LEGAL
Privacy policy
Last updated: 1 August 2026
This policy explains how SitioHero handles personal data when you visit the site, request an assessment, receive a report, or book a consultation.
1. Controller and contact
The controller is the SitioHero operator identified in the legal notice. To ask questions or exercise your rights, email info@sitiohero.com.
2. Data we process
- Data you provide: name, email address, business name, URL, industry, location, and optional answers.
- Public business and website data: visible content, metadata, technical signals, links, and other publicly accessible information needed for the assessment.
- Report data: findings, evidence, internal scores, confidence level, and recommendations produced from observed signals.
- Minimal technical data: service events and a temporary derived identifier used to prevent abuse. We do not store raw IP addresses in product tables.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Perform and deliver the requested assessment | Steps requested by you before entering a contract |
| Respond to enquiries and arrange a consultation | Pre-contractual steps and our legitimate interest in responding |
| Protect the service, limit abuse, and diagnose faults | Legitimate interest in maintaining a secure and reliable service |
4. How the assessment works
The assessment uses deterministic rules to interpret observable website signals. Automation may help summarise findings, but it does not make decisions with legal or similarly significant effects about you. The result is preliminary, depends on the data we can retrieve, and is not a guarantee of traffic, leads, sales, or revenue.
5. Providers and recipients
We share data only where necessary to provide and protect the service. Our current providers include Vercel (hosting), Supabase (database), Resend (transactional email), Google PageSpeed Insights (public performance metrics), and Cal.com (booking). Each provider processes data under its own terms and, where applicable, a data-processing agreement.
Some providers may process data outside the European Economic Area. Where required, we rely on mechanisms recognised under European law, such as adequacy decisions or standard contractual clauses.
6. Retention
- Incomplete or failed assessments: up to 30 days.
- Completed assessments without an associated contact: up to 90 days.
- Reports linked to a contact request: up to 12 months, unless you ask us to delete them sooner or a legal obligation requires longer retention.
- Temporary abuse-prevention identifiers: up to 24 hours.
7. Your rights
Where applicable, you may request access, correction, deletion, restriction, portability, or object to processing. You may also withdraw consent without affecting processing that was lawful before withdrawal. We may request reasonable information to verify your identity.
To exercise these rights, email info@sitiohero.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority where you live.
8. Security
We use reasonable technical and organisational measures, including tokenised report links, restricted database access, and data minimisation. No internet service can guarantee absolute security.
9. Cookies
See our cookie policy for the current use of storage and similar technologies.
10. Changes
We may update this policy when the service, providers, or law changes. We will publish the new revision date on this page.