Privacy policy
Effective date: 23 October 2026
1. Who is responsible for your data
Webverdio is operated by SmartSolve IT, Torenlaan 5B 1402 AT Bussum, registered with the Dutch Chamber of Commerce (KvK) under number 99658089. Contact hello@webverdio.com for privacy questions or to exercise your rights.
This policy explains how we handle personal data when you visit webverdio.com, request or purchase an audit, use an agency pack, receive a report or contact us. It also explains how personal data appearing on an audited public website can be processed.
SmartSolve IT is the controller for the personal data described in this policy.
2. The information we handle
Audit requests and delivery. We collect the website address, email address and report language you provide, together with request identifiers, confirmation status, timestamps and report access information needed to manage and deliver the audit.
Agency information. We process an agency's name, website, contact information, branding details supplied for reports, and pack purchase, expiry and credit-use records.
Orders and payments. Paddle collects payment and billing information through its checkout. We receive the customer and transaction information needed to fulfil the purchase, handle support and maintain records, such as name, email address, country, postcode, company name and VAT number where given, order reference, amount, tax information and payment or refund status.
Website audit material. Our tools collect accessible page content, page addresses, screenshots, technical test results and report findings. This material can include people's names, job titles, contact details, photographs, biographies or testimonials published on the website. Such information comes from the audited site, rather than necessarily from the person it concerns.
Findings kept for re-audits. After a report is delivered, we keep its list of findings (titles, affected pages and short descriptions, without your email address or any screenshots) for 90 days, so a re-audit can show what changed.
Technical and security information. We process IP addresses and browser, device, connection and request information to operate the service and prevent spam, fraud and other misuse.
Communications. If you contact us, we process your email address, message, attachments and related support or refund records. Please avoid sending passwords, payment-card information or unnecessary sensitive personal data.
The website address, delivery email and selected report language are necessary to fulfil an audit request. Billing information required at checkout is necessary to complete a paid order. If required information is not provided, we may be unable to deliver the requested service. Other information is optional unless the relevant form identifies it as required.
3. Why we use personal data
We use personal data only where we have an applicable legal basis.
| Purpose | Legal basis and relevant interest |
|---|---|
| Verify an individual's request, fulfil their order, deliver the report and provide necessary support | Taking requested steps before a contract or performing the contract with that individual |
| Manage agency and business-customer relationships, including communications with staff or representatives | Legitimate interests in administering and delivering those business relationships; contract where the individual is personally a party |
| Keep the findings of a delivered report so a re-audit can be ordered | Legitimate interests in offering a comparison with the earlier report, limited to the findings and to the period above |
| Keep required financial and tax records | Compliance with applicable legal obligations |
| Prevent spam, fraud, unauthorised access and service misuse | Legitimate interests in protecting our service, customers and audited websites |
| Investigate service errors and check the quality of reports | Legitimate interests in providing an accurate, reliable service, using only information needed for the check |
| Handle complaints, refunds and legal claims | Contract where applicable, legal obligations, and legitimate interests in resolving disputes and protecting legal rights |
When relying on legitimate interests, we consider the necessity of the processing and the effect on the people concerned. You may object to processing based on legitimate interests as explained in section 11.
For personal data incidentally collected from a public website, the relevant interest is providing the authorised website assessment and identifying improvements while limiting unnecessary information about individuals. The purchaser's contract is not, by itself, a legal basis for processing other people's personal data.
We use your email for requested verification, delivery and essential service communications. Confirming an audit request does not subscribe you to marketing. If we introduce optional promotional emails, we will provide a separate choice and the information required at that time; you will be able to withdraw any consent used for them.
4. Public website content and AI analysis
We review publicly accessible websites only in response to a confirmed audit request. The requester must confirm ownership or permission. We respect applicable access restrictions and do not log in, submit forms, place orders or bypass those restrictions.
Publicly available information can still be personal data. We process it to perform the requested assessment, produce the report and perform necessary support and quality checks. If information about you appears in an audited website or report, you can contact hello@webverdio.com even if you have never purchased an audit.
We use specialist AI analysis providers to analyse website content and test results and help prepare recommendations. What we share with them is the content and structure of the audited pages, screenshots, accessibility information and test results. We do not include the email address supplied for your order in that analysis, although website content or screenshots may themselves contain email addresses or other personal information. Our AI providers' business terms do not allow them to use this material to train their models, and they keep it only for a limited period before deleting it.
Our report-generation process evaluates websites and produces recommendations. It is not used to make decisions about individuals with legal or similarly significant effects. Automated security systems may identify suspicious requests; contact us if you believe a legitimate request has been blocked.
5. Providers and other recipients
We share personal data with the following categories of providers only as needed for the purposes described in this policy and subject to applicable contractual and legal safeguards. Section 6 explains international processing.
| Recipient category | Purpose and information involved |
|---|---|
| Hosting and secure storage providers | Operate the website and store information needed to deliver the service, including request, audit, report and operational data. Our main hosting and report storage are in the EEA. |
| Website analysis and AI service providers | Analyse website content, screenshots and test results and help prepare findings and recommendations. See section 4 for the information shared. |
| Email and customer communication providers | Deliver service emails and forward the messages you send us, using email addresses, message contents, attachments and delivery information. |
| Security and abuse-prevention providers | Protect forms and the service against misuse, using IP addresses and browser, device, connection and request information. |
| Website-performance data providers | Receive the audited website address to return available public performance statistics used in the report. |
| Payment, billing and tax administration | Paddle acts as merchant of record and handles checkout, payment, invoicing, tax and related fraud prevention. It receives the relevant customer, billing and transaction information. |
Providers acting on our behalf are subject to appropriate data processing terms. Some recipients act as separate controllers for defined activities. Paddle is our merchant of record and handles its merchant and payment activities under its own privacy notice.
Cloudflare protects our forms against automated abuse. It processes technical browser and connection information on our behalf and acts as a separate controller when using those signals to improve bot detection. See its Turnstile Privacy Addendum.
Authorised team members may access information for delivery, support, security and quality checks. Information may also be disclosed to professional advisers or public authorities when necessary for a legitimate business purpose or legal obligation, with appropriate safeguards. If our business is transferred, any disclosure must have a lawful basis and we will provide the information required by law.
Report recipients include the person who ordered the audit and anyone to whom they provide the report or its private access link. An agency may share its reports with the relevant client. We do not make customer reports publicly searchable as part of delivering the service.
6. International processing
Our hosting and report storage are in the European Economic Area (EEA), in Belgium, and our service emails are sent from the EU. Our AI analysis, form-protection, domain and email-forwarding, and website-performance data providers may process data in the United States. EEA hosting does not mean that every processing activity takes place within the EEA.
Where we arrange a transfer to a country without an applicable adequacy decision, we use a lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with additional measures where necessary. We rely on the EU-US Data Privacy Framework only where the recipient's valid certification covers the relevant transfer. A provider acting as an independent controller explains its own transfers in its notice.
Email hello@webverdio.com to ask about applicable safeguards or request a copy, with unrelated confidential details redacted where appropriate.
7. How long we keep information
Our standard retention periods for the information we control are set out below. A delivery email address or order reference can appear in more than one record: deleting the audit record does not require us to delete a separate invoice that must legally be kept.
| Information | Standard retention period |
|---|---|
| Confirmed audit request, website address, report language and delivery email in the audit system | 30 days after report delivery |
| Collected page content, screenshots, test results and report files | 30 days after report delivery; hosted report access ends at that point |
| List of findings from a delivered report, for re-audits (no email address or screenshots) | 90 days after report delivery |
| Requests that are never confirmed or for which no report is delivered | 30 days after the request is received, excluding separate payment or dispute records |
| IP addresses retained by Webverdio for abuse prevention and request limits | 30 days |
| Agency identity, branding and pack administration records | 12 months after the latest pack expires, excluding records subject to a longer legal requirement |
| Financial and tax records required by Dutch law | Normally seven years under the statutory retention rules; a longer period applies only where required for the relevant record |
| Support, complaint and refund correspondence that is not itself a required financial record | 2 years after the last message |
| Server logs and database backups, including residual copies awaiting deletion | Server logs 30 days, database backups 7 days; residual copies are gone within 30 days |
| Anonymous order statistics: dates, status, report language, order type and cost, without any website, email or IP address | Kept for our business figures; they cannot be linked to you or to a website |
We delete or irreversibly anonymise information when it is no longer needed. A limited, relevant set of records may be retained longer where a legal obligation, ongoing dispute or established legal claim makes that necessary. This does not mean we retain every report or all crawled material for the accounting period.
A recipient acting as a separate controller may apply its own retention periods, and specific safety or legal obligations can require longer retention. Contact us if you need further information about a particular record.
8. Cookies and similar technologies
We do not use cookies for advertising or visitor analytics on Webverdio. Visitors and customers receive no cookies from us; our own team's admin pages use one necessary sign-in cookie.
The form-protection service processes technical browser and connection information to distinguish legitimate requests from automated abuse. Cookie-free operation does not mean that no personal data is processed. Paddle's checkout has its own technology and privacy disclosures.
If we introduce optional technologies requiring consent, we will explain their purposes and obtain consent before activating them. Any consent controls will allow you to change your choice and withdraw consent as easily as it was given. Declining optional technologies will not prevent access to the core service.
9. Security and report links
We use technical and organisational safeguards appropriate to the information and risks involved, including encryption in transit and at rest and access restricted to authorised personnel. No online service can guarantee absolute security.
We email a private access link when a report is available. Anyone who has that link can access the report while it remains valid; access is not separately restricted to the original recipient. Keep the link confidential and contact us if it is disclosed unintentionally. Reports remain accessible for the 30-day period described above.
10. Children
Webverdio is intended for adults purchasing website audits and is not directed at children. Please contact us if you believe a child has supplied information to us inappropriately. Personal information about children may also appear on a public website; such material still requires appropriate protection and is not exempt from this policy because it is public.
11. Your rights
Subject to the conditions of applicable data protection law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, and a portable copy of data where the portability right applies. Where applicable, access information includes the identities of recipients of your personal data.
You may object to processing based on legitimate interests for reasons relating to your situation. We will assess that objection as required by law. You may object to direct marketing at any time. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.
Email hello@webverdio.com to make a request. We may ask for information reasonably necessary to verify your identity and locate the relevant data. We normally respond within one month. Where legally permitted because of the complexity or number of requests, we may extend this by up to two further months and explain the extension within the initial month. Requests are normally free of charge.
Some rights have legal exceptions. For example, we may need to keep required tax records despite a deletion request. If we cannot fulfil a request, we will explain the reason and available complaint routes.
You can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to another competent authority, including in the EEA country where you live, work or believe an infringement occurred. You do not have to contact us first.
12. Changes and contact
We update this policy when our processing or legal requirements change and revise the effective date. We will provide additional notice of material changes where appropriate or legally required, including by email where we have a valid contact address. A policy update does not itself authorise a new incompatible use of personal data or replace consent where consent is required.
For questions, privacy requests or concerns about an audited website or report, contact hello@webverdio.com or write to SmartSolve IT at the address in section 1.