Privacy policy
Effective November 4, 2026
This policy explains what personal information Sundrell collects through this website, its free website check, its prospecting emails and the services of its businesses (including Sundrell Web Care), why, how long we keep it and what you can do about it. We follow the EU General Data Protection Regulation (GDPR), which applies to us as a French business. For people in the United States, the section "US residents" below covers what US laws such as the California Online Privacy Protection Act (CalOPPA) ask us to tell you.
Who is responsible
The data controller is Thomas Richard Roger, Entrepreneur individuel (EI), micro-entreprise, trading as Sundrell, SIRET 13250798900011, 3 rue des Alpilles, 13280 Arles, France. Contact: [email protected]. See also our legal notice.
What we collect, why, and on what basis
| Information | Why | Legal basis | How long |
|---|---|---|---|
| Web address you check and the results | Run the check and show the report; share it by link | Your request (legitimate interest) | Saved reports deleted after 30 days |
| IP address (briefly) | Limit how many checks or messages one connection can send, to stop abuse | Legitimate interest (security) | Not stored beyond the server's short-term memory and standard hosting logs |
| Messages, quote requests and care-plan requests: name, business, email, website, message, problems selected | Reply, prepare a quote, review your website, do the work you approve | Steps before a contract, at your request | Deleted automatically from our website systems 2 years after we receive them; copies in our email inbox are deleted at the latest 3 years after our last exchange. If you become a customer, the next line applies. |
| Customer details, work log, repair records, invoices | Provide repairs and care plans, keep accounting records | Contract; legal obligation (accounting) | While you're a customer, then deleted automatically 5 years after the plan ends; repair records 6 years after the last update; invoices 10 years (French accounting law) |
| Business contact details found on a business's own website (business email, business name, website, where and when the address was published) | Send a single email to that business about a problem we found on its website | Legitimate interest in business-to-business prospecting, for a message related to the recipient's business | 3 years from collection or from the business's last reply; older records are deleted from our prospecting file at least once a year |
| Opt-out list (email address or domain, date) | Make sure we never contact you again after you say no | Legal obligation and legitimate interest | As long as needed to respect your choice |
| Backups of care-plan customers' websites (they can include personal information collected by your own website, such as form entries) | Restore your website after a problem | Contract with the website owner, as their processor | 30 days, then replaced by newer backups |
| Record of actions in our admin area (time, action, website concerned, our own connection address) | Security and accountability for changes we make | Legitimate interest (security) | 400 days |
| Email tips, only if you checked the box | Send occasional website tips | Your consent, with the date recorded | Until you unsubscribe |
This website doesn't use advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which doesn't use cookies or identify you. Our forms use Cloudflare Turnstile to keep out spam robots. We don't make automated decisions about you; the website check only describes a website.
Prospecting emails
If you received an email from us about your website, we found your business address published on your business's website, for business inquiries. We keep a note of where and when it was published. We don't use software that harvests email addresses, and we don't contact addresses where the website says it doesn't want sales emails. Every email tells you who we are and how to say no: reply "no thanks" or unsubscribe here, and we stop within 5 business days at most (in practice straight away). An unsubscribe made on this website is added to the opt-out list we check before every prospecting email.
Who else handles it
We use a small number of service providers, who act on our instructions under a data processing agreement. Some of them process information outside the European Union, mainly in the United States.
| Provider | What it does for us | Where | Safeguard for transfers outside the EU |
|---|---|---|---|
| Cloudflare, Inc. | Hosts the website, runs the check and the monitoring of care-plan websites, stores form messages and sign-ups | Worldwide network, company in the United States | EU–US Data Privacy Framework certification, and its data processing agreement |
| Stripe | Processes payments. Card details go straight to Stripe and never reach us | EU and United States | EU–US Data Privacy Framework certification, and its data processing agreement |
| Resend | Delivers form messages to our inbox, and alerts and monthly reports to care-plan customers | United States | EU–US Data Privacy Framework certification, and its data processing agreement |
| Business email, storage of care-plan website backups (Google Drive), the optional mobile speed test (PageSpeed Insights) and the fonts used on this site | Worldwide, company in the United States | EU–US Data Privacy Framework certification, and its data processing agreement |
You can check each company's certification on the official list at dataprivacyframework.gov, and ask us for a copy of the relevant safeguards.
We don't sell or rent personal information.
Security
Access to our accounts is protected by strong passwords and two-step verification. When we work on a customer's website we use a separate login of our own, never the customer's password, and remove it when the work ends. Shared report links are random, unlisted and not indexed by search engines, but they aren't password-protected: anyone with the link can open the report for 30 days.
US residents
- What we collect and why: the categories of personal information listed in the table above, for the purposes listed there.
- Who we share it with: only the service providers listed in this policy, who process it for us (hosting, email delivery, payments). We don't sell or rent personal information, and we don't share it for cross-context advertising.
- Other parties collecting information on our site: none for advertising. Cloudflare provides our hosting and privacy-friendly visit statistics without cookies, and Stripe handles payments on its own pages.
- "Do Not Track": our website doesn't track visitors across other websites and doesn't use advertising trackers, so it treats every visit the same way whether or not your browser sends a Do Not Track signal.
- Reviewing or correcting your information: email us or use the contact form, as described under "Your rights".
- Changes to this policy: we update the date at the top of this page, and for important changes we also email the customers concerned.
Your rights
You can ask to see, correct or delete the personal information we hold about you, to limit its use, to receive a copy, or to object to its use, including for prospecting at any time and without giving a reason. Contact us and we'll reply within one month. If you're unhappy with how we've handled your information, tell us first and we'll try to fix it. You can also complain to the French data protection authority (CNIL, cnil.fr).
Contact
Email [email protected] or use our contact form.