Transparency matters to us
Which data we process from the visitors to your website, which data comes from your own user account, which service providers are involved and how long we store everything.
Two kinds of data, two roles
When you use sitebrunch, two separate kinds of data arise. We deliberately keep them apart on this page, because different rules apply to them and because our role differs in each case.
We process data of the visitors to your website exclusively on your behalf. You decide what is collected and are the controller within the meaning of the GDPR. We are the processor and are bound by your instructions. The basis for this is our data processing agreement.
Data from your own user account, such as your login details and your billing information, we process for our own purposes. Here we are the controller ourselves. The details are set out in our privacy policy.
This page is an informative overview and not a contract. It replaces neither the data processing agreement nor our privacy policy. It is intended to make transparent what actually happens.
Data of the visitors to your website
When a person visits a page of your website, our standard script sends the following information to our server in Germany. It does not set any cookies. From the device we read only one technical marker that our editor sets, so that your own visits do not appear in your statistics. Information on our beta features, which deviate from this, can be found further below.
Item | Description |
|---|---|
url | The address that was called up |
referrer | Only for visits coming from an external domain, and only that domain name, without the path |
previousUrl | The path of the previously visited page, exclusively within your own domain. Query parameters and anchors are not transmitted |
device | Device type (mobile, tablet, desktop), derived from the user agent and the screen size |
scrollPosition | Scroll position, rounded to steps of five |
pageViewId | Random identifier per page view, no conclusions about a person are possible |
path, elementIdentifiers | Only for interactions such as clicks or form submissions: the CSS path of the element concerned, its visible text and technical attributes such as link target, title, alternative text or field name. We do not read out the entries in form fields. Please note: the visible text of a clicked element can contain personal information if your page displays, for example, a name or an order number there |
IP address, user agent, client hints | Sent along by the browser for technical reasons. Used exclusively to form the hash and discarded afterwards |
What we store permanently
From the IP address, user agent, client hints, device type and domain we form a hash using the SHA-256 procedure, together with a random, website-specific value (salt). IP address, user agent and client hints are discarded in this step and never reach our analytics database. There is no column for IP address or user agent there.
Of the location we store only the country according to ISO-3166. City or region are not recorded.
In enhanced-privacy mode we additionally truncate the IP address before the hash is formed. With IPv4 the entire last octet is set to zero (/24 mask).
If a person has enabled Do Not Track in their browser, our standard script switches off automatic collection entirely. Page views, interactions and scrolling are then not sent to our server.
Data from your user account
This data concerns you as a customer, not the visitors to your website. For it we are the controller ourselves.
Type of data | Description |
|---|---|
Registration | Name, email address, phone number and password. We store the password exclusively as a hash, never in plain text |
Origin of your sign-up | At registration we record which page and which campaign parameters brought you to us, as well as the referring address. This helps us assess which of our content is useful |
Your websites and projects | Name and domain of the websites you create, as well as your projects, comments and screenshots |
Billing | Billing name and billing address, your VAT identification number if you wish, and your payment details. We do not collect the payment details ourselves, they are processed directly by Stripe |
IP address at registration | Used exclusively to limit the number of registrations per hour and to prevent misuse. We do not store it in your user account |
Beta features
We offer individual features as beta. They are disabled by default and have to be enabled by you explicitly. As long as you do not enable a beta feature, only the behaviour described above applies to your website.
Cookie-based recognition
If you enable this feature, our script sets a cookie with a randomly generated identifier on the devices of your website visitors. Recognition then takes place via this cookie and no longer via the hash described above. The salt rotation, and the resulting limitation of recognition to 21 days, therefore do not apply to this feature. You set the lifetime of the cookie yourself. The feature requires consent under section 25 TDDDG. You may only use it if you have obtained valid consent from your website visitors beforehand. The browser setting Do Not Track is not evaluated in this beta.
Shopify pixel
For Shopify shops we offer our own pixel. It records events in the checkout process, such as adding an item to the cart. You set it up yourself in your shop, and without that setup it is not active. The browser setting Do Not Track is not evaluated in this beta.
AI-assisted analyses
The AI-assisted analyses, such as the check of alternative texts and the management summary, are beta features. If you enable the check of alternative texts, we transmit content and image files of the checked pages to Scaleway in France (Paris). If you enable the management summary, we additionally transmit aggregated statistics of your project, such as visit numbers, session duration, bounce rate, device distribution and the most visited pages. These statistics are sums and averages across all visits, individual persons are no longer identifiable in them. We do not transmit personal data of your website visitors.
Service providers we use
All processing of the data of your website visitors takes place within the EU. We operate our databases, queues and our error monitoring ourselves on our own infrastructure and do not pass this data on to third parties. Only the two following service providers are involved in the personal data of your website visitors. If you enable the management summary (beta), Scaleway is added, but receives exclusively aggregated statistics in which individual persons are no longer identifiable.
For the data of your website visitors
Provider | Purpose | Registered office and place of processing |
|---|---|---|
Hetzner | Hosting, databases, queues and backups of the analytics database | Germany (Falkenstein, Nuremberg) |
bunny.net | Delivery of our analytics script. When the script is loaded, the browser of your website visitors connects to the CDN, and its IP address is visible in the process for technical reasons. Access logging is disabled | Slovenia, delivery via European locations |
For your user account and the operation of the application
Provider | Purpose | Registered office and place of processing |
|---|---|---|
Hetzner | Hosting and databases, storage for uploaded documents | Germany (Falkenstein, Nuremberg) |
bunny.net | Delivery of static files and of our analytics script, as well as object storage: crawl snapshots and stored page HTML, preview screenshots, result data of the accessibility checks, course certificates and the encrypted backups of our customer database | Slovenia, delivery and storage via European locations |
Scaleway (object storage) | Object storage for application files, comments and exports | France (Paris) |
Brevo | Sending transactional and notification emails to your user accounts | France |
awork (your own account) | Not a subprocessor of ours: the contractual relationship with awork exists between you and awork, we merely transmit into your own account on your instruction. Optional integration, not active by default. If you connect your awork account, we create your comments as tasks in awork and transmit the comment text, the assigned people and the associated screenshot. Conversely, we retrieve your user profile there as well as your project, status and task lists and store them in your sitebrunch account. A transfer takes place only when you create or reply to a comment, not automatically in the background. Data of your website visitors is not transmitted | Germany (Hamburg) |
Scaleway (AI analyses) | AI-assisted analyses as a beta feature, such as the check of alternative texts and management summaries. Active only if you explicitly enable the respective feature. Transmitted are content and image files of the checked pages and, for the management summary, aggregated statistics of your project. The transmitted content is not stored and not used to train AI models. Personal data of your website visitors is not transmitted | France |
Stripe | Payment processing for your sitebrunch subscription. No data of your website visitors | Ireland, group affiliation with the USA |
To determine the country of origin we use the GeoLite2 database from MaxMind. It is held as a local file on our servers. No query is made to MaxMind and no IP address is transmitted.
Retention periods for server and CDN logs
Type of data | Retention period |
|---|---|
CDN logs (bunny.net) | Access logging is disabled. No CDN logs are created |
Server logs | No fixed period. The logs remain on the respective server in Germany, are rotated by size (at most five files of ten megabytes each per service) and are deleted at the latest when the service is next replaced. There is no central collection and no disclosure to third parties |
Error logs of the monitoring | 90 days, then automatic deletion. Operated on our own servers in Germany |
Salt used to form the hash | 14 days. It is then irretrievably overwritten |
Backups of the customer database | 7 days. The backups are encrypted on our server and leave it only in that form. The storage provider cannot read the contents |
Backups of the analytics database | The five most recent backups are kept, older ones are deleted automatically. Stored in Germany (Nuremberg). These backups contain exclusively pseudonymised analytics events, no salt and no IP addresses |
Raw data in the queue | Deleted after processing, at the latest after 14 days |
Analytics events (pseudonymised) | No fixed deletion period, so that analyses over longer periods remain possible. The personal reference ceases when the salt is overwritten |
Results of website crawls | Remain stored until you delete the website. Both the crawls and the page content recorded in them are removed |
Public accessibility checks | 90 days |
Logs of sent emails | 30 days. Concerns the emails to your user accounts, not your website visitors |
The salt is part of the hash. Once it has been overwritten after 14 days and removed from the last backup after a further 7 days at most, a stored hash can no longer be traced back to an IP address, not even by us. From that point on, the stored analytics events are permanently anonymised. Recognition of the same person is thereby limited to 21 days at most.
Transfers outside the EEA
The data of your website visitors is processed exclusively within the European Union. For this data there is no transfer to a third country.
We embed neither Google Fonts nor Google Analytics or reCAPTCHA in our application. We operate our error monitoring on our own servers in Germany, and no error data is transmitted to an external service. Before an error log is stored, we remove the IP address, user agent, client hints and the transmitted content of the tracking requests. The logs are deleted automatically after 90 days.
A third-country element exists only in the following cases, which do not concern your website visitors:
Payment processing via Stripe. The contracting party is Stripe Payments Europe, established in Ireland. A transfer within the Stripe group to the USA takes place on the basis of the standard contractual clauses of the EU Commission. This concerns only your billing data, not the data of your website visitors.
Internal operational notifications to Microsoft Teams, for example on changes to subscriptions. The data of our Microsoft 365 tenant is stored in Germany, so in that respect there is no transfer to a third country. No data of your website visitors is transmitted.
In the dashboard, individual help videos may be embedded via YouTube, Vimeo or Tella. We embed YouTube in the mode without cookies. If you open a page with an embedded video, a connection to the respective provider is established. This concerns only your own user accounts, not the data of your website visitors.
Last updated: 21 September 2026. We will notify you in advance of changes to the list of service providers we use.