Information we collect

Account information — your name and email address, and organization details, handled through our authentication provider when you sign up.

Sites and verification data — the sites you connect, your monitor configuration, and the results of the monitors we run: pass/fail status, timings, error messages, and screenshots or page-structure snapshots captured during a run. For monitors you enable on a WordPress or WooCommerce site, our plugin also reports your installed plugin and theme names and versions and store settings (for example checkout type and currency) — only for the monitors you turn on. If you put a site in quarantine mode, for the length of the quarantine the plugin also reports the paths, sizes and modification dates of files in the places malware returns to (never their contents), WordPress usernames and roles, an administrator's email domain (never the full address), the names of scheduled tasks, and a few settings such as the site address. If you enable the PHP errors & unsent emails monitor, the plugin also reports PHP fatal error messages (with server paths shortened and email addresses removed), the page path (without its query string) and kind of request where each happened, and, for emails WordPress failed to send, the plugin and hook that sent them and the recipients' email domains, never the subject, body or full addresses. The plugin (1.41.0 and later) also reports an activity log, which Relvato keeps outside your site: sign-ins of administrators and editors (their WordPress username, role and the network the sign-in came from, meaning the IP address cut down to its /24 or /48 range, never the full address), failed sign-ins (counted, never the usernames tried), changes to plugins, themes, roles and key settings (the administration email shown by its domain only), code-editor saves and application passwords (their name, never the password). It is kept for 7 days on Free, 30 on Pro, 90 on Business and a year on Agency, then deleted. If you turn on the plugin's Outside services map (1.50.0 and later; off until you do), the plugin also reports which outside services each of your plugins and themes contacts from your server: the plugin's or theme's folder name and the host name it called (never the full address, what was sent or what came back), with the day each was first and last seen; switching it off deletes the list from your site. Relvato never handles a real customer's password: authenticated monitors use a dedicated verification user whose credential is short-lived and rotated by the plugin.

Real-user performance data — if you enable the Real-user Web Vitals (RUM) beacon, we collect anonymous, cookieless performance timings from your site's visitors (such as loading and responsiveness metrics), grouped by page type and device. For slow or unstable page views only, the beacon also records a short description of what was involved — a CSS selector of the element (for example, button.add-to-cart) and the address of the image or script (without query strings, with long identifiers masked) — so you can see what to fix. This data carries no page URLs and no personal data, and may be sampled (the WordPress plugin sends roughly 15% of page views).

Client reports and status pages — if you send monthly client reports, the email addresses you enter for them, used only to send those reports; you choose who receives them. If you set a reply-to address, it goes on those reports so your clients’ replies reach you. A status page you publish shows the names and addresses of the sites you pick, their uptime and response times, and the incident updates you post, to anyone with its link. If you let visitors subscribe to a status page's updates, the email addresses they enter there: an address is used only after its owner confirms it through the link we email to it, only to send that page's incident updates on your behalf, and it is deleted when its owner unsubscribes (a link in every email) or when you delete the page. You see how many people subscribed, never their addresses.

Payment information — if you subscribe to a paid plan, payments are processed by our payment provider. We do not store your full card details.

Slack connection details — if you connect Slack to receive alerts, the details described under “Slack integration” below.

Search engine data — if you connect Google Search Console or Bing Webmaster Tools to a site, the details described under “Google Search Console and Bing Webmaster Tools” below.

Messages you send us — if you use the contact form on our website, your name, email address, the topic and subject you choose, your message, and the address of the page you sent it from. If you join a waitlist (for example, to hear when Shopify support is available), your email address. These are not stored in the Relvato service: our email provider delivers them to our inbox. To keep out spam, both forms use Cloudflare Turnstile, which checks your browser and IP address to tell people from automated bots.

Free website checkers — if you use one of the free checkers on our website (the WebMCP, legal pages, cookie consent and accessibility checkers), no account is needed. We process the address of the page you enter and the result of the test, kept for 24 hours and shown to anyone who tests the same address in that time, and your IP address, used only to count your tests against the checkers' limits and kept for at most 24 hours. Neither is linked to an account or used for anything else.

Usage and technical data — logs, IP address, browser and device information, collected to operate and secure the Service.

How we use information

To provide and operate the Service — run your monitors, show results, and send alerts when something fails.

To manage your account and process billing.

To answer messages you send us, and to tell you when a feature you joined a waitlist for is available.

To secure the Service, prevent abuse, and debug problems.

To improve the Service and develop new features.

To communicate with you about the Service, including important service or security notices.

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on these legal bases: performance of our contract with you; our legitimate interests in operating, securing and improving the Service; your consent (where required, for example optional communications); and compliance with legal obligations.

Sharing and sub-processors

We do not sell your personal data. We share it with third-party service providers (“sub-processors”) who help us run the Service — hosting, storage, authentication, payments, email delivery, analytics, error monitoring, and AI features. Our current sub-processors, their purpose and their data location are listed at /trust, which we keep up to date.

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a merger or acquisition (with notice where required).

Unsafe-site lookups (Google Web Risk)

The Signs of a hack monitor asks Google’s Web Risk service whether Google lists a monitored site’s home page and a few of its pages as unsafe (malware, phishing or unwanted software). Only those public page addresses are sent, never personal data, and Google answers whether each is listed. Google is listed as a sub-processor for this at /trust. Google’s list isn’t perfect: some unsafe sites aren’t on it, and a safe site can be listed in error.

Google Search Console and Bing Webmaster Tools

If you connect Google Search Console or Bing Webmaster Tools to a site (for the Google Search and Bing Search monitors, or to prove you own the site; available on every plan), you sign in on Google’s or Microsoft’s own screen and choose which of your properties is that site. We ask for read-only access only: from Google, the webmasters.readonly permission; from Bing, webmaster.read. Neither lets us change anything in your accounts, submit or remove URLs, or add or remove users.

What we keep: a refresh token that lets us read the data once a day, stored encrypted with keys managed in AWS KMS; the name of the property or site you chose and when you connected it; and daily totals for that site — clicks, impressions and average position by search type (for example web, image or Discover), device and country (the ten largest); the number of pages that appeared in search results over each week; from Bing, the number of pages in its index and its daily crawl counts (pages crawled, errors by kind, pages blocked by robots.txt, and pages it flagged as containing malware); and the address of each submitted sitemap with its URL, error and warning counts. With Google’s URL Inspection tool we also check up to 50 of your site’s pages each run — the home page, the shop, category and product pages found during setup, and your most-clicked pages — and keep each page’s address with its last two results: whether it’s indexed and why not, whether robots.txt or a noindex blocks it, whether Google could fetch it, the canonical address Google chose, when it was last crawled, and which rich results it has. Each run’s results also name the pages and search queries that lost the most ground (at most the 50 most-searched of each), and, from Bing, the addresses of pages it had trouble crawling. Search queries are the words people typed into Google to find your site; we keep only these most frequent ones, only inside the run’s results, and only for as long as your plan keeps run history (7 days to a year). If the Signs of a hack monitor is on and Google Search Console is connected, it also reads the site’s most frequent search queries and pages from Google (up to 1,000 of each, over the last week) to look for spam a hack added, and keeps only the ones that look like spam, inside that run’s results.

How we use it: only to show you your own site’s search performance, detect drops against the site’s own history, tell you what changed on the site around a drop, and alert you through the channels you set up — and, if you choose to verify a site this way, to confirm that the connected account owns it: we read the list of properties or sites the account can access and its permission on each, when you verify and about once a month after that, and keep only which method proved ownership and when. We don’t use it for advertising, don’t sell it, don’t use it to train AI models, and don’t combine it with other customers’ data. If you ask Relvato AI to suggest a fix for one of these monitors, the monitor’s findings are sent to our AI provider to write the suggestion, and to nothing else. People at Relvato look at it only with your permission, when needed for security or to comply with the law. Relvato’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google and Microsoft are the sources of this data, at your direction; they are not our sub-processors. The data is stored with the rest of your run results (see “Where your data is processed”) and kept for 16 months, the same as Google’s own history.

When it ends: if you disconnect an engine in the site’s Settings → Search engines, we revoke our access at Google, and delete the token and every number we read from that engine. Bing has no way for us to revoke access ourselves, so to remove it at Microsoft too, remove Relvato under Bing Webmaster Tools → Settings → API access. You can also revoke Google’s access at any time from your Google Account’s security settings; our next read then fails and the monitor tells you so.

Slack integration

If you connect Slack to receive alerts (available on the Business and Agency plans), you choose a channel on Slack’s own authorization screen, and Relvato receives a webhook address that lets it post to that one channel. We ask Slack for a single permission, incoming-webhook. It lets us post messages to the channel you picked and nothing else: we cannot read messages in that or any other channel, see your list of channels, or access your workspace’s members or their profiles.

What we keep: the webhook address, the ID and name of your Slack workspace, and the name of the channel — so that we can post your alerts, show you where they go, and recognize your workspace if you remove our app. Slack also issues an access token when you connect; we discard it immediately and never store it. The webhook address works like a password, so we never display it back to you in the dashboard. If you paste a webhook address instead of connecting through Slack, we keep that address and any label you give it.

What we send to Slack: when a monitor finds a problem, a message naming the site and the monitor, the error it found, its severity, what triggered the run (for example a plugin update or a deploy), and a link to the run in Relvato — and, if you have asked to be alerted on every run, a short note when a monitor passes. Screenshots stay in Relvato and are reached through that link. Messages we post become part of your Slack workspace and are governed by your agreement with Slack, not by this Policy. Slack is not one of our sub-processors for this, because the messages go to your own workspace at your direction.

When it ends: if you disconnect Slack in Alert settings, we delete the webhook address, your workspace details and the channel name. If you remove Relvato from your Slack workspace, or the webhook stops working for good (for example because the channel was archived), we delete the webhook address and workspace ID straight away, and keep only the channel name and the reason it stopped, so that we can tell you your Slack alerts have stopped — until you reconnect or disconnect Slack yourself. When Slack notifies us that our app was removed, the notice includes your workspace ID, which we use to find and delete the connection.

Webhook alerts

If you add a webhook in Alert settings (available on the Pro plan and up), Relvato sends your alerts to the web address you enter, as a signed request, so that you can pass them on to your own tools. The address must use https and belong to the public internet.

What we keep: the webhook address, a signing secret we create for you (stored encrypted), and a count of recent failed deliveries with the reason for the last one — so that we can deliver, prove each request came from us, and pause a webhook that keeps failing. The address can contain a token, so we never display it back to you in full.

What we send: when a monitor finds a problem (and, if you asked for it, on every run), the site's name and address, the monitor and its severity, the error it found, what triggered the run, and a link to the run in Relvato; Quarantine mode also sends a summary of what changed. Where the data goes after that is your choice and under your control — the receiving service is not our sub-processor.

When it ends: if you remove the webhook in Alert settings, we delete the address and the signing secret.

AI assistants, the API and the MCP server

You can connect an AI assistant (for example Claude, ChatGPT, VS Code or Cursor) to Relvato’s MCP server, or call the REST API from your own tools, by signing in to Relvato or with an API key you create under API access. You choose what to connect and what it may do: read your sites and results and, if you allow it, add and configure sites and monitors, run them, review results (only in ways that can be undone) and, on WordPress, apply the fix a run proposes or update a vulnerable plugin with automatic undo. Deleting data, secrets, API keys, who receives your alerts and billing can’t be done this way.

When you sign in, our authentication provider issues the assistant an access token for your account, or for the organization workspace you pick, which is renewed while the connection stays in use. The assistant never sees your password. The token works only for Relvato, and only within your plan’s limits.

What the assistant receives: the results of the requests it makes for you, such as your sites’ names and addresses, run results, errors, fix briefs, performance data and, for a WordPress site, its activity log (your site users’ usernames and the network their sign-ins came from, never full IP addresses). The assistant’s provider handles that data under its own terms and privacy policy; it acts at your direction and is not our sub-processor.

What we keep about a connected assistant: which assistant it is (the name and return address it registered), who in your account connected it, whether it can make changes, and when it was first and last used — so you can see it under MCP connector → Connected assistants and disconnect it. We never store its sign-in tokens. The record is kept like the rest of your account settings (see how long we keep data, below).

When it ends: remove the connector in your assistant, or revoke the API key under API access. A signed-in connection to an organization workspace stops working when you leave that organization.

Where your data is processed

Relvato runs its compute in the European Union, while some data is stored in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. See the data-location details for each provider on our sub-processors page.

Data retention

We keep account and configuration data for as long as your account is active and as needed to provide the Service. Run artifacts such as per-run screenshots are pruned over time. Real-user performance data from the optional Web Vitals beacon is kept only as daily aggregates and deleted after 97 days. Numbers read from Google Search Console and Bing Webmaster Tools are kept as daily totals for 16 months, page-inspection results until you disconnect, and the pages and queries named in a run for as long as that run is kept; all of it is deleted as soon as you disconnect that engine. Status page subscribers' email addresses are kept until they unsubscribe or the page is deleted; an address that is never confirmed is never emailed again after its confirmation link. Results of the free website checkers, and the IP addresses counted against their limits, are deleted after at most 24 hours. Messages you send through our contact form, and waitlist sign-ups, are kept in our inbox only as long as needed to answer you or, for a waitlist, until we have told you the feature is available; you can ask us to delete them at any time. We may retain limited data as required for legal, accounting or security purposes. You can ask us to delete your data as described below. The activity log is kept for 7 days on Free, 30 days on Pro, 90 days on Business and a year on Agency, then deleted.

Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. If you are in California, you have rights under the CCPA/CPRA, including to know and to delete, and we do not sell or share personal data as those terms are defined there.

To exercise any right, send a request through the form at relvato.com/contact (topic "Privacy request"), or email us at contact@relvato.com. We will respond within the timeframe required by applicable law. You may also lodge a complaint with your local data protection authority.

Security

We use technical and organizational measures to protect personal data, including encryption in transit and at rest, managed encryption keys, access controls, and the principle of least privilege. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to incidents.

Cookies

On our marketing website, with your consent, we use Google Analytics — which sets cookies — to measure traffic and understand how visitors use the site. When you first visit, a banner lets you accept or decline; unless you accept, no analytics cookies are set and only anonymous, cookieless measurement is used. You can withdraw consent at any time by clearing this site's data in your browser, which brings the banner back.

In the Relvato dashboard we use only the cookies necessary to run the app, such as keeping you signed in. The optional Real-user Web Vitals beacon is cookieless and stores nothing on your visitors' devices.

Children

The Service is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children.

Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and update the effective date; material changes will be communicated where appropriate.

Contact

Relvato SRL is the controller of the personal data described here. For any privacy question or request, contact us at contact@relvato.com.

Privacy Policy