Who we are
The controller responsible for personal data processed through this website and the SiteRefactor service is GACODE Adrian Wolf, Wrocław, Poland ("we", "us"). SiteRefactor is run by Adrian Wolf. You can contact us about anything in this policy at biuro@gacode.pl.
We are not required to appoint a data protection officer and have not done so. Privacy questions go to the address above.
Data we process
Websites you submit for analysis
You can analyze a website without creating an account. We store the URL you submit and the results of the analysis, which are derived from publicly available information about that website: detected technologies, performance results, SEO basics, page structure and a screenshot of the homepage. These results are usually not personal data, but a screenshot or page metadata can incidentally contain names or other details that the website itself publishes.
Analysis reports are accessible to anyone who has their unguessable link and are excluded from search engines. Please share report links only with people you want to see them.
Quote and DIY-plan requests
When you request a professional quote or a DIY plan, we collect the information you enter in the form:
- name and email address;
- company (optional) and website URL;
- selected migration strategy, budget range, timeline, goal and preferred technology;
- any free-text notes you add;
- the time at which you gave consent.
Please do not include sensitive information, such as health data or passwords, in free-text notes. These requests are stored in our database and are visible only to authenticated administrators.
Usage analytics
We use first-party, cookieless analytics. For each event we store only the event name, the page path and, where relevant, the analysis ID. We do not store IP addresses or user agents in analytics, we do not set analytics cookies, and we do not record analytics events when your browser sends a Do Not Track or Global Privacy Control signal.
Security and abuse prevention
To limit abuse of the analyzer and our forms, we apply rate limits. For this purpose a salted hash of your IP address is held temporarily in a cache (Redis) and expires automatically, at the latest after about 24 hours. Raw IP addresses are not stored in our database, and we do not keep web server access logs for this service. Application error logs do not contain IP addresses or the contents of forms, and they are rotated automatically.
Communications
If you email us, we process your email address, the content of your message and our reply in order to respond to you.
Purposes and legal bases
Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Running website analyses you request and showing the report | Performance of the service you requested (Art. 6(1)(b)) and our legitimate interest in providing the analyzer (Art. 6(1)(f)) |
| Handling quote and DIY-plan requests and replying to you | Steps taken at your request before entering into a contract (Art. 6(1)(b)) and, where we ask for it, your consent (Art. 6(1)(a)) |
| Cookieless usage analytics to improve the service | Legitimate interest in understanding how the service is used, with minimal data (Art. 6(1)(f)) |
| Rate limiting, security and abuse prevention | Legitimate interest in protecting the service and the websites it analyzes (Art. 6(1)(f)) |
| Complying with legal obligations, such as record-keeping | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.
Cookies and analytics
The public website does not use advertising, tracking or analytics cookies. The only cookie we set is a strictly necessary, HttpOnly session cookie for administrators who sign in to the admin area.
Optional AI explanations
If AI explanations are enabled, we send only derived analysis facts to the configured AI provider (for example Anthropic): technology names, scores, finding titles, estimate ranges and the hostname of the analyzed website. We do not send personal data, contact details from quote requests, or raw page content. Cost estimates themselves are calculated with deterministic formulas, not by an AI model.
Recipients and processors
We share personal data only as needed to run the service, with:
- OVHcloud, which hosts our servers and database in a data centre in the United Kingdom;
- Resend, Inc. (United States), our email delivery provider, which processes the recipient address and content of the emails we send you;
- Google, when we request a PageSpeed Insights test: the URL of the analyzed website is sent to Google's PageSpeed Insights service, which fetches that page using Google's own infrastructure;
- the configured AI provider, limited to the derived, non-personal facts described above, if AI explanations are enabled;
- Calendly, if you choose to book a call through the scheduling link on our website. Calendly processes the details you enter there under its own privacy policy;
- authorities or advisers where required by law or to establish, exercise or defend legal claims.
Quote and DIY-plan requests are read by Adrian Wolf and, where a project needs it, by members of the GACODE team who are bound by confidentiality. We do not pass your request to other companies without your permission. Service providers acting on our behalf process data under data processing agreements and only on our instructions.
International transfers
Our servers are located in the United Kingdom, which the European Commission recognises as providing an adequate level of data protection. Our email provider, Resend, is based in the United States. Where personal data is transferred outside the European Economic Area or the United Kingdom, we rely on an adequacy decision or on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum. You can ask us for information about these safeguards at any time.
Retention
Unless a legal obligation requires longer storage, our default retention periods are:
| Data | Default retention |
|---|---|
| Website analyses and reports | 90 days |
| Quote and DIY-plan requests | 730 days (about two years) |
| Cookieless analytics events | 395 days (about 13 months) |
| Hashed IP addresses for rate limiting | Automatically expire, at the latest after about 24 hours |
These periods are configurable and data is deleted automatically when they end. You can ask us to delete your data earlier at any time (see your rights below).
Security
We use encrypted connections (HTTPS), restrict access to quote requests to authenticated administrators, avoid storing raw IP addresses, and collect only the data we need. No system is completely secure, and we will notify affected people and authorities of personal data breaches where the law requires it.
Your rights (EU and UK)
If the GDPR or the UK GDPR applies to you, you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data in the cases provided by law;
- restriction of processing in certain circumstances;
- data portability for data you provided to us, processed on the basis of consent or contract;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. Our lead supervisory authority is the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). In the UK, it is the Information Commissioner's Office (ICO).
To exercise your rights, email biuro@gacode.pl. We may need to verify your identity, and we will respond within the time limits set by law, normally one month.
California and other US state privacy rights
If you live in California or another US state with a comprehensive privacy law, and that law applies to our processing of your data, the following also applies:
- Categories collected in the last 12 months: identifiers (name, email address); professional information (company); commercial information you provide about your project (budget range, timeline, goals, preferred technology); and limited internet activity information (cookieless analytics events). Sources: you, and publicly available information about websites you submit.
- Purposes: providing the analyzer, responding to your requests, securing the service and improving it, as described above.
- No sale or sharing: we do not sell personal information and do not share it for cross-context behavioral advertising. We do not knowingly collect personal information of consumers under 16.
- Sensitive personal information: we do not intentionally collect it and do not use it to infer characteristics about you.
- Your rights: to know and access the personal information we hold, to request deletion, to request correction, and to be free from discrimination for exercising these rights. You may use an authorized agent, and we may need to verify your request.
- Global Privacy Control: we honor GPC signals as described in the analytics section.
Owners of analyzed websites
When someone submits your website, our crawler, SiteRefactorBot, fetches a limited number of public pages, honors robots.txt and never logs in or submits forms. You can block it with these lines in your robots.txt:
User-agent: SiteRefactorBotDisallow: /
Read more about what the crawler does on the SiteRefactorBot page. If a report about your website contains personal data that you would like removed, contact us.
Children
The service is intended for businesses and professionals and is not directed at children. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy as the service or the law changes. The date at the top shows when it was last updated. For material changes, we will provide a more prominent notice on this website.
Contact
Questions or requests about privacy: biuro@gacode.pl. See also our Terms of Service.