Who is responsible for this site
| Field | Value |
|---|---|
| Trading name | Measured |
| Legal entity | SC MY SOFTWARE IT DEV SRL |
| Company form | Romanian limited liability company (SRL) |
| Registration number (CUI) | 42242905 |
| Trade register number | J3/268/11.02.2020 |
| VAT number | RO42242905 |
| Registered address | Str. Profesor Ștefan Chicoș nr. 1B, Pitești, județul Argeș, Romania |
| alex@measuredweb.com | |
| Data protection officer | None appointed. Art. 37 GDPR does not require one here: there is no large-scale monitoring, no large-scale processing of special categories, and this is not a public authority. |
The entity above is the controller for the personal data described on this page. This block is also the business identification an EU business is required to publish about itself. Write to the email address for anything on this page, including to exercise a right.
What is collected, and on what basis
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Email you send, and our replies | Answering you; running the engagement if you become a client | Legitimate interest, Art. 6(1)(f); contract, Art. 6(1)(b), once you are a client | Enquiries that do not become work: 24 months. Client correspondence: for the duration of the engagement, then under the retention that Romanian accounting law sets for the records it belongs to. |
| Business contact details of people at prospective client companies: name, role, work email, and the public technical measurements of their website | Writing to them once about something measurable on their own site, and following up if they reply | Legitimate interest, Art. 6(1)(f). Sources and the balancing test are recorded, and every message says how it was obtained and how to stop it. | Until they ask to be removed, or 12 months after the last contact, whichever comes first. A request to stop is recorded permanently so it is not undone by a later scan. |
| The free script-tag checker: the domain you type | Running the check, and building the public catalogue of which vendors appear on which kinds of store | Legitimate interest, Art. 6(1)(f) | Kept. A domain name typed into a form is not personal data, and we deliberately store nothing alongside it — no IP address, no browser, no identifier, nothing that links one check to another or to you. |
| Deep scan: your email address, the domain you asked about, a one-way hash of your IP address, and the result of the scan itself | Running the scan, emailing you the result, keeping that result readable at a private link, and limiting how many can be run per day | Consent, Art. 6(1)(a) for the scan, the email and keeping the result. Legitimate interest, Art. 6(1)(f), for the rate limit — each scan runs a real browser and the limit is what keeps the tool free. | The email address, domain and stored result: 24 months, or until you ask. The IP hash: 30 days, then deleted. The hash is one-way and truncated, so the original address cannot be recovered from it and it cannot be used to identify you. |
| Core Web Vitals report: your email address, the page you asked about, a one-way hash of your IP address, and the report itself together with the two Lighthouse results and the Chrome UX Report record it was computed from | Producing the report, emailing you the link, keeping the report readable at a private link, re-analysing the stored results when the rules improve, and limiting how many can be queued per day | Consent, Art. 6(1)(a) for the report, the email and keeping the result. Legitimate interest, Art. 6(1)(f), for the rate limit — each report is two full Lighthouse runs and the queue is shared. | The email address, page and stored report: 24 months, or until you ask. The IP hash: 30 days, then deleted. The results describe a web page, not a person; the address is what makes the record personal data, and asking removes both. |
| Monitor account: your email address, a sign-in link token and a session token (both stored only as hashes), the agency name you enter, the stores and templates you add, every measurement taken of them, what changed between measurements, and a record of each alert sent | Signing you in without a password, measuring the stores you asked us to watch, showing history, and sending alerts to you and, if you configured one, to your Slack | Contract, Art. 6(1)(b): this is the service you signed up for | While the account exists and for 30 days after you close it, then deleted. Sign-in links expire after 15 minutes; sessions after 30 days. Measurements describe websites, not people. |
| Funnel counts: which page a visit landed on and the campaign name in its address, whether a check, a report, a sign-in, a sign-up, a store or a checkout happened, and when | Knowing whether an advert or a post brought anyone who then used the product | Legitimate interest, Art. 6(1)(f) | Kept as counts. No IP address, no browser, no cookie and no identifier of any kind is stored with them, so two rows cannot be linked to each other or to you. |
| Waiting list: your email address, and the domain you checked | Writing to you once, when continuous monitoring is available | Consent, Art. 6(1)(a) — you typed it into the form for that purpose | Until you ask to be removed, or 24 months from signing up if the product has not launched by then. Reply to any message, or write to the address above, and the record is deleted. |
| Request logs at the host: IP address, user agent, page requested, timestamp | Serving the page, security, abuse | Legitimate interest, Art. 6(1)(f) | Not retained by us: we neither export nor store them. Cloudflare holds its own edge logs under its published schedule. |
Nothing on the public site needs an account or a password, and no payment is taken there. Monitor, the paid service, has an account: it is opened with an emailed link rather than a password, and payment is taken by Stripe, so card details never reach us. Everything each part collects is in the table above.
The link in your deep-scan or report email
A deep scan or a Core Web Vitals report is kept so that the email can carry a link to it, and the result stays readable as a web page rather than only as a wall of text. That link is the whole credential: it contains 128 bits of randomness, it is the only way to reach the report, and there is no login in front of it. Treat it as you would treat the report itself. The page is marked noindex and excluded in robots.txt, and it is never stored by a shared cache — but anyone you forward it to can read it.
The scan result describes a website, not a person. What makes the record personal data is the address it was sent to, which is stored alongside it so we can find your reports again if you later ask for them or ask for them to be deleted. Ask, and both the report and the address go.
The email address is the delivery mechanism, not a gate. That is deliberate: it means there is no separate step asking you to confirm anything, and a mistyped address simply receives nothing.
The instant checker deliberately stores no visitor data. We keep the domain that was checked and what we found on it, because that is what builds the catalogue and because comparing this week's finding with last week's is the whole point of the product — but nothing recorded alongside it identifies who ran the check, and there is no identifier that links one check to another. If you would rather not have a domain recorded at all, email us instead and we will run it by hand, or add ?nolog=1 to the result URL and nothing is written.
Everything the checker reads is already public: it requests the same homepage any visitor would, from outside, with no credentials. It is never given access to a store.
If you become a client, the contract and invoicing records that follow are handled under that contract and under Romanian accounting law rather than under this page.
The lawful bases above are a considered reading, not a settled one, and they are exactly the kind of thing to put in front of an adviser. A first enquiry can also be argued as steps prior to a contract under Art. 6(1)(b), and the boundary between an ordinary enquiry and consent is not always as clean in practice as a table makes it look.
No third party is involved in rendering this page
Web fonts are the usual reason a site quietly sends its visitors' IP addresses abroad: asking Google Fonts for a typeface means your browser requests it from Google's servers, and to send the file Google has to know where to send it. That is a transfer of personal data to a third party, before you click anything, and it happens on a very large share of the web.
This site does not do that. Both typefaces — Chivo and JetBrains Mono — are served from this domain. Google receives nothing when you load a page here, no consent banner is required for fonts, and the page is marginally faster as a side effect.
Requests this page makes to third parties. None for fonts, none for analytics, none for tracking. The only third party involved in delivering this page is the hosting provider, listed below, which necessarily sees the request in order to answer it.
Who else processes it
These are the third parties that handle data on our behalf, or that receive it as a consequence of how the site is built.
| Who | What they handle | Where |
|---|---|---|
| Google Workspace | Email between you and us, including its contents and attachments | Google's global infrastructure. No data-region restriction is configured on the account, so processing is not limited to the EU. |
| Cloudflare Workers | Hosting the site and running the free checker, plus request logs for pages served | Global edge network, served from the location nearest you |
| Cloudflare Browser Rendering | Loading the page you asked about in a real browser, in order to record what it loads. No data about you is sent to it — only the address of the site being scanned. | Cloudflare's network |
| Google PageSpeed Insights and Chrome UX Report APIs | Producing a Core Web Vitals report: the address of the page you asked about is sent to Google, which loads it and returns Lighthouse's measurements and the published field record. Nothing about you is sent — not your email address, not your IP address. | Google's infrastructure, global |
| Stripe | Monitor subscriptions: your card, your billing name and address, and the invoices. We see the last four digits and the subscription status, never the card. | Stripe's infrastructure, global; Stripe is the controller for the card data it holds. |
| Slack (only if you add a webhook) | The text of an alert, posted to the channel you chose. We send it; Slack stores it under your workspace's terms. | Slack's infrastructure |
| Resend | Delivering the scan result to your email address | EU region. Resend sends on our behalf from a subdomain kept separate from our own correspondence. |
| Cloudflare D1 | Storing waiting-list email addresses, deep-scan and report requests with their results, Monitor accounts with their stores and measurements, funnel counts, and the log of which domains have been checked | Eastern Europe. The database was created in Cloudflare's EEUR region, so this data does not leave the EU. |
No data from this site is sold, rented, or handed to anyone for advertising. There is no analytics or attribution vendor in the list because there is no analytics on the site, and no form provider because the forms post to our own code rather than to somebody else's. The list is five entries long, every one of them is there to do a specific job named above, and none of them receives anything we were not asked to send.
Transfers outside the EU
Google and Cloudflare are both capable of processing data outside the European Union, which means a transfer mechanism under Chapter V of the GDPR has to apply to each of them. The mechanism relied on for both is the set of standard contractual clauses incorporated into each provider's data processing agreement. Where a provider is additionally certified under an adequacy framework, that certification supplements those clauses rather than replacing them.
The clauses are the primary mechanism here deliberately. Two successive adequacy frameworks for the same transfers have been annulled by the Court of Justice, and the standard contractual clauses survived both. A notice that rests only on the framework in force this year has to be rewritten the next time one falls.
Measurement of publicly accessible pages
Part of the work this business does is measuring how public web pages perform. That means requesting pages belonging to prospective and actual clients and recording what the request returns — one HTTP request per page, the same request your own browser makes when you open the page.
Only publicly published pages are measured. Nothing behind a login is touched, no account is created, no credentials are used, no form is submitted, and no customer data is read, because none of it is reachable from a public page. Where results are published, they are published as aggregate statistics across a sample. Results for an individual site are never published, and are shared only with the operator of that site.
It is set out here because a careful reader will want it addressed. In the ordinary case there is no personal data in a page measurement at all. But a small store is often run by one identifiable person, and a public page can carry that person's name and contact details, so the activity is treated as processing: the purpose is technical research and preparing an offer of service, and the basis is legitimate interest under Art. 6(1)(f). If you would rather your site was not measured, say so at the email address above and it will be excluded from future measurement.
What a measurement is. A request to a public URL, and a record of what came back — timings, resource sizes, which third-party scripts the page loads. What it is not. No login, no crawling of private areas, no form submissions, no purchase, no collection of anything a visitor to that page could not see.
Cookies
The public site sets no cookies and stores nothing in your browser: no local storage, no session identifier, no fingerprint, no analytics of any kind. Signing in to Monitor sets one cookie, named ms: a random session identifier that is strictly necessary for the account to work, marked HttpOnly and Secure, valid for 30 days and deleted when you sign out. It carries no tracking and is not read by anyone else. A strictly necessary cookie needs no banner, so none appears.
Note that an empty cookie list is not by itself the same as no third parties: a request to an external host happens whether or not anything is stored on your device. On this site the fonts are self-hosted and there is no analytics, so the hosting provider is the only external party in the chain.
If analytics, a chat widget, an embedded video, a heatmap tool, or a form endpoint that sets its own cookies is ever added, this section stops being true. It has to be rewritten first, together with the table of what is collected — and at that point the question of a consent mechanism becomes real.
Your rights
If we hold personal data about you, the GDPR gives you the following rights over it.
- Access. Ask what we hold about you, and get a copy of it.
- Rectification. Have anything inaccurate corrected, and anything incomplete completed.
- Erasure. Have it deleted, where there is no overriding reason to keep it.
- Restriction. Have us stop using it while a dispute about it is resolved.
- Objection. Object to processing that rests on legitimate interest, including the page measurement described above.
- Portability. Receive data you provided in a structured, machine-readable form, or have it sent to another controller.
Ask by email and you will get an answer within one month, as the GDPR requires. There is no charge, and no form to fill in. None of the processing described on this page involves automated decision-making or profiling.
If you are not satisfied with the answer, you can complain to the Romanian supervisory authority: the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at dataprotection.ro. You can also complain to the supervisory authority in the EU member state where you live or work. Complaining to an authority does not require you to have contacted us first, though it is usually quicker if you do.