ON. WebMeter

Privacy and data retention policy

Who processes the data, what WebMeter reads and stores when checking a website, for how long, who receives it and what your rights are.

Summary

WebMeter checks only publicly available technical information about a website (DNS records, HTTP headers, the certificate, the home page and at most five other public pages). It does not log in, does not try passwords or vulnerabilities and does not fill in forms. Check results and finished reports from the web application (HTML and PDF, so that the report link keeps working later) are stored for at most 365 days (PDF for 30 days) and then deleted. A website owner can block the checks in robots.txt (User-agent: WebMeterBot, Disallow: /) or ask for the domain to be excluded and the stored data deleted at kontakt@webmeter.eu. A consultation inquiry sent through the form (name, e-mail, optional phone number and message) is used to handle the inquiry and to prepare the quote you ask for. No IP address is stored with it. The inquiry is deleted after 365 days at the latest, or earlier on request. Traffic measurement runs only with your consent.

Who processes the data

The controller of personal data is Ondřej Novák, a natural person doing business under the Czech Trade Licensing Act, Company ID (IČO) 745 345 99, registered office at Pod vysokou mezí 137/21, 154 00 Praha 5 – Holyně, registered in the Trade Register kept by the Municipal District Office of Prague 5, trading under the business name ON Consulting & Advisory. Contact for all questions and requests: kontakt@webmeter.eu. We have not appointed a data protection officer because the law does not require us to.

What WebMeter reads when checking a website

WebMeter reads only publicly available information about the checked website:

In addition, it loads the home page once in a real browser, including the images, styles and scripts the page downloads itself, and takes a screenshot of it before any choice in the cookie banner.

It also queries public services: Google PageSpeed Insights (Google loads the website 3× from its own infrastructure), public certificate logs (crt.sh, with the Cert Spotter service of SSLMate, Inc., USA, as a fallback), domain registries (RDAP), the RIPEstat database, the HSTS preload list, certificate issuers and the Czech business register ARES if it finds a company ID (IČO) on the website. It also checks whether similar-sounding domains exist (only by a DNS query). These services receive only data about the checked website, nothing about you.

WebMeter does not log in, does not try passwords or vulnerabilities and neither fills in nor submits forms. We do not store who started the check, neither in the database nor in the report: the report carries no information about the requester except the page language. Only in the server's memory do we keep, for the free-check limit, the IP address and the domains of the websites checked from it (see IP addresses and form protection).

From public certificate logs WebMeter also finds the website's subdomains. In the public report, subdomain names that may hint at internal services are only partly shown or given as a count.

Why and on what basis: we carry out the check at the requester's request to show them the technical state of the website from publicly available information. The legal basis is our and the requester's legitimate interest (Art. 6(1)(f) GDPR). For websites of self-employed natural persons this is personal data (the domain, data from ARES, e-mail addresses in DNS). We obtain the data from the website itself and from the public sources listed above. You can object to the check by excluding the website (see Deletion and exclusion of a website).

Report and screenshot

The check result is saved as a report at a link that cannot be guessed. Anyone who knows the link can open the report; whoever checks the same website in the same language within 10 minutes gets the same link. The screenshot of the home page serves only as internal evidence for the cookie findings; it is not shown in the report and we delete it once it is older than 30 days. If the website states a company ID (IČO), the report also shows business data from the ARES register (the Czech Administrative Register of Economic Subjects); for self-employed natural persons only the name, legal form, status and VAT registration, without address and VAT ID.

Consultation inquiry

When you send an inquiry below the result, we store your name, e-mail, phone number (if you fill it in), the text of the message, the time it was sent, the page language and the link to the measurement (the domain and the report link). We do not store the IP address with the inquiry. The operator receives a notification with this data and a summary of the measurement result by e-mail. We use the data to get back to you, arrange a consultation and prepare the quote you ask for (for example a new website). We will not send you marketing messages without your consent.

Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); if you write on behalf of a company, our legitimate interest in handling the inquiry (point (f)). We cannot handle the inquiry without a name, e-mail and message; the phone number is optional.

Once a week we send ourselves an internal operations overview; inquiries appear in it only with their number, domain and time of receipt.

IP addresses and form protection

The application does not store visitors' IP addresses on disk or in the database. It keeps them in the server's memory for about 24 hours in order to limit the number of checks and inquiries from one address. From one IP address you can check 6 different websites in 10 days for free and, separately, 12 different websites of competitors in 10 days in the competitor comparison. So that one address cannot check an unlimited number of other people's websites for free, the server also keeps in memory the IP address (for IPv6 only the /64 network) together with the domains of the websites checked from it, for at most 10 days from the first check of each website. This data is not written to the database, to disk, to backups or to logs, and a server restart deletes it.

The forms are protected by Cloudflare Turnstile, which checks that they are not being sent by a robot. It loads only when you fill in a form and processes the IP address and technical data about the browser; the server passes the IP address to it for verification. Cloudflare may store a technical cookie (cf_clearance) during a security check. Cloudflare also uses the verification data to improve its protection against bots; in that respect it is an independent controller (Turnstile privacy policy: cloudflare.com/turnstile-privacy-policy).

Legal basis for IP addresses and form protection: legitimate interest in protecting the service against misuse (Art. 6(1)(f) GDPR). Storing data necessary for security does not require consent (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications).

Cookies and visitor analytics

Without consent we store only your cookie choice in your browser, so that the banner does not appear on every page: the entry webmeter-consent in browser storage (localStorage) with the settings version and the time of your choice. The entry is never sent anywhere and is valid for 6 months; after that, or when we change the tools we use, we will ask you again.

Only with your consent (category “Analytics”) do we load Google Tag Manager and Google Analytics 4 so that we know which pages people read, how the website check is used and what to improve. Google Analytics processes data about the visit: pages visited, where the visit came from, the type of device and browser and an approximate location based on the IP address. From the website check it receives only data about its course and result (for example the grade and the score band) and about whether you opened the report, downloaded the PDF or sent an inquiry; never the address of the checked website, the link to the report or the contents of forms. It stores the cookies _ga and _ga_<ID> with a lifetime according to the settings, at most 2 years; Google Tag Manager itself does not store cookies. Detailed visit records in Google Analytics are deleted after 14 months at the latest.

Processor: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The data may also be processed by Google LLC in the USA; the transfer to the USA is based on the EU–US Data Privacy Framework (the European Commission's adequacy decision), which Google LLC has joined; the data processing agreement with Google also contains standard contractual clauses.

Microsoft Clarity is also loaded through Google Tag Manager only with your consent in the “Analytics” category, so that we can see how people use the pages and where something does not work for them. From mouse movements, clicks and scrolling, Clarity creates heatmaps (aggregated maps of clicks and scrolling) and recordings of how visitors move through the pages. It does not record the contents of form fields, and the parts of the homepage with the address of the checked website, the check result, the comparison and the inquiry are hidden (masked) from it. It also processes data about the device and browser and an approximate location based on the IP address, and stores the cookies _clck (at most 1 year) and _clsk (1 day); Microsoft may also store its own cookies on its domains. When you withdraw your consent, we delete the _clck and _clsk cookies if the browser allows it.

Microsoft keeps recordings and heatmaps according to its terms: recordings usually for 30 days, heatmaps and selected recordings for at most 9 months. Provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; for Clarity, Microsoft is an independent controller of the data (privacy statement: microsoft.com/privacy/privacystatement). The data may also be processed by Microsoft Corporation in the USA; the transfer to the USA is based on the EU–US Data Privacy Framework, which Microsoft Corporation has joined, and on standard contractual clauses.

We do not use marketing cookies yet. If we introduce them, we will list them here and the banner will ask for your consent again.

Changing or withdrawing consent: at any time via “Cookie settings” in the footer of every page. After withdrawal, analytics stops loading and we delete the Google Analytics cookies in your browser where the browser allows it; the change takes full effect once you reload the page.

Legal basis: your consent (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications, and Art. 6(1)(a) GDPR). Withdrawing consent does not affect processing before the withdrawal. We store the choice in the banner itself without consent, because without it the banner could not work.

Analytics tools are never loaded on report pages or in PDFs.

Where the data is and who processes it for us

Data about the checked website is also received by Google (PageSpeed Insights, public DNS) as an independent controller and by the other public services listed in the section What WebMeter reads when checking a website; they receive only the website address, the IP address of its hosting or the company ID (IČO).

Transfers to the USA: Cloudflare, Google and Better Stack are certified under the EU–US Data Privacy Framework, for which the European Commission's adequacy decision applies; their contracts also contain standard contractual clauses in case the framework ceases to apply. Microsoft Corporation (Microsoft Clarity) is also certified under this framework.

Canada: our server contract is with the Canadian company OVH Hosting Inc., 1801 McGill College Avenue, Suite 800, Montréal (Québec) H3A 2N4; for Canada, the European Commission's adequacy decision on the protection of personal data applies. The application's data is stored on the server in Germany (EU).

How long we keep data

DataRetention period
Check result and report (screenshot as internal evidence only 30 days) 365 days from the check
Report PDF 30 days; then it is created again on request
Consultation inquiry 365 days from sending
E-mail with the inquiry in the operator's mailbox 12 months from the last contact; if a contract is concluded, for the period required by tax law
IP address in the server's memory about 24 hours; together with the domains of checked websites at most 10 days
List of excluded domains (domain, reason, date) permanently, so that the exclusion keeps applying
Log of performed deletions 40 days
Server system logs 14 days
Encrypted backups about 5 weeks
Google Analytics cookies (only with consent) at most 2 years; detailed records in Google Analytics 14 months
Microsoft Clarity cookies and recordings (only with consent) cookies at most 1 year; recordings usually 30 days, heatmaps at most 9 months (according to Microsoft's terms)
Choice in the cookie banner (localStorage) 6 months

Data deleted from the database, whether after the period expires or at your request, remains in encrypted backups for about 5 more weeks; after that it can no longer be restored.

Deletion and exclusion of a website

To have the stored results for your domain deleted and the domain excluded from further checks, e-mail kontakt@webmeter.eu. The exclusion applies to the whole domain including all subdomains; we keep a permanent record of the domain, otherwise the exclusion could not be honoured. So that we do not exclude or delete someone else's website, we verify that the request comes from the owner or administrator of the website: usually because it was sent from an e-mail address on that domain or from an address given on the website; otherwise we will ask you for a simple verification, for example a DNS record.

You can also block the checks in robots.txt (User-agent: WebMeterBot, Disallow: /). The block stops further checks but does not delete stored data; to have it deleted, send us an e-mail. The procedure is described on the page How to opt a website out of analysis.

Your rights

You have the right to request access to your data, its rectification or erasure, restriction of processing and portability of the data you have provided to us. You can object to processing based on legitimate interest (website check, form protection, free-check limit); for website checks the easiest way is to exclude the website (see Deletion and exclusion of a website). You can withdraw your consent to traffic measurement at any time in “Cookie settings”.

Send requests to kontakt@webmeter.eu. We will handle them within one month; if in doubt, we may verify your identity.

You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or with the supervisory authority in your country of residence.

The score and grade rate the website, not people. We do not carry out automated decision-making with legal effects or profiling.