Privacy Policy

We collect Personal Data that you give us, that is generated when you use the service, and that we receive from third parties you choose to connect.

• Account information: your name, email address, password (stored only in hashed form), company name, and account preferences.
• Social sign-in data: if you sign in with Google, Facebook, or LinkedIn, we receive your name, email address, and profile picture from that provider. We do not receive your password for those services.
• Website and service data: the URLs of the WordPress sites you connect, connection credentials or keys, performance, uptime, and security scan results, and backup files you ask us to create and store. Backups may contain Personal Data about your own site visitors or customers; we process that data only on your instructions.
• Billing information: your plan, billing address, transaction history, and tax details. Card details are handled by our payment processor; we do not store full card numbers.
• Usage and device data: IP address, browser type, operating system, pages viewed, referring URLs, and timestamps, collected through server logs, cookies, and Google Analytics.
• Communications: messages you send to our support team or through our contact forms.

We use Personal Data for the following purposes:

• Creating and managing your account and authenticating you when you sign in.
• Providing the service, including running backups, monitoring, performance tests, and alerts for your sites.
• Processing payments, issuing invoices, and managing subscriptions.
• Sending service messages such as alerts, security notices, and billing reminders.
• Responding to support requests and other enquiries.
• Understanding how the website and product are used so we can fix problems and improve features.
• Sending product updates and marketing emails where you have agreed to receive them. You can unsubscribe at any time.
• Detecting and preventing fraud, abuse, and security incidents.
• Complying with legal obligations and enforcing our Terms of Service.

Where the EU/EEA or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Performance of a contract: to create your account, provide the service you signed up for, and take payment.
• Legitimate interests: to secure our systems, prevent fraud, provide support, and improve the product, where those interests are not overridden by your rights.
• Consent: for non-essential cookies, analytics, and marketing emails. You may withdraw consent at any time without affecting processing that happened before withdrawal.
• Legal obligation: to keep tax and accounting records and to respond to lawful requests from authorities.

Under India’s Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent or for the legitimate uses the Act permits, such as providing a service you have requested.

We do not sell your Personal Data, and we do not share it for cross-context behavioural advertising. We share it only with:

• Service providers who process data on our behalf under written contracts, such as cloud hosting and storage, email delivery, payment processing, and analytics (Google Analytics).
• Sign-in providers (Google, Facebook, LinkedIn) when you choose to use them. Their own privacy policies govern what they collect.
• Your team: account owners and authorized team members can see data about the sites in the shared workspace.
• Authorities and legal requests: when required by law, or to protect the rights, property, or safety of W3speedX, our users, or others.
• Business transfers: to a buyer or successor in a merger, acquisition, or sale of assets, subject to this policy.

We keep Personal Data only for as long as we need it for the purposes described in this policy:

• Account data: for as long as your account is active. After you close your account, we delete or anonymise it within 90 days.
• Backups and site data: for the retention period of your plan. They are purged when that period ends or when your account is closed.
• Billing records: for as long as tax and accounting laws require, generally up to 8 years.
• Server and security logs: up to 12 months, unless needed longer to investigate an incident.
• Support messages: up to 3 years after the conversation ends.

Depending on where you live, you may have the right to:

• Access the Personal Data we hold about you and get a copy of it.
• Correct inaccurate or incomplete data.
• Delete your data.
• Receive your data in a portable, machine-readable format.
• Restrict or object to certain processing, including direct marketing.
• Withdraw consent at any time where we rely on consent.
• Nominate another person to exercise your rights if you die or become incapacitated (India).
• Lodge a complaint with your local data protection authority or, in India, the Data Protection Board of India.

California residents. Under the CCPA/CPRA you have the right to know what Personal Data we collect, use, and disclose; to delete and correct it; and to opt out of its sale or sharing. We do not sell or share Personal Data as those terms are defined. We will not discriminate against you for exercising these rights.

To exercise any of these rights, email [email protected]. We may ask you to verify your identity before acting on a request. We respond within 30 days, or sooner if local law requires.