Legal
Information on which data we process when you use turbometrics.io, for which purposes, and which rights you have.
This is a translation for your convenience. The German version is legally binding. Read the German version.
Controller
Dipalino UG (haftungsbeschränkt)
Alexander-Puschkin-Platz 1
01127 Dresden
Germany
Contact
E-mail: [email protected]
Contact form: turbometrics.io/contact
Imprint: turbometrics.io/imprint
We process personal data only to the extent necessary for operating turbometrics.io, carrying out scans, administering user accounts, sending notifications and handling contact enquiries. This includes in particular the master data of your account, technical usage data, scan and monitoring data as well as communication data.
When turbometrics.io is accessed, technically necessary connection data is processed so that the website can be delivered and secured. This may include in particular the following data:
This processing serves the provision, stability and security of the website as well as error analysis and the prevention of abuse.
We use technically necessary cookies and session data so that logins, forms and protected areas work. This includes in particular session cookies and security mechanisms such as CSRF protection. This data is required to operate the application and is not used for advertising purposes.
When you create an account or use your profile, we process the data you provide to us or store in the app. This may include in particular:
We process this data for account administration, authentication, provision of the features booked and communication regarding your account.
When you register, we use Cloudflare Turnstile to check that the request comes from a human (see section 10). If you sign in with Google or GitHub, section 14 also applies.
Accounts for turbopress hosting customers. turbopress is our own hosting service; turbopress and turbometrics.io are run by the same controller (see above). Access to turbometrics.io is included in a turbopress hosting contract at no extra charge. When you sign such a contract, we therefore automatically create a turbometrics account for you, or add the access to your existing account with the same e-mail address. For this we take the following data from our own customer management system:
If we create a new account, your e-mail address counts as confirmed, and we send you a welcome e-mail with a link to set your password (sent via Brevo, see section 8). For an account created this way, we add the domain we received as a domain in your account, initially without scheduled scans, and start a first, non-public scan. When your hosting contract ends, we switch your account to the free plan and let you know by e-mail; the account itself remains.
The legal basis is the performance of your hosting contract, which includes access to turbometrics.io (Art. 6(1)(b) GDPR). You can delete your turbometrics account at any time under Profile → Delete account; you need your password to do so. Your hosting contract is not affected.
When you scan a URL with turbometrics.io, we process the scan and result data required for this. This includes in particular:
Public scans and public reports may be visible to other visitors. This applies in particular to guest scans and to scans that are expressly kept as public. In these cases the domain, the URL and the associated report data may be publicly accessible.
Private scans are only shown within the associated user account.
If you use scheduled scans, alerts or notifications, we process additional monitoring data so that recurring checks and messages work. This includes in particular:
We need this data in order to provide monitoring, history, repetitions, state changes and the display in the user account.
If you store a webhook URL in your profile, we use it exclusively to send the notifications you have activated to your system.
In doing so we process in particular:
Please store only endpoints that you are authorised to use. In the application we display sensitive webhook targets only in a restricted form.
If you contact us via the contact form, we process the details you submit in order to handle your enquiry.
The processing serves to answer your enquiry and to communicate with you. Before the form is sent, we use Cloudflare Turnstile to check that the request comes from a human (see section 10).
We use Brevo as an external delivery provider for sending transactional e-mails. This concerns in particular contact form messages, alert e-mails, test e-mails for alert settings and other system-related e-mails, insofar as they are triggered in the application.
In doing so, the data required for delivery is transmitted to Brevo, in particular the recipient address, sender information, subject, message content and technical delivery data.
The provider is Brevo SAS (formerly Sendinblue), 9-17 rue Salneuve, 75017 Paris, France. We have concluded a data processing agreement with Brevo under Art. 28 GDPR. Further information on data processing by Brevo can be found in Brevo's official privacy policy: brevo.com/legal/privacypolicy.
We use Brevo exclusively for sending and technically delivering our e-mails.
For paid plans we use Stripe as our payment and billing provider. This concerns in particular Stripe Checkout, the customer portal for managing subscriptions and payment methods, and the technical processing of billing events via webhooks.
In particular, the following data may be processed or transmitted to Stripe:
From Stripe we receive in particular status information on checkout, on active or ended subscriptions and on payments, so that we can correctly assign and manage your plan in turbometrics.io.
Where Stripe acts as our processor, a data processing agreement under Art. 28 GDPR is in place. For the payment processing itself, Stripe is in part an independent controller.
Further information on data processing by Stripe can be found in Stripe's privacy policy: stripe.com/privacy.
We use Cloudflare as a content delivery network (CDN) and to protect our website against DDoS attacks and other threats. All traffic to turbometrics.io is routed through Cloudflare's servers before it reaches our own servers. This also applies to status pages that users publish under their own domain: we register that domain with Cloudflare for this purpose, and requests to the status page are also routed through Cloudflare.
In doing so, Cloudflare processes in particular:
For security purposes Cloudflare sets its own cookies, in particular __cf_bm (bot detection) and cf_clearance (security challenge). These cookies are technically necessary and are not used for advertising purposes.
Cloudflare Turnstile.
On the registration page and in the contact form we use Cloudflare Turnstile to fend off automated sign-ups and spam. For this, your browser loads a script directly from challenges.cloudflare.com on these two pages. Turnstile evaluates your IP address and technical characteristics of your browser and device and produces a verification result. When you submit the form, we send this result together with your IP address to Cloudflare to have it confirmed. The legal basis is our legitimate interest in protecting our forms against abuse (Art. 6(1)(f) GDPR). Turnstile's access to information on your device is strictly necessary under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), so that we can provide the registration or contact request you have expressly asked for, protected against automated abuse; consent is therefore not required. Further information can be found in
Cloudflare's Turnstile privacy addendum.
turbometrics.io does not embed any other scripts, stylesheets, fonts or libraries from third-party servers; it serves them itself.
The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. The processing takes place on the basis of our legitimate interest in a secure and performant operation of the website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Cloudflare under Art. 28 GDPR. Cloudflare is certified under the EU-US Data Privacy Framework, so that an adequate level of data protection is ensured for transfers to the USA.
Further information on data processing by Cloudflare can be found in Cloudflare's privacy policy: cloudflare.com/privacypolicy.
What is the Live Data feature? Users on a suitable plan can embed a JavaScript snippet (tm.min.js) on their own websites. This snippet collects performance metrics from the visitors of those websites and transmits them anonymised to turbometrics.io.
Which data is collected? The snippet collects exclusively technical performance data, in particular:
What is not collected? No cookies are set, no browser fingerprinting is carried out, and no personal data such as names, e-mail addresses or complete IP addresses is stored.
IP anonymisation. IP addresses are used exclusively to determine the country of origin. The last octet of the IPv4 address, or the last 80 bits of the IPv6 address, is set to zero before storage. The complete IP address is not stored.
Legal basis for the processing. turbometrics.io processes the transmitted performance data on behalf of the respective user (Art. 28 GDPR). The controllers within the meaning of the GDPR are the users who embed the snippet on their websites — not turbometrics.io. The legal basis for the processing on the customer websites is typically the legitimate interest in the technical optimisation of the respective web offering (Art. 6(1)(f) GDPR).
Retention period. Performance data is stored for the period provided for in the plan booked (between 14 and 180 days) and is then deleted automatically.
Processing on behalf of the controller. Where turbometrics.io acts as a processor when processing end users' performance data, a data processing agreement is available. The current DPA is available at turbometrics.io/dpa.
Use on turbometrics.io itself. We also use the same snippet on the pages of turbometrics.io to measure the loading times of our own website. It collects exactly the data listed above, likewise without cookies, and the snippet is loaded from our own server. For this we are the controller ourselves; the legal basis is our legitimate interest in a fast and stable website (Art. 6(1)(f) GDPR).
From the Starter plan, you can connect your account to other applications through our REST API or our MCP server (https://turbometrics.io/mcp), for example to AI assistants such as Claude (Anthropic) or ChatGPT (OpenAI). You set up the connection yourself. An application only gets access once you approve it during sign-in or give it a personal API token.
In doing so, we process in particular:
The connected application can retrieve the account data that the individual functions provide: monitored domains, scan results and findings, alerts, live data, and account details such as name, email address, plan and quota. It can also start scans and mark alerts as read. If you pass access credentials for a protected site with a scan, we store them encrypted together with the scan. We only use them for scans you start yourself, for example also for a re-scan from that report. They are deleted together with the scan.
Whatever an AI assistant retrieves from us ends up in your conversation and therefore with the provider of the assistant, such as Anthropic or OpenAI. You initiate this transfer yourself. The provider processes the data under its own responsibility and according to its own privacy policy. We do not receive the content of your conversations, only the requests made to our interface.
The processing is necessary to perform the user agreement (Art. 6(1)(b) GDPR). Access tokens from the OAuth sign-in are valid for one hour and are deleted one to two days after they expire. Refresh tokens are valid for 30 days. When a refresh token is replaced by a new one or expires, we delete it 60 to 61 days later. We delete authorization codes from the OAuth flow two to three days after they expire, and app registrations without an active sign-in after 30 days at the earliest. The daily counter expires after two days. Personal API tokens remain until you delete them or until an expiry date you set is reached; we delete expired tokens after one to two days.
Under Profile → API & apps you can see all connected applications and revoke their access at any time. When you do, we immediately delete all tokens and open authorization codes of that application. You can also delete personal API tokens there.
The servers of turbometrics.io, the servers that run scans and screenshots, and our database are located in data centres of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The data centres are in Germany (Falkenstein, Nuremberg) and Finland (Helsinki), i.e. within the European Union. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR.
All data mentioned in this privacy policy that we process ourselves is stored and processed on these servers. The scan servers request the URL being tested; the website requested sees the IP address of the scan server, not yours. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR) and, where your account is concerned, the performance of the user agreement (Art. 6(1)(b) GDPR).
In some cases your browser loads screenshots of tested pages directly from screenshots.turbopress.de. This is our own screenshot server, also hosted at Hetzner. It sees your IP address and the other technical access data, just as when you visit this website (see section 1).
Further information can be found in Hetzner's privacy policy: hetzner.com/legal/privacy-policy.
Instead of using your e-mail address and password, you can also register and sign in with your Google or GitHub account, or link such an account in your profile. When you choose the button, we redirect you to Google or GitHub. You sign in there and approve that we receive your data. Google or GitHub thereby learns that you are signing in to turbometrics.io.
From Google or GitHub we receive and store:
We do not store access tokens from Google or GitHub. The processing takes place at your request for registration and sign-in, i.e. to perform the user agreement (Art. 6(1)(b) GDPR).
For users in the European Economic Area, the providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. Google also transfers data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of data protection (Art. 45 GDPR). GitHub also processes your data in the USA; GitHub participates in the EU-US Data Privacy Framework and additionally uses EU Standard Contractual Clauses.
Further information can be found in the privacy policies of Google and GitHub.
For a scan we additionally retrieve Google's PageSpeed score. For this we send the URL tested to Google via the PageSpeed Insights interface; Google then requests the page itself. We do not transmit any data about you or your account. If a current value already exists for the same URL, we use it and do not ask Google again.
The legal basis is our legitimate interest in complete and comparable scan results (Art. 6(1)(f) GDPR). The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The URL tested is therefore transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission found an adequate level of data protection in its decision of 10 July 2023 (Art. 45 GDPR).
Further information can be found in Google's privacy policy: policies.google.com/privacy.
If you request AI recommendations in a scan report, we have them generated by a language model from the provider Anthropic. For this we send the technical results of the scan to Anthropic, in particular:
We do not send your name, your e-mail address or any other account data to Anthropic. We store the recommendations with the scan and reuse them for the same URL when the findings are unchanged, instead of having them generated again. The processing takes place because you request the feature, to perform the user agreement (Art. 6(1)(b) GDPR).
Our contractual partner is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Anthropic processes the data on our behalf; we have concluded a data processing agreement with Anthropic under Art. 28 GDPR for this. The processing may also take place in the USA by Anthropic, PBC. This transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Further information can be found in Anthropic's privacy policy: anthropic.com/legal/privacy.
We store personal data only for as long as it is required for the respective purposes or as long as statutory retention obligations exist. Account, scan, monitoring and notification data generally remains stored for as long as it is needed for the use of your account, for tracing reports and notifications, or for legal evidence.
Within the statutory requirements you have in particular the following rights:
If you have questions about data protection or about exercising your rights, please contact us via the contact form or by e-mail to [email protected].
We may adapt this privacy policy if features, legal requirements or the services used change. The current version is always available on this page.