Privacy Policy

This Privacy Policy explains how KO Data (“we”, “us”, “WebSpeed”) collects, uses, shares and protects personal data when you visit webspeed.pro, run a speed audit, or use the WebSpeed acceleration service (together, the “Service”). We act in line with the EU General Data Protection Regulation (GDPR) and equivalent laws.

1. Two roles: controller and processor

WebSpeed handles personal data in two distinct capacities:

• As a controller — for our own website, marketing, audit tool and account area, we decide why and how your data is processed. That is what this Policy covers.
• As a processor — when we accelerate a customer’s website through our reverse proxy, that customer’s visitors’ data passes through our systems on the customer’s behalf. There, the customer is the controller and we are their processor; those terms are set out in our Data Processing Addendum (DPA), not here.

2. Data we collect

Information you give us

• Audit requests. The website URL you submit for a speed audit, and any options you choose. A submitted URL is a business identifier, but may occasionally contain personal data in its path or query string.
• Contact & enquiries. Your email address and message content when you contact us, request a report, or ask to be added to a plan.
• Change watch (“Watch for changes”). If you ask us to watch an audited page, we store your email address, the page URL, and a snapshot of that page’s current measurements (scores, metrics and page weight) as the baseline we compare later checks against. We keep watching, and re-measuring that page periodically, until you unsubscribe. Every message carries a one-click unsubscribe link, and you can also ask us at any time.
• Account data (future SaaS cabinet at app.webspeed.pro): name, email, credentials and billing details when accounts launch.

Information collected automatically

• Technical & log data. IP address, user-agent, referrer, pages/endpoints requested and timestamps — kept in server logs for security, abuse prevention and diagnostics.
• Cookies & similar. A small set of first-party cookies (language, audit access) and — only if you allow it in the cookie banner — analytics: pages viewed, activity, landing page and referrer, audit-tool events, and the contact details you submit in a form on the site. See the Cookie Policy for the full list.
• Audit results. Generated reports, screenshots and before/after metrics for a URL, which we store to serve the report and to improve the Service.
• Audit runs. The fact that a site was checked and the result of that check — the audited address and its before/after scores, with no data about you — are passed to our analytics whatever you choose in the cookie banner. They are sent by our server; nothing is read from or stored on your device for this.
• Your answer to the audit question. While an audit runs we may ask what matters most to you. Answering is optional. If you do, we store the answer with the audit it was given on, and nothing about you: no IP address, no browser details, no cookie or visitor identifier.

WebSpeed in ChatGPT and Claude

If you add the WebSpeed app to ChatGPT or Claude and ask it to measure a page, the assistant calls our server. Each call brings us:

• The page address you asked about. We measure it like any other audit request: the address goes to Google PageSpeed Insights, and the result becomes a public report (see section 4).
• A user identifier. In ChatGPT this is an anonymised id that ChatGPT provides to apps; elsewhere it is an id our server gives to the app session. We use it only to apply the limit on new measurements per user per day, and we store it only as a one-way hash, never as received.

The WebSpeed browser extension and code editors such as Cursor and VS Code call our server directly from your device, so for them the daily limit is per network instead: we count new measurements against a one-way hash of the IP address the request came from. That hash is kept only in the daily counters, not in the call log below. When you open its window, the extension sends the address of the site’s home page to look up an existing result. It sends the address of the open page, without the part after “?”, only when you ask it to check that page, and the address being measured when you press its button to start a new measurement. A look-up creates no report and does not count against the limit.

The extension can also highlight sites that already have a WebSpeed report. This is off until you turn it on in its window, and your browser then asks you to let the extension see the addresses of your tabs. Once a day the extension downloads a list of the sites we have measured, each given as a short one-way hash of its domain name with its PageSpeed scores, and checks the domain of each open tab against that list on your device. The addresses of your tabs are not sent to us: the daily download carries no address and no identifier, and reaches us like any other web request (see “Technical & log data” above). Turning the option off withdraws that permission and deletes the downloaded list.

For each call we record the hashed identifier, the platform (ChatGPT or Claude), the tool used, the site measured or looked up, the audit and its outcome, and the time. The platform may also send its own context, such as your language or approximate location; we do not store it. We do not receive your name, email address or the rest of your conversation: the chat itself is handled by OpenAI or Anthropic under their own privacy policies.

We also pass a record of each measurement made through the app to our own analytics (see section 5), to count how many people use the app and how many measurements they request. For the browser extension we also pass on each opening of its window: the site it was opened on, the browser, and whether that site already had a report. The extension’s identifier is the session number our server gives it for the current browser session. The record carries a second one-way hash of the user identifier, made with a secret key, so the analytics never sees the identifier itself. Next to it are the platform, whether the identifier belongs to a person or to a single session, the site measured, the audit and its outcome, and the time. It contains no IP address, name, email address or chat text.

3. Why we use it and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Run an audit you requested and deliver the report	Performance of a contract / your request (Art. 6(1)(b))
Operate, secure and debug the Service; prevent abuse	Legitimate interests (Art. 6(1)(f))
Respond to enquiries and provide support	Legitimate interests / pre-contract steps (Art. 6(1)(b),(f))
Watch a page you subscribed to and message you when its measurements change (including re-measuring that page periodically)	Consent (Art. 6(1)(a)) — withdrawn any time by unsubscribing
Record that you accepted our Terms before your domain is connected: your name, email, company, the domain, the time, your IP address and browser, and a copy of the Terms you accepted	Contract (Art. 6(1)(b)); legitimate interests in being able to show what was agreed (Art. 6(1)(f))
Accounts and billing (when live)	Contract (Art. 6(1)(b)); legal obligation for invoices (Art. 6(1)(c))
Count audit runs and their results (no data about you)	Legitimate interests (Art. 6(1)(f))
Learn what people who check their site want from it (anonymous answers to the audit question)	Legitimate interests (Art. 6(1)(f))
Apply the daily limit in the ChatGPT and Claude app and the browser extension, and count how they are used (hashed identifier or hashed IP address only)	Legitimate interests (Art. 6(1)(f))
Analytics and product measurement	Consent (Art. 6(1)(a)) — withdrawn any time via Cookie settings in the footer

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

4. Public audits

We publish some before/after audits as examples across the site. These come from publicly reachable pages and are independent research; WebSpeed is not affiliated with the sites shown, and we proxy only sites whose owners have opted in. If your site appears and you want it removed, email us and we will take it down promptly — see the Disclaimer.

5. Sharing and sub-processors

We share personal data only with providers that help us run the Service:

• Google PageSpeed Insights API — when you audit a URL, that URL is sent to Google to run the measurement (see Google’s privacy terms).
• Hosting & infrastructure — Hetzner (Germany, EU) hosts the website, the proxy and the audit engine.
• Analytics — with your consent, the site loads KO Data’s own analytics counter. KO Data runs WebSpeed, so this is not a third-party service; the data is stored on our servers at Hetzner in the EU. What it records and which cookies it sets are listed in the Cookie Policy. The app measurement records described in section 2 are sent there by our server and are stored the same way.
• Email delivery — we do not currently send email about a watched page: subscriptions are stored, but nothing is dispatched. Before the first message is sent we will name the delivery provider here.
• Authorities or advisers where required by law, or to establish, exercise or defend legal claims.

6. International transfers

Where a provider processes data outside the EU/EEA, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

7. Retention

We keep personal data only as long as necessary for the purpose it was collected: server logs for a rolling window of up to 90 days, audit records for as long as the report is offered plus a reasonable archive period, and enquiry/account data for the life of the relationship plus any legally required retention (e.g. tax records).

A change watch lasts until you end it: we keep your email address, the watched URL and its baseline measurements for as long as the watch is active. Unsubscribing deletes that record — we do not keep your address on a suppression list afterwards — and once a page has no watchers left, its watch record is removed entirely.

For the ChatGPT and Claude app and the browser extension, the daily counters (per user, or per hashed IP address) are deleted after two days, and the call log described in section 2 after 13 months. An audit started from the app is kept like any other audit.

A record of accepting the Terms is kept for as long as the agreement lasts and, after it ends, for the period in which claims under it can still be brought.

8. Your rights

Subject to the GDPR, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise any of these, email hi@webspeed.pro. We answer within one month, as the GDPR requires.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi), and you may equally complain to the authority in your own country of residence or place of work.

9. Security

We apply appropriate technical and organisational measures — encryption in transit (HTTPS), access controls, and least-privilege operations — to protect personal data. No method of transmission or storage is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying breach as required by law.

10. Children

The Service is intended for businesses and professionals and is not directed to children under 16. We do not knowingly collect their data.

11. Changes to this Policy

We may update this Policy from time to time. The “last updated” date at the top reflects the current version; material changes will be highlighted on the site.