Privacy Policy

• For account, billing, website, and support data, Clarivo is the controller (in Brazil, controlador; in Mexico, responsable).
• For personal data that may appear inside the sites you ask us to scan (for example, a URL that contains a name), you are the controller and Clarivo processes it on your behalf. If you need a Data Processing Agreement for that processing, contact legal@sitewarm.dev.
• Privacy contact: privacy@sitewarm.dev.
• We have not designated a data protection officer (or LGPD encarregado), an EU representative (GDPR Art. 27), or a UK representative (UK GDPR Art. 27). Privacy requests from any country go to privacy@sitewarm.dev.

What scan history never stores: the values of cookie or Authorization headers. Our workers and servers write operational logs that can include the URLs being scanned, so do not put personal data, secrets, or one-time tokens in URLs you submit.

We do not knowingly collect sensitive data (special categories under GDPR, sensitive personal information under CPRA, dados sensíveis under LGPD, or datos sensibles under LFPDPPP).

We do not use your data for automated decisions that have legal or similarly significant effects on you. Trial and refund eligibility checks are rule-based (has this site, domain or card already used it?); you can ask a person to review a refusal at the support address.

We do not sell personal data and do not share it for cross-context behavioral advertising (as those terms are defined in the CCPA/CPRA).

We share personal data only with service providers (subprocessors) that process it for us under contract. We currently use 4 subprocessors. The data each one handles, and where, is on the sub-processors page.

If you sign in with GitHub or Google, the provider sends Clerk your name, avatar, verified email address and provider user id, and Clerk creates or signs in your sitewarm account. Signing in with GitHub or Google is optional. We request only profile and email scopes and do not receive access to your repositories or other provider data. Each provider handles your account under its own privacy statement.

The services below are planned. None of them processes any data today, and we will update the list and the count above before any of them starts.

• Product analytics: PostHog, Inc.
• Customer support chat: Atlas
• Welcome and account emails: Loops
• Browser error reports: Sentry (Functional Software, Inc.)
• Regional measurement servers: Cloud provider under evaluation

If you configure Slack or a webhook, we send scan results to the destination you chose; that recipient's own privacy terms apply. We may also disclose data when the law requires it, to protect rights and safety, or in a merger or acquisition, subject to this policy.

Clarivo is based in the United States and your account, billing and scan-history data is stored in the United States (the list of sub-processors gives the location of each provider). If you use the Service from another country, you understand that your data is transferred to and processed in the United States. You can ask the privacy contact about the safeguards that apply to your transfer.

• Account and scan data: while your account exists, and for the history window of your plan. After the account is closed we delete it, except what the law requires us to keep.
• Backups: deleted data can remain in backups for up to 30 days after deletion, then it is overwritten.
• Billing and tax records: for as long as tax and accounting law requires.
• Trial and refund records (sites, root domains, card fingerprints): kept to enforce one trial and one refund per site, domain and card, for as long as that rule applies.
• Technical logs: for as long as needed for security and debugging.

We use encryption in transit (all of sitewarm.dev is HTTPS-only). Card data is entered on Stripe's pages and never touches our servers. The controls in place today are described on the security page. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

You can exercise any right below by emailing privacy@sitewarm.dev. We will verify your identity before acting, and we will answer within the time the applicable law sets. We will not discriminate against you for exercising your rights. Some data (for example, billing records we must keep for tax law) may be exempt.

EEA and UK (GDPR and UK GDPR)

You have the right to: access your data; correct it; erase it; restrict its processing; receive it in a portable format; object to processing based on legitimate interests (including, at any time, to direct marketing); and withdraw consent at any time without affecting earlier processing. You may complain to your local data protection authority, or in the UK to the Information Commissioner's Office (ICO).

California (CCPA as amended by the CPRA)

If you are a California resident, you have the right to:

• know what personal information we collect, use, and disclose, including the categories and the specific pieces;
• delete it;
• correct it;
• opt out of sale or sharing: we do not sell or share personal information;
• limit the use of sensitive personal information: we do not use it for purposes that require this right; and
• not be discriminated against for exercising these rights.

You may use an authorized agent. Clarivo is currently below the CCPA applicability thresholds; we publish this notice anyway and honor these rights.

Your Privacy Choices

• No sale or sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
• Cookies. We set only strictly necessary cookies today, so there is no cookie choice to make; see the Cookie Policy.
• Requests. To know, delete, or correct your data, email privacy@sitewarm.dev. We verify the request by asking you to confirm it from the email address on your account.

Brazil (LGPD)

Under LGPD Art. 18 you have the right to: confirmation that we process your data; access; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data or data processed against the law; portability; deletion of data processed with your consent; information about the entities we share data with; information about the possibility of refusing consent and its consequences; and revocation of consent. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Mexico (LFPDPPP)

You have the ARCO rights: Access, Rectification, Cancellation, and Opposition, and you may revoke your consent and limit the use or disclosure of your data. Send your request to privacy@sitewarm.dev with your name, a way to reply, a document proving your identity (or your representative's authority), a clear description of the data and the right you want to exercise, and anything that helps us find the data. We will answer within the deadlines set by the law.

Other places

Wherever you live, you can ask us for access to or deletion of your data, and we will honor the request where we reasonably can.

See the Cookie Policy. We set only strictly necessary cookies today. If we ever add a non-essential cookie, we will ask for your consent first.

The Service is for businesses and professionals and is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child gave us data, contact us and we will delete it.

We will post any change here with a new effective date, and email account owners about material changes before they take effect.

• Privacy: privacy@sitewarm.dev
• Support: support@sitewarm.dev
• Address for notices: Clarivo, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713