Privacy Policy

This Privacy Policy explains how KO Data (“we”, “us”, “WebSpeed”) collects, uses, shares and protects personal data when you visit webspeed.pro, run a speed audit, or use the WebSpeed acceleration service (together, the “Service”). We act in line with the EU General Data Protection Regulation (GDPR) and equivalent laws.

1. Two roles: controller and processor

WebSpeed handles personal data in two distinct capacities:

• As a controller — for our own website, marketing, audit tool and account area, we decide why and how your data is processed. That is what this Policy covers.
• As a processor — when we accelerate a customer’s website through our reverse proxy, that customer’s visitors’ data passes through our systems on the customer’s behalf. There, the customer is the controller and we are their processor; those terms are set out in our Data Processing Addendum (DPA), not here.

2. Data we collect

Information you give us

• Audit requests. The website URL you submit for a speed audit, and any options you choose. A submitted URL is a business identifier, but may occasionally contain personal data in its path or query string.
• Contact & enquiries. Your email address and message content when you contact us, request a report, or ask to be added to a plan.
• Change watch (“Watch for changes”). If you ask us to watch an audited page, we store your email address, the page URL, and a snapshot of that page’s current measurements (scores, metrics and page weight) as the baseline we compare later checks against. We keep watching, and re-measuring that page periodically, until you unsubscribe. Every message carries a one-click unsubscribe link, and you can also ask us at any time.
• Account data (future SaaS cabinet at app.webspeed.pro): name, email, credentials and billing details when accounts launch.

Information collected automatically

• Technical & log data. IP address, user-agent, referrer, pages/endpoints requested and timestamps — kept in server logs for security, abuse prevention and diagnostics.
• Cookies & similar. A small set of first-party cookies (language, audit access) and — where enabled and consented to — analytics. See the Cookie Policy for the full list.
• Audit results. Generated reports, screenshots and before/after metrics for a URL, which we store to serve the report and to improve the Service.

3. Why we use it and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Run an audit you requested and deliver the report	Performance of a contract / your request (Art. 6(1)(b))
Operate, secure and debug the Service; prevent abuse	Legitimate interests (Art. 6(1)(f))
Respond to enquiries and provide support	Legitimate interests / pre-contract steps (Art. 6(1)(b),(f))
Watch a page you subscribed to and message you when its measurements change (including re-measuring that page periodically)	Consent (Art. 6(1)(a)) — withdrawn any time by unsubscribing
Accounts and billing (when live)	Contract (Art. 6(1)(b)); legal obligation for invoices (Art. 6(1)(c))
Analytics and product measurement	Consent (Art. 6(1)(a)) where required

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

4. Public audits

We publish some before/after audits as examples across the site. These come from publicly reachable pages and are independent research; WebSpeed is not affiliated with the sites shown, and we proxy only sites whose owners have opted in. If your site appears and you want it removed, email us and we will take it down promptly — see the Disclaimer.

5. Sharing and sub-processors

We share personal data only with providers that help us run the Service:

• Google PageSpeed Insights API — when you audit a URL, that URL is sent to Google to run the measurement (see Google’s privacy terms).
• Hosting & infrastructure — Hetzner (Germany, EU) hosts the website, the proxy and the audit engine.
• Analytics — we do not currently run any analytics or tracking service. If we introduce one, we will name it here and in the Cookie Policy before it goes live.
• Email delivery — we do not currently send email about a watched page: subscriptions are stored, but nothing is dispatched. Before the first message is sent we will name the delivery provider here.
• Authorities or advisers where required by law, or to establish, exercise or defend legal claims.

6. International transfers

Where a provider processes data outside the EU/EEA, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

7. Retention

We keep personal data only as long as necessary for the purpose it was collected: server logs for a rolling window of up to 90 days, audit records for as long as the report is offered plus a reasonable archive period, and enquiry/account data for the life of the relationship plus any legally required retention (e.g. tax records).

A change watch lasts until you end it: we keep your email address, the watched URL and its baseline measurements for as long as the watch is active. Unsubscribing deletes that record — we do not keep your address on a suppression list afterwards — and once a page has no watchers left, its watch record is removed entirely.

8. Your rights

Subject to the GDPR, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise any of these, email hi@webspeed.pro. We answer within one month, as the GDPR requires.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi), and you may equally complain to the authority in your own country of residence or place of work.

9. Security

We apply appropriate technical and organisational measures — encryption in transit (HTTPS), access controls, and least-privilege operations — to protect personal data. No method of transmission or storage is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying breach as required by law.

10. Children

The Service is intended for businesses and professionals and is not directed to children under 16. We do not knowingly collect their data.

11. Changes to this Policy

We may update this Policy from time to time. The “last updated” date at the top reflects the current version; material changes will be highlighted on the site.