Privacy

Who is responsible

Albert Garcia Pujadas, tax ID ES43681066H, c/ Josep Carner, 11, 08173 Sant Cugat del Vallès, Spain.

For anything about your data, write to us through the contact form.

What we keep, why and on what basis

When you analyze a site, we keep what we read of it: the content of the pages, screenshots and the measurements we take. We keep it so we can show you where every sentence in the report comes from. Basis: providing the service you ask for.

Those pages may contain data about other people, such as a name or an email address published on the site. We use it only for that report, and it is deleted with it.

If you create an account, we process your email address to keep the account and your reports. Basis: the service you ask for when you create it.

If you create an account right after a measurement, we keep a fingerprint of your email, not the email itself, for up to 48 hours, so we can add that measurement to your account when you sign in. The fingerprint is deleted when it is used or when it expires.

If you subscribe to Monitoring, payment is handled by our payment provider, which acts as the merchant of record. It processes your payment details; we don’t see or store them. We only receive the notice that the charge went through.

If you leave us an email address so we can notify you, we use it only for that. Basis: your consent.

If you write to us through the form, we keep your email address and your message so we can reply. Basis: your consent when you write to us.

We count visits to the public pages: how many each page gets per day and where they come from (the referring site or the link's tag). In this count of visits we also note whether the visit came from a Google ad (only yes or no, without the ad identifier) and whether it is from a phone or a computer. We also count, without identifying anyone, how often people go from one of our pages to another. For each analysis we also keep where it was started from. In this count we do not keep your IP address, your browser or the exact time. Basis: our legitimate interest in knowing whether the service is used and where people come from.

If you arrive from a link with a campaign tag, we keep that tag with your analysis, and with your account if you create one. Basis: our legitimate interest in knowing which campaigns work.

If you accept ad measurement, we also keep the click identifier Google adds. Basis: your consent.

If you accept measurement with Google, we load Google Analytics, Google Ads or both, depending on what you choose. We do not turn on ad personalization or Google Signals, and we do not do remarketing. Basis: your consent.

We keep your answer to the cookie notice so we can show what you chose. Basis: complying with the law.

We do not sell your data.

For how long

Reports without an account: they stop being accessible after 30 days. The link stops working and no one can open it again. If you have not deleted it before, we delete its content 90 days after it stops being accessible.

Reports with an account: for as long as you have the account, or until you delete them. You can delete your account from your dashboard, or ask us to, and we delete it along with its reports.

You can delete any report whenever you want, from the report itself: that deletes its content.

The click identifier is deleted with the report. The campaign tag is kept with the report and, if you create an account, with your account for as long as you have it.

The email address for notifying you: until we write to you. Then we delete it.

If you tick the reminders box, we keep your address longer, as explained below.

If you tick the reminders box when you request a review, we keep your email to send you at most two messages about that report: one after 7 days and one after 27. We delete it when the second one is sent, when you unsubscribe or after 30 days, whichever comes first. If you create an account before then, we send none of the pending ones. If you do not tick the box, we only let you know when the review is ready and then delete the address. The emails are sent by Postmark on our behalf.

Messages from the form: 1 year.

Your answer to the cookie notice: 2 years.

The service's backups may keep data that has already been deleted for up to 28 days, until they are replaced.

Who sees it

We do, so the product works and so we know how many visits it gets and where they come from. If you accept measurement with Google, so does Google. If you do not accept it, Google only receives anonymous counts of some actions, with nothing that identifies you. We do not use what we analyze on one site to improve what we say to another.

Who we work with

Railway, which hosts the service and stores what we keep from the sites we analyze. Its servers are in Amsterdam (Netherlands).

Supabase, which handles accounts and sends the sign-in emails. If you create an account, your email address lives there and also here, with your account. Your password is kept there, encrypted: it passes through our server when you sign in, but we do not store it. Its servers are in Ireland.

Google and GitHub, only if you sign in with them: they confirm who you are so we can open your account.

Google (Analytics and Ads). If you accept measurement, it counts visits to the public pages and tells us which ads bring people who request an analysis. If you accept, we also tell it from our server when you request an analysis, create your account, connect an agent or open a report or your UX Memory, without their content. If you do not accept, we only tell it anonymously when an analysis is requested, from the website or from an agent: the details of the analysis (language, goal and the agent's tool, if any) and the campaign you came from, if any. We send it from our server, without your IP address, without cookies and without anything that identifies you. We do not send it your email, the site you analyse or the link to your report.

If you accepted measurement when you connected an agent, we keep with that connection the identifier Google Analytics set in your browser, so the measurements your agent requests count as yours. It is deleted when you remove its access or delete your account. If you did not accept it, those measurements are counted anonymously: we send them from our server, without your IP address, without cookies and without anything that identifies you.

If you accept measurement, with those notices we also send the country you connect from. We work it out on our server from your IP address, without keeping or sending it. When you connect an agent, we keep that country with the connection, and it is deleted with it or with your account. To work it out we use IP Geolocation by DB-IP.

Postmark, which sends the emails that tell you your report is ready or that we could not finish it, and delivers to us the messages from the contact form. For the notices, it receives your email address, the site analyzed and the link to your report, or the address you asked us to analyze if we could not finish it. For contact messages, it receives what you write in the form, the time and the page of our site you write from. It processes the data in the United States.

Our payment provider, only if you subscribe to Monitoring. It acts as the merchant of record and processes your payment details on its own behalf.

Supabase and Postmark keep their own access and delivery logs, for as long as they decide. We do not control them, and they are not deleted when we delete your data.

Apart from these providers, no one else processes your data, unless the law requires it.

Outside the European Union

Railway, Supabase, Google, GitHub and Postmark are United States companies. Railway and Supabase keep your data in the European Union. Google, GitHub and Postmark may process it in the United States. When a provider processes data outside the European Union, it does so with the safeguards the GDPR provides for: the EU-U.S. Data Privacy Framework, if it takes part in it, or standard contractual clauses.

The payment provider may process data outside the European Union. We will name it here, with its safeguards, before we open payments.

Cookies

We always set these, because the service does not work without them:

• ses: your session when you request an analysis without an account. It tells us the report is yours. It lasts until you close your browser.
• acceso and refresco: your session when you sign in to your account, for 30 days.
• pkce, prov and idioma: only while you sign in with Google or GitHub, for 10 minutes.
• uxm_consent: your answer to this notice, for 1 year, so we do not ask you on every page.

These, only if you accept visit measurement:

• _ga and _ga_*: Google Analytics, for 13 months.

These, only if you accept ad measurement:

• uxm_at: the campaign and the click you came with, for 30 days, so we can link them to the analysis you request even if you visit other pages first.

And this one, if you accept either:

• uxm_ev: a few minutes, so we do not count the same analysis or sign-up twice.

You can change your answer at any time, right here or from «Cookie settings» in the footer of the public pages:

If you connect an agent

We keep the authorization you gave: which tool, when, and the permission to measure with your account, until you remove it.

We keep the addresses it asks us to measure and their results, like any other analysis.

We also keep a log of your agent's calls to UXMachine: which agent and which tool it used, when, in which work session and on which site (only when measuring or reading the memory), without your IP. It is used to apply usage limits and to understand how the service is used. We delete it after 90 days, or earlier if you delete your account.

If you measure your local version, the measurement goes through a temporary tunnel that your tool opens.

Who else is involved: Railway, which hosts the service; Supabase, which handles accounts and agent authorization; and Cloudflare, which carries the tunnel to your local version.

We also count the measurements your agent requests in Google Analytics, as explained on this page.

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, to object to its processing or for a copy to take with you. If you gave us your consent, you can withdraw it at any time; that does not affect what we did before.

Write to us through the contact form and we will do it, unless the law requires us to keep something; in that case we will tell you what and why. You do not have to explain why you are asking.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).