Privacy

Who processes the data

The controller of the personal data processed by PageAudit is WRP Consultoria e Informática Ltda (Brazilian company registry CNPJ 66.300.125/0001-45), at R. Copaíba, Lote 01, Bloco B, Sala 408, Águas Claras, Brasília/DF, CEP 71919-540, Brazil, which also runs the other products listed in the footer. The channel for personal data matters is eu@wendelmaques.com; requests are answered by e-mail.

What this product keeps

• Each audit stores the URL, score, findings and summary (title, metas, headings, links, redirects, robots.txt and sitemap status, JSON-LD, discovery-file observations, Chrome UX Report metrics, the summary of any lab test you run and response headers without Set-Cookie). The page HTML and discovery-file bodies are not stored.
• A page you put under the daily watch: the e-mail the alert goes to (the account's, or another one you type), when we last checked it and when we last wrote to you. Switching the watch off stops the checks and the e-mails.
• Each audit stores a hash of the source network. The daily allowance uses a hash of your account when signed in, or your network otherwise.
• Shared reports (/r/…) are public to anyone with the link until you unshare them.
• When editorial features are available, we keep your business brief, sources, generation requests, draft articles and versions to organise the work for each website. Optional WordPress connections store the site, user and encrypted application password.
• The Google import assistant stores the selected Google Analytics account, GA4 property and web stream metadata. Daily collection stores users, sessions, engagement, views, events, key events, transactions, revenue and the bounded original Google response.
• The optional Journeys script collects action IDs, structural button selectors, opaque page IDs and event times after analytics consent. A random tab session expires after 30 minutes without activity. It does not record typed text, page contents or screens. Refusal and withdrawal stop collection and remove the session identifier.
• Domain monitoring stores public registration, installed-certificate and DNS observations, published email policies and bounded certificate-issuance data. Private contact comparison keeps field states and keyed digests, not personal contact values. Manual dates, known DKIM selectors, monitor settings, incidents and delivery receipts belong to your account and organization.
• The weekly site report stores its settings, with up to 3 competitor addresses you type, and for each week the findings of up to 500 pages of your sitemap, the pages checked and the new pages found in the competitors' sitemaps.
• Generated fix prompts store their text, source selector, domain license and creation date for your authenticated identity and organization. The text is not sent to an AI provider. You choose whether to share it with your agent.
• Account: e-mail, password, passkeys, sign-in codes and sessions are kept by the account system shared by our products, in its own database — this product keeps only the account id next to what is yours. Without an account, a signed guest token stored in your browser owns what you create; signing in moves it to your account.
• Pay-per-call payments (x402) settle on the Base network, which is public by design. Here we keep the transaction reference and the amount for reconciliation and accounting. From the request that paid, we also keep the IP address, browser, languages, source site, and approximate country and network, for audit and fraud prevention.
• Prepaid credit: the token is stored only as a SHA-256 hash with its balance and movements; whoever holds the token holds the credit, and it cannot be recovered by e-mail.
• Contact: the name, email, message, WhatsApp number and audio you choose to send go through our own mail server to the controller's mailbox. The message includes the source page, language and network (IP) address. We use this data to answer your request.
• Audio recording is optional and requires your microphone permission. You can listen and delete it before sending. Audio stays in your browser until submission, then goes as an attachment without transcription. Contact does not subscribe you to marketing lists.

Sign in with Google

• When you choose Sign in with Google, you allow access to your Google account identifier, verified email and basic profile. The profile can include your name, given name, family name, photo, language and Google Workspace organisation domain.
• We use this data to identify your account, give you access and display your profile. We store the link and profile fields in the account system. Google confirms your identity. We do not receive your Google password.
• Sign-in requests only openid, email and profile. It does not give access to Gmail, Drive, Calendar, contacts or Search Console. Additional integrations request their own permission when you choose to connect them.
• Sign-in tokens are used on the server to check your identity. We do not keep access or refresh tokens from this sign-in to query other Google services.
• We do not sell data received from Google. We do not use it for personalised advertising or to train general artificial intelligence models. Internal access is limited to service operation, authorised support, security and legal obligations.
• We keep the link and profile while needed for your account. Unlinking Google prevents new access through that link. It does not delete your account, the imported profile, product data or required security and billing records.
• You can remove the connection in your Google Account settings at https://myaccount.google.com/connections. To request access, correction or deletion of data we keep, write to eu@wendelmaques.com. Include the product and account email. Do not send a password or token.
• Our use and transfer of information received from Google APIs follow the Google API Services User Data Policy, including its Limited Use requirements where applicable: https://developers.google.com/terms/api-services-user-data-policy.

Search Console in PageAudit

• When you connect Search Console, PageAudit requests webmasters.readonly permission. Google permits reading properties you can access. The import assistant displays those properties and imports only the ones you select.
• We keep the property, query period, collection date, search queries, pages, clicks, impressions, click-through rate, average position and Google's original response. The overview covers 28 days and up to 50 queries and 50 pages. It does not represent all Search Console data.
• You can select up to 20 queries to track. Each collection reads a rolling 28-day window. We keep earlier series until deletion. We use the results to show performance and detect drops in clicks or position. Collection runs when you connect and can repeat daily. We do not change your Google property or promise a position, traffic or indexing.
• Access and refresh tokens are encrypted on the server and linked to your account. Each imported website receives only the link needed to query the selected property. Tokens are not sent to the browser, public reports or the artificial intelligence provider.
• When an email alert is enabled, Amazon Web Services (SES) receives the domain, search term and click or position values included in the message, plus the recipient's email address. It uses this data to deliver the alert. Search Console results are not included in public reports, advertising or AI requests.
• Disconnecting a website in PageAudit removes that website's local credential and stops new collection. Earlier samples, series and alerts remain stored until deletion. To revoke permission at Google, remove the connection at https://myaccount.google.com/connections. Request deletion of results at eu@wendelmaques.com.

Google Analytics in PageAudit

• When you connect Google Analytics, PageAudit requests analytics.readonly permission. The assistant reads the accounts, GA4 properties and web data streams you can access. It imports only the properties you select.
• We keep the identifiers and names of the account, property and web data stream, the measurement identifier and the website's default address. We use this data to create or link projects in the active organisation. Importing does not run a website audit.
• After import, we collect daily active, total and new users, sessions, engaged sessions, views, events, key events, transactions and total revenue for the selected web streams. The first collection reads the available history from the start of Google Analytics 4. Later collections repeat up to three days to include Google's adjustments.
• We keep the daily series and Google's original response with the period and collection date. We use this data to show history and detect session drops. The site package can send an e-mail alert when a new drop reaches the threshold shown in the interface. We do not change the Google property or promise traffic or a business result.
• Access and refresh tokens are encrypted on the server and linked to your account and the Google Analytics service. They are not sent to the browser, public reports or the artificial intelligence provider.
• When an email alert is enabled, Amazon Web Services (SES) receives the domain, session counts for the two periods and percentage drop included in the message, plus the recipient's email address. It uses this data to deliver the alert. Analytics metadata, raw responses and metrics are not included in public reports, advertising or AI requests.
• Disconnecting a property pauses new collection. Revoking permission at https://myaccount.google.com/connections stops new queries for every property linked through that permission. Earlier projects, metadata, series and alerts remain until deletion. To request deletion, write to eu@wendelmaques.com.

Sharing Google user data

• These disclosures cover the Google account data and any Google integration data described in this policy. They also cover raw responses, summaries and aggregated or derived data.
• WRP processes this data to provide the features you request. Our hosting and storage providers supply the servers we operate. They process stored data to provide that infrastructure. Authorised operators can access data when needed for service operation, security or support you request.
• Google receives the requests and credentials needed to confirm your identity or read a service you connect. Amazon Web Services Simple Email Service (SES) receives your email address and message contents to deliver account messages and enabled alerts. The integration sections describe any Google metrics included in alerts.
• For a purchase you request, the payment providers identified in this policy can receive the name and email used for billing, including those imported at sign-in. They do not receive your Google access tokens, refresh tokens or imported performance reports.
• We do not sell Google user data or disclose it to data brokers or advertisers. We do not use it for advertising, credit decisions or AI model training. We do not send Google API responses, imported performance reports or tokens to AI providers.
• We disclose data to authorities only when required by applicable law. We limit such disclosure to what is required. Hosting and email providers can process data outside your country. Their role is to supply the services described here.

Protecting Google user data

• HTTPS encrypts data between your browser and our service, and between our service and Google's APIs. This includes Google sign-in, permission requests and imported reports.
• The server checks your session and permission before it returns private data. Account and product identifiers restrict access to the records you are allowed to use. Private responses are not stored in shared public caches.
• For optional Google integrations, access and refresh tokens are encrypted before storage with AES-256-GCM. The encryption binds each token to its product, account and Google service. Server configuration holds the encryption keys separately from the encrypted records.
• Google tokens stay on the server. They are not included in browser storage, public reports or AI requests. Sign-in sessions use Secure and HttpOnly cookies. State validation, short expiry and single-use callbacks protect the Google authorization flow.
• Stored profile fields and report metrics are protected by server access controls and account checks. You can revoke Google access and request deletion as described in this policy.

Purposes and legal basis

• To create and keep your account, sign you in and protect access: performance of a contract (LGPD, article 7, V).
• To charge, deliver what you bought and keep the tax records: performance of a contract and legal obligation (LGPD, article 7, V and II).
• To answer your contact, at your request: steps before a contract (LGPD, article 7, V).
• To limit abuse, prevent payment fraud and protect the service: legitimate interest (LGPD, article 7, IX).
• To measure usage and improve the product, with no advertising profile: legitimate interest (LGPD, article 7, IX). Global Privacy Control or "Do Not Track" turns this measurement off.
• To send the e-mail alerts you turned on: your consent, which you withdraw by turning the alert off (LGPD, article 7, I).

For how long

• Audits are kept: closing a tab does not delete its history, so the timeline of a URL survives; deletion requests are handled by e-mail.
• Journeys keeps the current UTC day and the preceding six days. Raw events expire automatically. Collection is limited to 1 MiB per site per UTC day. Site configuration remains until removal is requested.
• Domain history and earlier public versions expire after 90 days. TLS review reports expire after 26 hours. The current observation and your settings remain until removal is requested through Contact. Stopping a monitor does not erase its history or cancel its subscription.
• Weekly site reports older than 12 weeks are deleted.
• Saved fix prompts remain available for free reading and copying, including after plan expiry. Request deletion through Contact. The saved observations do not refresh when you reopen a prompt.
• Account data stays while the account exists. Sign-in codes expire within minutes; the session ends when you sign out or when it expires.
• Per-network rate-limit counters (guest, contact, sign-in code) expire on their own within minutes or hours.
• Payment and credit records stay for the legal retention period of tax and accounting records, usually 5 years.
• Contact messages stay in the controller's mailbox while the conversation and the business relationship last.
• Visit steps stay 7 days on the product server; the copy kept for analysis, without IP or account, stays on our data server.
• Web server records, with the IP address, are deleted within 15 days.

Infrastructure and third parties

• Servers we operate run the service and store the account, payment and usage data in Brazil (Vinhedo, São Paulo state). The copy of visit data kept for analysis, without IP or account, stays on our server in Europe.
• Cloudflare provides only the domain's DNS and receives no account or usage data.
• Amazon Web Services (Amazon SES) sends the account e-mails, such as the sign-in code, the invitation and the alerts you turned on. It receives the recipient e-mail and the message text, in the United States.
• When configured, our server forwards pages and actions to Google Analytics 4. Your browser does not load the Google library. We do not send typed text, e-mail or account data. Advertising features stay off. Google processes this data in the United States.
• Asaas Gestão Financeira Instituição de Pagamentos S.A. processes payments in Brazilian reais (Pix, boleto and card), in Brazil. It receives the payer's name, CPF or CNPJ and e-mail. In the product's card forms, card and billing details pass through our API to Asaas, with the buyer's postal code, address number, phone and IP address. We do not store the card number or security code.
• Stripe processes card payments from outside Brazil, in US dollars, on Stripe's own page. There you type the e-mail, billing address and card details; from us, Stripe receives only the amount, the product and the charge code. Stripe processes this data in the United States.
• Coinbase Developer Platform (CDP) verifies and settles x402 payments on the Base network, in the United States. It receives the wallet address, amount, signed authorization and paid resource URL. The private key is not sent. The wallet address and transaction are public on the network.
• Interface libraries (Bootstrap) are served from the product's own domain, not from a third-party CDN.
• We do not sell personal data or share it for advertising.
• The audited page is fetched by our server the way a crawler would, as PageAuditBot; the site you audit sees that request coming from our server, not from you.
• The audited URL is sent to Google's Chrome UX Report API to read real-user speed data, and to Google PageSpeed Insights when you run a lab test.
• Requested editorial generation sends your business brief, sources and revision instructions to an artificial intelligence (AI) provider in the United States. Citation research sends the configured search queries to that provider's web search. Search Console tokens and collected results are not included in these requests.
• The AI search check sends the page address and the searches you choose to an AI search provider in China. It does not send your account, your e-mail or the page content.
• Google supplies the Search Console and Google Analytics account, property, stream and performance data that you choose to connect. Google receives the authenticated requests needed to read those services.
• When you approve draft delivery to WordPress, the selected article and the WordPress credential are sent to that website. Disconnecting stops new deliveries but does not delete drafts already created there.
• If the site owner configures Journeys delivery to Google Analytics, our server sends only the allowlisted action data and the random session ID to Google. The API secret stays encrypted on our server.
• Domain checks send the domain to its registration service and connect to the saved HTTPS address. DNS queries send known names and configured DKIM selectors to the resolver and relevant DNS servers. Alerts use your verified account e-mail and configured account webhook.
• The weekly site report fetches the pages of your sitemap as PageAuditBot. For each competitor you name, it reads only the sitemap, not the pages.

Cookies and browser storage

• When you sign in, the account session lives in an HttpOnly cookie on this domain; without an account, the guest token stays in your browser and identifies what you created.
• Screen preferences (theme, filters) stay in the browser's local storage and never leave it.
• To improve the path through the product, we measure page views, clicks on controls and purchase steps. We keep a random identifier and the session in your browser. These events contain no typed text, page content, IP, e-mail or account data. Global Privacy Control or "Do Not Track" disables this collection.
• Our Google Analytics integration does not set Google cookies in your browser.
• There is no advertising cookie and no cross-site tracking.
• The only cookies are the essential ones: the account cookies and the guest cookie. That is why we do not ask for cookie consent.

IP address

To limit abuse, the IP address goes into a hash with a secret salt. The approximate country and city come from a geolocation database (MaxMind GeoLite2) on our server. This lookup does not send the address to third parties. Card payments send the IP address to Asaas to validate the payment. The raw IP is kept in the record of each payment (Pix, card or x402) and in its notice to the controller, for audit and fraud prevention, for the retention period of payment records. Otherwise, it appears only in the contact e-mail and in the web server records, deleted within 15 days.

Your rights

The Brazilian data protection law (LGPD, Law 13,709/2018, article 18) gives you the right to confirm the processing and to access, correct, anonymize, block, delete or move your data to another provider, and to know with whom we share it. Where the GDPR applies, it also applies here. In your account, you download your data and close the account. Closing ends access; data deletion is requested by e-mail. For any request, write to eu@wendelmaques.com. We answer within 15 days. Data from public sources (official registries) stays at the source; only the copy here is removed. You can also complain to the Brazilian data protection authority (ANPD).

Data protection officer

The data protection officer (LGPD, article 41) is the management of WRP Consultoria e Informática Ltda. The contact is eu@wendelmaques.com.