Privacy policy

What we collect, where it's kept, for how long and how you ask for it to be deleted. Each point describes what the system does today — not an intention.

Free analysis

To analyse a site we use the address you type, make a normal request to that site and show you the result. Without an account, we don't keep the analysed address or anything that identifies you. We only keep counts aggregated by day (how many visits, how many analyses), with no IP address, no user-agent and no visitor identifier.

To stop abuse, we count requests per connection for one hour. For that we keep a irreversible summary (hash) of the IP address — never the IP — which is deleted automatically after 2 hours.

Public sources we check

For the analysis we also check public information about the domain: the DNS records (through Cloudflare's DNS service), the public certificate log Certificate Transparency (crt.sh and Cert Spotter, by SSLMate) and, on WordPress sites, the latest version of WordPress and its plugins (WordPress.org) and the known flaws in those versions (WPVulnerability). These services only receive the domain or plugin name — never your data.

When the blocklist check is active, the address of the analysed site is sent to Google (Web Risk) to find out whether it is flagged as dangerous. Only the site's address is sent, never your data.

Account

An account is optional. You sign in with a link sent to your email, no password. We keep your email and, of the session, only a hash of the identifier — never the value of the cookie. When you're signed in, we keep the history of your analyses (site address, score and date) and the sites you ask us to monitor, for as long as the account exists.

Contact requests and messages

If you use the assistant, your questions (and, on an analysis page, that analysis result) are sent to Anthropic to generate the answer. We don't keep the conversations: we only count how many questions there were each day.

If you use the «Explain it to me» button or ask for the report by email, we keep the email, the site and the country the request came from, to send you the report and reply. We delete these requests automatically after 12 months. The messages you send us at /responder are kept until the matter is resolved; those about payments or refunds are kept as a record of the purchase.

Payments and credits

Payments are processed by Stripe. Card details are entered in its service and never pass through us. On our side we keep the purchase record (payment session, amount and the site it's for) and, if you have an account, the credit movements — kept for the period required by tax law.

Plans, teams and agency forms

With a plan, we keep the tasks you mark as done and email you a summary once a month. On the Agency plan, we keep the agency's name, contact and site, and the emails of the team members the owner adds.

Anyone who uses an agency's form leaves the site, their name, email and, optionally, phone. That data and the analysis result go to that agency, which is responsible for it and is the one who contacts you; SinalPT stores it on the agency's behalf for as long as the agency's account exists. To ask for it to be deleted, talk to the agency or write to us at /responder.

Monitoring

If you subscribe to monitoring, we keep the sites you choose to monitor, the result of each check and the subscription status (active, cancelled). The monthly payment is handled by Stripe; you can cancel at any time and, from then on, we stop checking your sites.

If you send us your domain's DMARC reports, we keep a summary of each report (email provider, period, number of emails and the IP addresses of the servers that failed) for 12 months.

Connected WordPress sites

Connecting WordPress sites is paused and we don't ask for new credentials. If you connected a site before, the Application Password is stored cifrada (AES-256-GCM, with the key kept outside the database) and you can disconnect it in «Connected sites»: we delete the credential and try to revoke it in your WordPress.

Who processes data for us

Cloudflare (hosting and database), Stripe (payments), Resend (email delivery) and Anthropic (AI assistant, only when you ask it something). We don't use advertising or third-party tracking.

The site's JavaScript is ours and is served by sinalpt.com itself: it counts visits without personal data and runs the assistant. The site's fonts are also served by us, with no requests to Google.

Cookies

We only use three cookies, all our own:

• sinal_s — keeps you signed in after you log in. It lasts 30 days or until you sign out.
• sinal_l — remembers the language you chose. It lasts 1 year.
• sinal_ad — only when you arrive from a SinalPT ad: it stores the campaign name for 30 days, so we know how many analyses came from each ad. It doesn't identify you and isn't shared with anyone.

We don't use advertising or third-party cookies.

Controller and legal basis

The data controller is SinalPT, which you can contact at contacto@sinalpt.com.

• Free analysis, counts and abuse protection: legitimate interest in running and protecting the service (Article 6(1)(f) GDPR).
• Account, plans, reports and replies you ask us for: performance of the contract or of steps taken at your request (point b).
• Payment records: compliance with legal obligations, such as tax law (point c).

Transfers outside the European Union

Cloudflare, Stripe, Resend and Anthropic are US companies and may process data outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework, when the provider is certified, or on the standard contractual clauses approved by the European Commission.

Your rights

You can ask for access to, correction or deletion of your data at /remover or by email to contacto@sinalpt.com. We reply within 30 days. If you feel we didn't handle your request well, you can complain to the data protection authority in your country.

This page describes how the service actually works. It is not legal advice.