Privacy
Last updated: 3 October 2026 · version 2026-10-03.1
This is an English translation provided for convenience. The legally binding version is the Spanish original; if they differ, the Spanish version prevails.
Here we explain, with no small print, what personal data we process at WebBorder, what for, on what legal basis, for how long and what rights you have, in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Controller
Carlos Alvarez Santana, Tax ID 16814826D, with address at Camino Viejo del Monte, 18, 35300 Santa Brígida (Las Palmas), Spain. For any question about your data: soporte@webborder.es.
2. What data we process, what for and why we may
| What for | What data | Legal basis | How long |
|---|---|---|---|
| Letting you know when WebBorder opens and when its paid plans arrive (waiting list) | Email, date, the form you signed up from and the language of the page | Your consent, by ticking the box (art. 6.1.a GDPR) | Until we have told you about the opening and the paid plans, or until you withdraw your consent. If they never happen, the list is deleted. |
| The free analysis on the home page: analysing the website you ask us to and preventing abuse | The address of the analysed website, the result, the date and a fingerprint of your IP (your IP passed through a one-way function with a key that changes every day: it lets us count how many analyses you request, not know who you are) | Our legitimate interest in providing the analysis you request and limiting its abuse (art. 6.1.f GDPR) | 30 days; then everything is deleted. |
| Creating and keeping your account and providing the service | Email, name (if you give it), password (stored only as an encrypted hash, never in plain text), plan, preferences, the websites you add and the date you accepted the terms | Performance of the contract you accept when signing up (art. 6.1.b) | While you have the account. When you delete it, everything is deleted at once (from the backups, within 3 days at most). |
| Teams (Professional plan): letting an account holder invite other people, who then log in with their own access | The invited person's email, the date of the invitation and who sent it; once they join, the same as any account (email, name if given, password as a hash, preferences) and who approved each change | The account holder's legitimate interest in organising their team (art. 6.1.f) for the invitation; once they join, the contract the person accepts (art. 6.1.b) | The invitation, 7 days if not accepted, or until it's cancelled. The access, while the person remains on the team: if the account holder removes them or they leave, it is deleted at once. Their name stays in the history of the changes they approved while the website exists. |
| Sending you change alerts and service emails (confirming your email, recovering your password, changes to the terms) | Email and the content of the alert | Performance of the contract (art. 6.1.b) | Alerts stay in your dashboard while you have the account. |
| Protecting the service against abuse (limits on login attempts, server technical logs) | IP address, date and time, requested page and browser | Legitimate interest in keeping the service secure (art. 6.1.f) | Attempt limits, at most one hour and only in memory. Technical logs, 30 days. |
| Meeting legal obligations (for example, invoicing once the service is paid, or requests from authorities) | The data each obligation requires | Legal obligation (art. 6.1.c) | Whatever the law requires (for example, six years for accounting records). |
We don't use your data for advertising, we don't profile you or make automated decisions with effects on you, and we don't sell or pass your data on to anyone. Giving us data is not mandatory, but without an email and password we can't create an account for you.
3. Data on the websites you monitor
To do its job, WebBorder visits your website and stores what it sees there: texts, links, image and script addresses, and the changes between one visit and the next; the last good version of the code of each page and of each script of the site itself, so we can show you exactly what changed (it is replaced by the new one when you approve a change); and, from the availability checks, only whether it responded, with which code and how long it took (summarised by hour for 90 days, and outages while the website remains registered). In addition, on the plans that include evidence (Starter and Professional), when we detect a change we keep as evidence a copy of the affected pages and scripts exactly as the website served them at that moment (their content, the headers and the IP address of the server that responded), signed by WebBorder, so you can use it if you need to prove an attack. Those copies are kept while the website remains registered and deleted when you remove it or delete your account. If personal data appears on your website (for example, someone's name or phone number), it is stored too. For that data, you are the controller, as owner of the website, and WebBorder acts as processor on your behalf, under the annex to the Terms of service. We only monitor websites whose ownership or authorisation has been proven.
4. Who else is involved
To provide the service we use providers who process data on our behalf, under a processing agreement and with the guarantees of the GDPR:
- IONOS SE (Germany): server hosting, within the European Union.
- Volentio JSD Ltd. (Globalping, United Kingdom): when a monitored website stops responding, and unless it is turned off in its settings, we send it that website's address to check it from other countries. We send it no data about you as a customer. Its results (whether the website responded, the code and the time) are public on its platform. The United Kingdom has an adequacy decision from the European Commission.
- Google Ireland Ltd. (Ireland), if emails are sent through Google: delivery of the service emails. Google may process data outside the European Economic Area; those transfers are covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
Beyond that, we would only disclose data to authorities when a law requires us to.
5. Your rights
You can ask at any time to access your data, rectify it, erase it, object to processing, restrict it or take it with you (portability), and to withdraw your consent where that is the basis, without affecting what was done before. You can do much of this yourself from the dashboard: download all your data, change it and delete your account. For anything else, write to soporte@webborder.es; we will reply within one month. If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the supervisory authority of your own country.
6. Security
The connection is always encrypted (HTTPS). Passwords are stored with argon2id and sessions as a hash, so they can't be used even with access to the database. Each account can only see its own websites, the data is on a server in the European Union in an area not reachable from the web, and the service runs isolated from the rest of the server. If there were a security breach affecting your data, we would tell you and notify the AEPD as the law requires. We make a daily backup of the service, only to be able to restore it if the server fails: it is kept on the same server and on a computer belonging to the owner in Spain, with restricted access, and each backup is deleted after 3 days. So whatever you delete also disappears from the backups within 3 days at most.
7. Minors
WebBorder is a service for people over 18 and professionals who manage websites. We do not knowingly process data of minors.
8. Cookies
The public website uses no cookies. The dashboard uses a single technical cookie, essential to keep you logged in. Details in the cookie policy.
9. Changes to this policy
If we change it in any important way, we will tell you by email or in the dashboard before it applies. The version in force is always the one on this page, with its date at the top.