Privacy Policy

Version 0.3, in force from 13 November 2026

Draft for legal review. This text is not in force yet.

This policy explains what personal data SiteCare Lab handles about its customers and the people who use their accounts, why, and for how long. Personal data that appears on our customers' websites is covered by our Data Processing Agreement, not by this policy.

1. Who is responsible

Es Key Tech Ltd, ЕИК 208916463, 35 Stoyan Mihaylovski St., fl. 4, apt. 12, Sadiyski quarter, Tsentralen district, 4000 Plovdiv, Bulgaria, is the controller of the data described here. Write to us at hello@sitecarelab.com about anything in this policy. We have not appointed a data protection officer, as the law does not require one for our activity.

2. What we collect, why, and for how long

Your account and signing in

• Your email address: to sign you in and to send you what you asked for (reports, alerts, invoices). We do not send newsletters or advertising.
• When you ask for a sign-in link, we record the time and your IP address to stop abuse. These records are deleted after 30 days.
• Legal basis: the contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in keeping accounts safe (Art. 6(1)(f)).
• Kept while your account exists. After it is closed, your email address stays only as part of the proof of what you accepted (below).

Your business and invoice details

• Business name, country, address, registration number and VAT number. For a sole trader these may be personal data.
• We check EU VAT numbers in the European Commission's VIES system and keep the answer.
• For each order we keep what the VAT rules require us to prove: your billing address, the IP address and its country at checkout, and the country of your card. The messages Stripe sends us about a payment are kept 90 days; after that only what the invoice and the VAT rules need remains.
• Legal basis: the contract, and our legal duties under accounting and VAT law (Art. 6(1)(c)).
• Invoices and the data on them are kept as long as accounting and tax law require (up to 10 years). Other details are kept while your account exists.

Proof of what you accepted

• Which version of our terms, this policy and the Data Processing Agreement you accepted, when, and from which IP address.
• Legal basis: our legitimate interest in being able to prove the contract (Art. 6(1)(f)).
• Kept while your account exists and 5 years after it is closed.

Your websites and their results

• The addresses of your sites, how you verified them, and the results of our checks.
• Pictures of parts of your pages are deleted after 90 days; vulnerability checks after 180 days (the latest one for each site stays).
• What you enter yourself: your business profile (address, phone, email, opening hours) and your accessibility statement (contact email and phone). If you enter other people's details, please make sure they know.
• Legal basis: the contract.
• Deleted when you delete the site, and in any case within 30 days after the contract ends.

Messages you send us

• Kept for 2 years after the last message in the conversation, so we can follow up. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)).

Server logs

• Our servers record IP addresses, times and requested addresses to keep the service running and secure. Deleted after 30 [to be confirmed] days. Legal basis: our legitimate interest in security (Art. 6(1)(f)).

We need your email address and invoice details to provide the service and to issue invoices; without them we cannot sell to you.

3. Cookies

The app uses only cookies it needs to work: one that keeps you signed in (for up to 30 days), one that protects forms against misuse, one that remembers your language, and a short-lived one that carries a notice (such as "Saved.") to the next page. We use no analytics and no advertising cookies. Our public website sets no cookies of its own.

4. Who receives data

• WAN.bg (Bulgaria): hosts our servers and database. [to be confirmed]
• [email provider]: sends our emails (sign-in links, reports, alerts, invoices). [to be confirmed]
• Cloudflare, Inc. (USA, with servers worldwide; EU Standard Contractual Clauses and the EU–US Data Privacy Framework): protects and speeds up our website and app; sees IP addresses and requests. [to be confirmed]
• Rollbar, Inc. (USA; EU Standard Contractual Clauses): receives reports of errors in our app, with email and IP addresses removed, so we can fix them. [to be confirmed]
• Stripe Payments Europe, Ltd. (Ireland; Stripe may transfer data to the USA under the EU Standard Contractual Clauses): takes card and other payments; for its own legal duties (fraud prevention, anti-money laundering) it decides itself, under its own privacy policy.
• European Commission (VIES) (EU): checks EU VAT numbers; we send the number you give us and our own.
• Our accountant (Bulgaria): keeps our books; receives invoices and payment records.

We also give data to authorities when the law requires it. We do not sell personal data.

When you open a partner link in a report (for example to CookieYes), you go to that company's website, and its own privacy policy applies there. We do not pass your data to it; it only learns that you came from us.

5. Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, or to receive it in a portable format. You can object to uses based on our legitimate interest. We answer within one month.

You can also complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg) or to the data protection authority in your own EU country.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects on you. Our scores describe websites, not people.

6. Security

Sign-in works through single-use links instead of passwords, connections to our app are encrypted, and our plugin and our servers sign every message they exchange. Your data is visible only in your account and, where needed to provide the service, to our staff. Sign-in records, pictures of pages and old vulnerability checks are deleted automatically when their periods end; we delete the rest ourselves within the periods above.

7. Changes

When we change this policy, we tell you by email and in your account. The version in force and its date are shown at the top.