Privacy notice

Who controls your data

WP Renewal Radar is the controller for personal data collected through this website. It is an early-stage product for WordPress freelancers and small agencies.

For a privacy question or to exercise your rights, use the contact form and choose the relevant privacy request type. Use the same email address you previously submitted where possible. We verify identity before disclosing, changing, or deleting personal data.

What data we collect

• Early-access details: your email address, and any optional name and client-site range or workflow challenge you provide, plus the consent time, consent method, and privacy notice version.
• Contact details: your email address, and any optional name and message you provide. If you make a privacy request, we also store its type and handling status.
• Submission context: the form source, campaign source, referring page, and browser user-agent associated with a submission.
• Security data: your network address may be used briefly to limit abusive form submissions. Routine server logs may also contain request information needed to operate and secure the website.
• Optional analytics: if you allow analytics, Google Analytics may process page views, downloads, form-completion events, referrals, device/browser information, and online identifiers. We do not intentionally send your name, email address, or message to Google Analytics.

You can download the free spreadsheet without providing an email address.

Why we use the data

Who receives the data

Access is limited to the following recipients. Each receives only the data needed for its role:

• Authorised WP Renewal Radar administrators can access the stored early-access and contact records: email address, optional name, optional client-site range, optional workflow challenge or message, form type and source, campaign source, referring page, browser user-agent, submission timestamps, legal basis, notice version, retention deadline, and any privacy-request type and status. They use this data to manage the early-access list, respond to messages, and handle privacy requests.
• DigitalOcean (application hosting in Frankfurt, Germany)processes the visitor's network address and the web request needed to deliver and secure the site. Request information can include the requested page, date and time, response status, referrer, and browser user-agent. When a form is submitted, its contents pass through the DigitalOcean-hosted application for validation before being sent to the database. Lead records are not intentionally stored in a local application database on DigitalOcean.
• Neon (managed PostgreSQL database)stores the early-access or contact record: email address, optional name, optional client-site range or message, optional workflow challenge, form type and source, campaign source, referring page, browser user-agent, and submission timestamps. It also stores the legal basis, privacy-notice version, retention deadline, consent evidence where applicable, and privacy-request type and status where applicable. The application does not add the visitor's network address to the Neon lead record.
• Google Analytics receives data only after you allow optional analytics. This can include the page URL and title, referrer or campaign source, page-view and session information, spreadsheet-download and form-completion events, the type and source of the completed form, browser and device information, language, screen size, a pseudonymous client identifier, and approximate location. Google uses the network address at collection time to derive approximate location and says it is discarded before the address is logged. We do not send the submitted name, email address, message, client-site range, or workflow challenge to Google Analytics.

We do not sell or rent personal data, and we do not share form contents with Google Analytics.

DigitalOcean, Neon, and Google may use documented subprocessors to provide their services. A subprocessor may handle the same limited data described above on its provider's behalf. Their published data-processing terms cover transfers outside the European Economic Area using applicable safeguards, including the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses where relevant. You can review the published DigitalOcean Data Processing Agreement, Neon Data Processing Addendum, and Google Ads Data Processing Terms.

How long we keep the data

• Early-access details are scheduled for review or deletion 24 months after signup. They are deleted earlier after a verified withdrawal request unless a limited legal reason requires retention.
• Ordinary contact messages are scheduled for review or deletion 12 months after submission.
• Privacy-request records are kept for 36 months so we can demonstrate how the request was handled.
• Submission context is kept with the related lead or message for the same period.
• The application's form rate-limit data is held temporarily, normally for about one minute. Routine server logs are kept for a limited operational and security period.
• Google Analytics event-level data is retained for no longer than 14 months under the Analytics property's retention setting. Aggregated reports may remain available for longer.

Data may be deleted earlier when it is no longer needed or when a valid deletion request applies.

Analytics choices

Google Analytics does not load until you choose “Allow analytics.” Advertising storage, ad personalisation, and Google Signals are disabled. Your choice is saved in your browser's local storage so the website can remember it.

You can change or withdraw your choice at any time using the “Analytics settings” button shown on the website. Declining analytics does not prevent you from using the website or downloading the spreadsheet.

Your rights

Depending on the circumstances, you can ask us to:

• provide access to the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to processing; or
• provide data you supplied in a portable format.

You may withdraw consent at any time without affecting processing that took place before withdrawal. You may also lodge a complaint with the data-protection supervisory authority where you live, work, or believe an infringement occurred.

To make a request, use the contact form. We may need to confirm your identity before disclosing or deleting data. Choose “Withdraw early-access consent” for removal from the early-access list or “Delete my data” for erasure. We record the request as pending, verify it, complete it through the restricted administration area, and record the outcome.

How we protect the data

The website uses HTTPS, restricted administrative access, input validation, request origin checks, rate limiting, and security headers. No online system can be guaranteed completely secure, but access and safeguards are kept proportionate to the limited data collected at this validation stage.

Changes to this notice

This notice may be updated when the product, providers, or data practices change. The effective date at the top will be updated when a material change is published.