pages, countries, referrers), not individual visitors.
The site sets no cookies, so it shows no cookie banner. Legal basis: our legitimate interest in running a secure website and knowing how it is used (Art. 6(1)(f) GDPR).
3. Using the plugin
Update checks (every installation, with or without a license). A few times a day the plugin asks our license server whether a new version exists. The request contains the site address, the plugin version and, if there is one, the license key. We use it to offer updates and security fixes, to check what the license allows, and to count how many sites use PWSpeed and which versions. We keep one record per domain; a domain that stops checking for 12 months is deleted. Legal basis: legitimate interest in delivering updates and knowing our installed base (Art. 6(1)(f)). Removing the plugin stops the checks.
License activation and daily check. When you activate a key, and once a day after that, the plugin sends the key, the site address, the plugin version and whether WooCommerce is active. We store only a fingerprint (hash) of the key and its last five characters. Legal basis: performance of the contract (Art. 6(1)(b)).
Script list. Once a week the plugin downloads a public list of scripts that must not be delayed. The request carries no data about your site beyond what any web request carries.
What the plugin never sends us: your content, data about your visitors or customers, your Cloudflare API token (it stays on your site), or the email addresses of your users.
Services the plugin contacts on your instruction. Your own Cloudflare account (to set up and update the edge cache), Google PageSpeed Insights (the address of the page you test), IndexNow (addresses of changed pages, only if you turn it on and the site may be indexed) and public DNS resolvers by Cloudflare and Google (for setup checks). For this data the site owner is the controller; it does not reach us.
4. Asking for a free launch license
We ask for your name, email address and site address, and store your language, whether you want the newsletter, your IP address (to limit abuse) and the version of the Terms of service you accepted, with the date. We need them to send the confirmation link and the key. The request record is deleted after 30 days; if you confirm, your email is kept as described in the next section. Legal basis: steps at your request before a contract (Art. 6(1)(b)).
5. Customers and licenses
For each license we keep your name, email address and language, the version of the Terms you accepted and when, the plan, the expiry date, the domains you activated and a log of what happened to the license (activations, renewals, emails sent). Legal basis: performance of the contract (Art. 6(1)(b)).
We keep this data while the license exists and for 24 months after it expires, so that you can renew it without losing your setup. Then it is deleted automatically. Invoices and tax records are kept by Paddle, our reseller.
6. Emails and newsletter
Service emails (confirmation link, license key, expiry reminders) are sent through Brevo. They are part of the service and do not need your consent.
The newsletter is sent only if you ask for it and confirm with the link in the first email (double opt-in). You can unsubscribe at any time from the link in every message. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
7. Payments
Subscriptions are sold by Paddle.com Market Ltd, our reseller and Merchant of Record. Paddle collects the payment and billing data as an independent controller, under its own privacy notice. We receive your name, email address, country and the state of your subscription, never your card details.
8. Writing to us
Emails to our @pwspeed.com addresses are received by Cloudflare Email Routing and forwarded to our mailbox. We keep them as long as needed to answer you and for at most 24 months after the conversation ends, unless they relate to a dispute.
Contact form. We ask for your name, email, subject and message, and optionally your site address. The message reaches us by email through Brevo and the conversation follows the paragraph above: we do not keep it anywhere else. Against spam the page loads Cloudflare Turnstile, which analyses technical signals of your browser and connection, including your IP address, to tell people from automated programs. Legal basis: answering your request (Art. 6(1)(b)) and our legitimate interest in improving PWSpeed through reports (Art. 6(1)(f)). The newsletter box in the form is optional, not ticked, and follows section 6.
9. Who else sees the data
- Cloudflare, Inc. (USA): website hosting, license server, database, email forwarding, anti-spam check of the contact form (Turnstile). Processor.
- Brevo (Sendinblue SAS, France): service emails and newsletter. Processor.
- Paddle.com Market Ltd (United Kingdom): sales and payments. Independent controller.
Cloudflare is certified under the EU-U.S. Data Privacy Framework and also signs the European Commission’s Standard Contractual Clauses. The United Kingdom has an adequacy decision of the European Commission. We do not sell data and do not share it with advertisers.
10. Security
License keys are stored only as fingerprints, the tokens the plugin receives are digitally signed, every connection is encrypted, and access to the database is limited to the people who run PWSpeed.
11. Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and you can withdraw consent at any time. Write to privacy@pwspeed.com: we answer within one month.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority of the country where you live.
We make no automated decisions about you and build no profiles.
12. Changes
If we change how we use data, we update this page and the date at the top. For important changes we also email our customers.