Privacy Policy
Who we are
PerfoMetrix (perfometrix.com) is operated by NK Kurumsal Teknoloji Çözümleri San. ve Tic. Ltd. Şti., Esentepe Mah. Büyükdere Cad. No:199/6, Levent, Şişli, 34394 İstanbul, Türkiye (tax office Zincirlikuyu, tax number 6311026560) (“we”, “us”). We are the data controller for the personal data described here. Contact: hello@perfometrix.com.
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| The website address you submit and the scan results | Producing your report | Performance of the service | 7 days (free) or 90 days (Pro), then deleted |
| A one-way hash of your IP address, recalculated each day (HMAC-SHA256 with a secret key) | Enforcing daily scan limits and preventing abuse | Legitimate interest | The counter for one day; hashed scan records follow the report retention above |
| Account data: email address, sign-in provider, email-verified status | Your account, saved reports and monitors | Performance of contract | Until you delete your account |
| Subscription status (plan, renewal date, provider IDs). No card data. | Providing Pro features | Performance of contract | As long as needed for accounting and legal obligations |
| Monitor settings and alert history | Sending the alerts you asked for | Performance of contract | Until you delete the monitor or your account |
| Technical logs (request time, path, error codes). Query strings, cookies and tokens are removed. | Security and troubleshooting | Legitimate interest | Up to 30 days |
We do not store raw IP addresses, and we do not sell personal data.
The websites you scan
Our scanner performs passive checks only. It loads the page you submit and a short list of public
files (such as robots.txt), like a single visitor would. Reports are reachable only through their
random link and are excluded from search engines. Do not include personal data in the URLs you
submit.
Data about scanned websites. Reports include public information about the scanned site: IP geolocation from DB-IP’s database (run on our own servers), domain registration dates and registrar from the registries’ public RDAP services, the site’s rank in the Tranco list, and authority estimates from Open PageRank. These services receive only the scanned domain name, never information about you.
Cookies
| Cookie | Set by | Purpose |
|---|---|---|
__session |
PerfoMetrix | Keeps you signed in (only when you sign in) |
| Cloudflare Turnstile | Cloudflare | Bot protection on the scan and sign-up forms |
| Advertising and consent | Google AdSense / Google CMP | Ads for non-subscribers and your consent choice |
Visitors in the EEA, UK and Switzerland are asked for consent before personalised ads are shown. Pro subscribers see no ads, and no advertising script is loaded for them.
Service providers (processors)
We use these providers to run the service. Each receives only the data it needs:
- Google (Firebase Authentication, Firebase Remote Config): sign-in and configuration
- Google (PageSpeed Insights API, Web Risk API): receive the URL you submit, to measure performance and check reputation
- Google AdSense: advertising for non-subscribers
- Hetzner Online GmbH: application hosting and database (servers in Germany)
- Cloudflare: content delivery, security, bot protection and encrypted database backups (R2)
- Google Drive: a second copy of the encrypted database backups
- Paddle or Lemon Squeezy: payment processing as Merchant of Record (they handle your payment details and invoices under their own privacy policies)
- Resend: sending alert and account emails
Some providers process data outside your country, including in the United States. Where required, transfers rely on the safeguards the law requires, such as the European Commission’s Standard Contractual Clauses, adequacy decisions and, for transfers from Turkey, the standard contracts and notifications required by KVKK.
Your rights
Depending on where you live (for example under the GDPR or Turkey’s KVKK), you can ask to access, correct, delete or export your personal data, object to or restrict processing, and withdraw consent. Signed-in users can delete their account and data from the account page at any time. For any other request, email hello@perfometrix.com. You can also complain to your data protection authority.
Children
PerfoMetrix is not directed at children under 16, and we do not knowingly collect their data.
Changes
We will post changes on this page and update the date above. Significant changes will be announced on the site or by email to account holders.