Legal

Privacy policy

What data I process, why and for how long. Straight to the point: the minimum needed to do the job, and never to sell it or hand it over.

This is an English translation for convenience. The Spanish version (Política de privacidad) is the legally binding one and prevails in case of any discrepancy.

Data controller

Controller: Jose Soriano Castro (WebIntacta)
Tax ID (NIF): 50508565J
Address: Calle Espronceda, 59, 03440 Ibi (Alicante), España
Privacy contact: info@webintacta.com

What data I process and why

1. Free website scan

I store the address of the scanned website and the technical result, so I can show you the report, let you share it through a private link (which does not appear in search engines) and compare it with later scans. I do not ask for your name or email to run a scan. Your IP address is only used to limit abuse (number of scans per hour) and is stored as a digest (hash), not in plain text.

Legal basis: legitimate interest in providing the tool you have asked for and in protecting it from abuse (art. 6(1)(f) GDPR).

1a. Full diagnostic, 30-day alerts and a written reply

If you leave me your email on the scan result (or, optionally, when starting the scan), I use it for three things only: sending you the diagnostic as a PDF; emailing you for 30 days if a security flaw affecting what the scan saw on your website (platform, add-ons, libraries or PHP version) is published, with a follow-up scan on day 30; and replying in writing to your question. I store your email, your question if you write one, the scan it belongs to and the record of your consent (date, accepted text and version of this policy). After 30 days the alerts stop by themselves. These emails are not advertising: offers only reach you if you separately tick the offers box.

Legal basis: your consent (art. 6(1)(a) GDPR; art. 21 of the Spanish LSSI for offers). You can withdraw it at any time with the unsubscribe link in every email or by writing to me; unsubscribing stops the alerts, the follow-up scan and the offers.

2. Support requests, forms and chat

When you open a request, fill in a form or write in the chat, I process your name (if you give it), your email, your phone number (if you give it), your website address, the service you are interested in and the messages we exchange, plus a record of your consent (date and version of this policy). This is used to reply to you, keep the conversation on your private request page and, if you order a service, prepare the quote.

With form requests I also store how you reached this website: only the domain of the previous page (for example, a search engine or an AI assistant), the first page you opened here and, if the link carried one, its utm_source tag. Never the full address or anything that identifies you. I read this at the moment you submit, without cookies or storage in your browser, and it tells me which pages and channels help people find me.

Legal basis: your consent, which you give when you submit (art. 6(1)(a) GDPR) and can withdraw whenever you like, and, if you order a service, the performance of the contract or of pre-contractual steps (art. 6(1)(b)).

3. Clients

If you order a service, I also process the data needed to provide and invoice it (name or company name, tax ID and billing address) and the technical data of your website needed for the work: what the read-only connector sends (versions, file fingerprints, excerpts of suspicious files, evaluated configuration) or what I see during a cleanup. I do not search for or extract your customers' data; if I have access to it during a cleanup, I act as a data processor on your behalf, only for that work and under a duty of confidentiality.

Legal basis: performance of the contract (art. 6(1)(b) GDPR) and compliance with legal tax obligations (art. 6(1)(c)).

4. Analytics and advertising

Only if you accept it in the cookie notice, I use Google Analytics 4 and Google Ads to measure visits and conversions. Details in the cookie policy. Legal basis: your consent (art. 6(1)(a)).

How long I keep it

Requests and chat without an order: while the request is being handled and, afterwards, up to two years from the last activity (the last message of the request or the chat, the last scan of your website or the last unlock of the diagnostic), so the conversation can be picked up again. After that they are deleted automatically, together with your messages, your contact details and the record of your consent. You can ask me to delete them sooner.
Email left for the diagnostic and the alerts: the alerts stop after 30 days or when you unsubscribe; the contact is kept as a request and deleted automatically two years after the last activity. You can ask me to delete it sooner.
Clients: for as long as the relationship lasts and, afterwards, for the legal periods (six years for accounting records and invoices, art. 30 of the Spanish Commercial Code (Código de Comercio); four years for tax purposes).
Website scans: those run from this website without leaving any contact details are deleted automatically 365 days after the last scan; those of a website you left your details for without placing an order, two years after the last activity, together with your contact (automatic deletion); those of clients, for as long as the relationship lasts. You can ask me to delete those of your website sooner.
Consent record: as long as the data it refers to, so that the consent can be proven.
Backups: kept for 30 days; anything deleted also disappears from them within that time.

Who else sees it

I do not disclose data to third parties unless required by law. To operate, I use these providers (data processors):

OVHcloud (OVH SAS, France), where the server of this website and its database are hosted, inside the European Union.
Cloudflare, which protects and speeds up the website: visits go through its servers, which see your IP address and the pages you request.
Brevo (Sendinblue SAS, France), which I use to send confirmations and replies.
Telegram, to get a notification on my phone of a new request or message, with its content, so I can attend to you sooner.
Stripe, if you pay by card. Card details are processed by Stripe; I do not see them. I receive your email, name, country and, if you give them, your billing address and tax ID, to record the payment and invoice it.
WhatsApp (Meta), only if you choose to message me there: it is an optional channel and WhatsApp handles the conversation under its own privacy policy.
Google (Analytics and/or Ads), only if you accept the corresponding cookies.

Some of these providers may process data outside the European Economic Area. Google, Stripe and Cloudflare do so under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. Telegram is based outside the European Union and does not offer those safeguards: if you would rather your message did not go through it, write to me by email and I will not forward it.

Your rights

You can request access to your data, its rectification or erasure, the restriction of or objection to its processing, and its portability, and you can withdraw your consent at any time, by writing to info@webintacta.com. I will reply within one month. If you believe I have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) (aepd.es).

Security

I sell security, so this website applies what I recommend: HTTPS with HSTS, security headers, private links with random tokens for reports and requests, and restricted access to the admin panel. No system is infallible; if I detected a breach affecting your data, I would notify you as required by the GDPR.

Last updated: October 26, 2026