Privacy Policy
1. An overview of data protection
General information
The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit this website. The term "personal data" comprises all data that can be used to personally identify you. For detailed information about the subject matter of data protection, please consult our Data Protection Declaration, which we have included beneath this copy.
Data recording on this website
Who is the responsible party for the recording of data on this website (i.e., the "controller")?
The data on this website is processed by the operator of the website, whose contact information is available under section "Information about the responsible party (referred to as the 'controller' in the GDPR)" in this Privacy Policy.
How do we record your data?
We collect your data as a result of your sharing of your data with us. This may, for instance, be information you enter into our test form.
Other data shall be recorded by our IT systems automatically or after you consent to its recording during your website visit. This data comprises primarily technical information (e.g., web browser, operating system, or time the site was accessed). This information is recorded automatically when you access this website.
What are the purposes we use your data for?
A portion of the information is generated to guarantee the error free provision of the website. Other data may be used to analyze your user patterns.
What rights do you have as far as your information is concerned?
You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data are rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Moreover, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency.
Please do not hesitate to contact us at any time if you have questions about this or any other data protection related issues.
2. Hosting
We are hosting the content of our website at the following provider:
All-Inkl
The Provider is the ALL-INKL.COM, Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (hereinafter "All-Inkl"). For details, please visit the privacy policy of All-Inkl: https://all-inkl.com/datenschutzinformationen.
The use of All-Inkl is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable representation of our website. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user's end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.
Data processing
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
3. General information and mandatory information
Data protection
The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration.
Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This Data Protection Declaration explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected.
We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.
Information about the responsible party (referred to as the "controller" in the GDPR)
The data processing controller on this website is:
Christian Schreiber
Sybelstr. 42
10629 Berlin
Phone: 0162/7506034
E-mail: [email protected]
The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).
Storage duration
Unless a more specific storage period has been specified in this privacy policy (see section 6 for the storage period of your test reports), your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.
General information on the legal basis for the data processing on this website
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data are processed according to Art. 9(1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to the access to information in your end device (e.g., via device fingerprinting), the data processing is additionally based on § 25(1) TDDDG. The consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.
Recipients of personal data
In the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is required as part of the fulfillment of a contract, if we are legally obligated to do so, if we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or if another legal basis permits the disclosure of this data. When using processors, we only disclose personal data on the basis of a valid contract on data processing.
Revocation of your consent to the processing of data
A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.
Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)
If data are processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to at any time object to the processing of your personal data based on grounds arising from your unique situation. If you log an objection, we will no longer process your affected personal data, unless we are in a position to present compelling protection-worthy grounds for the processing of your data that outweigh your interests, rights and freedoms, or if the purpose of the processing is the claiming, exercising or defence of legal entitlements.
If your personal data is being processed in order to engage in direct advertising, you have the right to object to that processing at any time (objection pursuant to Art. 21(2) GDPR). PerfDelta does not use your data for direct advertising.
Right to log a complaint with the competent supervisory agency
In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work, or at the place where the alleged violation occurred.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.
Information about, rectification and eradication of data
Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients, as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated.
Right to demand processing restrictions
You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned, for example while a dispute about the correctness of your data is being investigated. If you have restricted the processing of your personal data, these data (with the exception of their archiving) may be processed only subject to your consent or to claim, exercise, or defend legal entitlements, or to protect the rights of other natural persons or legal entities, or for important public interest reasons cited by the EU or a member state.
SSL and/or TLS encryption
For security reasons and to protect the transmission of confidential content, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser shows "https://" and the lock icon in the browser line.
4. Recording of data on this website
Cookies
This website does not set its own cookies to track visitors. If a service described in this policy (such as Cloudflare Turnstile, see section 5) stores a cookie or accesses information on your device, this is described in the relevant section.
To remember your language choice, we set the cookie pd_lang. It contains only the language code ("de" or "en"), is not used to recognise or analyse you, and expires after twelve months. On your first visit to an English page, we redirect you to the German version, if one exists, based on your browser's language setting. The legal basis is § 25(2) no. 2 TDDDG, as the cookie is strictly necessary to show the site in the language you requested.
Server log files
The provider of this website automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises the browser type and version, the operating system used, referrer URL, the hostname of the accessing computer, the time of the server inquiry, and the IP address. This data is not merged with other data sources.
This data is recorded on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator's website.
Cookie-free audience measurement
To understand which content is used and how visitors find us, we count page views and started tests. Counting happens only on our own server, as part of the page request that takes place anyway. No third-party script is loaded, no cookie is set, and no information is stored on or read from your device.
We only evaluate information your browser sends with every request: the requested page, the referrer address and the browser identifier (user agent). From the referrer we keep only the name of the referring website and assign it to a category such as search engine, AI assistant or social network. The user agent is used solely to filter out automated access and is not stored. If the requested address contains a campaign parameter (utm_source), its value is kept. Your IP address is not used for counting.
We store nothing but daily counters per page and origin, for example "guide page X, 12 views from search engines on 23 September 2026". No user profile is created, and the stored counters cannot be traced back to individual visitors.
The information evaluated during the page request (referrer address, user agent) is not stored; it is processed only for the duration of the request. The daily counters are deleted automatically after 25 months.
This processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to improve our service based on how our content is used.
Request by e-mail
If you contact us by e-mail, your request, including all resulting personal data (name, request), will be stored and processed by us for the purpose of processing your request. We do not pass this data on without your consent. These data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR).
Contact form
Through the feedback/contact form on this website, you can submit your name, email address, and a message to us. This information is forwarded by email to our mailbox and processed there to handle your request; it is not stored in a database on this website. The form is protected against automated abuse by Cloudflare Turnstile (see "Cloudflare Turnstile" section below). This processing is based on our legitimate interest in handling inquiries submitted to us (Art. 6(1)(f) GDPR).
5. Plug-ins and Tools
Cloudflare Turnstile
We use "Cloudflare Turnstile" on this website. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter "Turnstile").
Turnstile is used to check whether the data input on the test form or the contact form is done by a human or by an automated program. For this purpose, Turnstile analyzes the behavior of the website visitor based on a number of characteristics. On the test form, Turnstile is loaded only once you start filling it in, and runs in invisible mode with no visible check shown to you; on the contact form, it is embedded as a visible widget when the page loads.
This analysis starts as soon as the script loads. For the analysis, Turnstile evaluates various information (e.g., IP address, time spent on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Cloudflare. This data is not merged with other data sources.
The storage and analysis of the data is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in protecting the test form from abusive automated requests and spam.
The processing of data is based on Standard Contractual Clauses, which you can find here: https://www.cloudflare.com/cloudflare-customer-scc/. For more information on Cloudflare Turnstile, please see Cloudflare's Turnstile Privacy Policy Addendum and the data processing addendum.
The company is certified under the "EU-US Data Privacy Framework" (DPF): https://www.dataprivacyframework.gov/participant/5666.
6. PerfDelta test reports
This section describes the data processing that is specific to PerfDelta's actual function and is not covered by the general sections above.
When you run a test, PerfDelta processes the website URL you enter and any optional competitor URLs, in order to generate and store your report at its own shareable link. This also creates and stores a mobile and a desktop screenshot of the tested homepage. No email address is collected for the test report itself, and no follow-up email is ever sent (only if you reach out separately via the contact form or by email, see section 4, will your name and email address be processed). Reports, including the screenshots, are deleted automatically 365 days after creation.
Data recipients for this processing are Google (PageSpeed Insights API and Chrome UX Report API), used to measure the pages you submit for testing, and Mistral AI SAS, 15 rue des Halles, 75001 Paris, France.
The texts of the optimization notes come from PerfDelta's recommendation library. Where a text for a platform or a third-party service is missing, a language model writes it once and it is stored for all later reports. For this we transmit only the type of the finding (for example "unused JavaScript"), the detected platform (for example WordPress) and, for third-party services, their name (for example Google Tag Manager), but no URLs, measured values or other data of the tested website. The model is provided by Mistral AI; texts written in the background are also produced by OVHcloud AI Endpoints (OVH SAS, France), which receives no personal data. To assign the website to an industry we transmit to Mistral AI the domain and the title, description, headings and a short text excerpt of the start page. We do not transmit email addresses, IP addresses or account data to Mistral AI. Personal data can only be included if it appears in publicly accessible content of the start page.
Mistral AI processes this data as a processor. The data processing agreement under Art. 28 GDPR is part of Mistral AI's terms (Data Processing Addendum). Use of our data for training Mistral AI's models is disabled. Under that agreement, transfers outside the European Economic Area take place only to countries with an adequacy decision of the European Commission or on the basis of the Standard Contractual Clauses. Mistral AI publishes the current list of sub-processors in its Trust Center. For further information see the Mistral AI privacy policy.
This processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in providing the free testing service you actively request.
PerfDelta is a free tool provided as is, without warranty. Results are based on Google PageSpeed Insights and Chrome UX Report data and may vary between runs.
7. Accounts, projects and monitoring
This section covers the data processing specific to registered accounts (free or paid), which is not covered by the general sections above.
Registration and login
Creating an account requires an email address and a password, which we store as a salted hash, never in plain text, or a "Sign in with Google" account. With Google sign-in, Google shares your email address, name and a unique account identifier with us for the purpose of creating and recognising your account; we do not receive your Google password. We send a verification link to confirm your email address, and, if you request one, a password reset link. This processing is based on Art. 6(1)(b) GDPR (performance of a contract) and, for the verification/reset tokens, on our legitimate interest in a secure account system (Art. 6(1)(f) GDPR).
Projects, monitored URLs and competitor tracking
A registered account can create projects, add URLs to monitor, and record competitor domains for comparison. We store this data, together with the resulting scan history, to provide the dashboard and the monitoring feature you configured. This processing is based on Art. 6(1)(b) GDPR.
Monitoring and report emails
If you enable monitoring for a project, we send you email alerts when a monitored page's score drops significantly, and, if you enable it, a weekly performance report. These emails go to your account email address, or to a separate report email address you can optionally set for a project. This processing is based on Art. 6(1)(b) GDPR (performance of the monitoring feature you activated).
Team members
If you invite a team member to your account, we store their email address and an invitation link until they accept or you revoke the invitation. This processing is based on Art. 6(1)(b) GDPR.
API keys
Paid plans can generate API keys for programmatic and MCP access. We store a cryptographic hash of the key, never the key itself, together with a name you choose and the time it was last used. This processing is based on Art. 6(1)(b) GDPR.
Storage duration
Account data is stored for as long as your account exists. If you delete your account, or if we delete it under Sections 3 or 7 of our Terms of Service, associated projects, monitored URLs, and API keys are deleted with it, subject to statutory retention obligations (e.g. tax or commercial law) that may apply to billing-related records.
8. Payment processing for paid plans
Paid plans (Solo, Agency, Scale) are billed through Paddle.com Market Ltd ("Paddle"), which acts as our reseller and merchant of record for these transactions (see also Section 4 of our Terms of Service).
Before checkout, we ask you to confirm that you are ordering as a business under section 14 BGB and store that confirmation together with a timestamp and a hashed, not plain-text, version of your IP address, for evidentiary purposes.
To complete a purchase, Paddle collects your email address, billing address, and, if provided, your VAT identification number and business name, and processes your payment details directly; PerfDelta never receives or stores your card or bank details. Paddle acts as an independent controller for this payment transaction and processes this data under its own privacy policy: https://www.paddle.com/legal/privacy.
Paddle notifies us of the resulting subscription status (active, past due, canceled, etc.), the plan and billing interval purchased, and the billed amount and currency, which we store to grant or remove access to paid features and to reconcile your account's status. This processing is based on Art. 6(1)(b) GDPR (performance of the paid plan's contract) and Art. 6(1)(c) GDPR (our tax and commercial-law record-keeping obligations).
Subscription and billing records are retained for the statutory retention periods under German tax and commercial law after the subscription ends.
Contact for data protection requests: [email protected]