Privacy Policy

This Privacy Policy describes how Wunderly collects, uses, discloses and otherwise processes personal data in connection with the Wunderly website, applications, analytics script, forms and related services (the "Service"), and the rights available to you.

1. Who We Are

Wunderly is operated by Zachary Johnson, an individual doing business as Wunderly, Kentucky, USA. Questions about this Privacy Policy may be sent to privacy@usewunderly.com.

The Service involves several kinds of people, whose data is processed in different capacities:

• Customers hold a Wunderly account and add their websites to it. For account and billing data, Wunderly determines what is collected and why, and acts as the controller.
• Visitors visit a customer's website, where the customer has installed Wunderly's analytics script. Requesters send a customer's contact form or quote form. The customer determines what is collected about them and why, and acts as the controller; Wunderly processes that data on the customer's behalf as a processor, under our Data Processing Addendum.
• People who use the free site check on our website. For the check, Wunderly acts as the controller.
• Visitors to our own website, usewunderly.com, and people who send its support form. We use Wunderly on our own website, in exactly the way a customer does, and we are the controller of what it collects there: the same data as sections 3.2 and 3.3 describe, with us in the customer's place. The app and the sign-in pages are not measured.

2. Cookies and Similar Technologies

Wunderly sets one cookie, for customers only: when a customer signs in on usewunderly.com, a cookie keeps them signed in. It is strictly necessary and is used for no other purpose. The analytics script sets no cookies and stores nothing on a visitor's device, and Wunderly's forms set no cookies. If a customer chooses to pay, Paddle's checkout opens over the page; it is operated by Paddle under Paddle's own privacy policy, and it loads only when the customer starts a checkout.

So that a requester can come back to an unfinished form, their browser keeps one token in local storage on the website where the form is. It is not a cookie, it is not shared with other websites, and it identifies only that requester's own answers. The form tells them that their answers save as they go.

3. Information We Collect

3.1 From customers

• Email address, to send sign-in links. The Service does not use passwords.
• The workspace's name; each website's name, address and time zone; the two forms and their settings; and the addresses the customer adds to receive request emails and the weekly report.
• A record of each sign-in, stored as a hash of the cookie, never the cookie itself.
• Billing records: which websites are on the plan, the plan's dates and Paddle's identifiers. Payment details are held by Paddle, never by us.

3.2 From visitors, on behalf of the customer

When a visitor's browser sends neither Do Not Track nor Global Privacy Control, the analytics script sends, for each page they open:

• the page's address without its query string, apart from any utm campaign tags;
• the name of the website they came from, never its page;
• whether the screen is a phone, a tablet or a computer, never its size;
• a tap on the customer's phone number, email address or a map link, and that one of the customer's own forms was sent, never what was in it.

We also record the visitor's country, from Cloudflare. A visitor is counted under a key computed from a random value that changes every day, the visitor's network address, their browser's description and the website. The random value is deleted the day after its day, so the key cannot be traced back to the address or linked to another day. We never store the network address. For "on the site now", a short form of the key is kept for 5 minutes.

3.3 From requesters, on behalf of the customer

• The requester's answers, saved as they are typed so they can come back later, including any name, email address or phone number the form asks for.
• The estimate the quote form displayed, if it displays one.
• When they send the form, the pages they looked at on the customer's website that day, in order, and the website they came from. Both forms say so directly above the Send button. Nothing is attached when their browser sends Do Not Track or Global Privacy Control.
• Their country, from the network the request came through, to decide which consent wording the quote form shows. We do not store network addresses.
• Whether they asked for their estimate by email, when, and which wording the form showed, so that the customer can show how consent was obtained.
• Whether an email was sent to them and delivered. No email of ours tracks whether it was opened or which links were clicked.

3.4 The free site check

When someone uses the free site check, we keep the address of the page they asked us to check and what the check found, for 7 days, at its own link. Anyone with the link can see it, and someone who asks to check the same address within the hour is shown the same result. We do not ask who they are. To limit how often the check runs, we count checks from each network address for up to a day, under a code derived from the address and a random value that changes every day, and Cloudflare's spam check (Turnstile) runs on each request. We never store the address itself.

3.5 The weekly site checks

For customers' websites, and for a page checked by the free site check, our crawler WunderlyBot reads public pages as any visitor could. It keeps each page's address, status, title and description while a check runs, and keeps what it found (an address, a kind of problem and what was seen), speed measurements and accessibility results. It records nothing about anyone who visits those pages.

3.6 From people who report a form

When someone reports a form, we keep the link, the description provided and, if given, the reporter's email address, so we can act on the report and reply. The report is sent to our abuse mailbox. We do not keep the reporter's network address, and we never disclose the reporter's email address to the form's owner. The reporter's email address is deleted 90 days after the report is handled; the report itself is kept to protect the Service from repeat abuse.

3.7 To operate and protect the Service

Counts of requests and errors, without names or answers. An error record holds the page's address without its query string, and never a requester's answers. Requests from each network address are counted for up to two hours to limit floods, under a code derived from the address and a random value that changes every day. The text of published forms is checked for questions requesting passwords or card numbers; see how we find abuse.

4. How We Use Information

We use the information described above to:

• count each customer's visitors, who reached out and what they looked at, and show it to the customer with the methods defined on How we count;
• display the customer's forms, save answers and deliver each request to the customer by email;
• send a requester the estimate they ask for, from the customer's name;
• check customers' websites each week, and run the free site check when someone asks;
• send customers their weekly report and notices about their account and plan;
• sign customers in, keep the Service secure and prevent abuse.

We do not sell personal data, display advertising, combine visitors' data across customers, or use any of it to train a model or system.

Legal bases. For customers' account data, we rely on the performance of our contract with the customer, and on our legitimate interests in securing the Service and preventing abuse. For the free site check, we rely on our legitimate interest in showing what Wunderly does and on the request of the person using it. For visitors to our own website and people who send its support form, we rely on our legitimate interest in understanding how our website is used and in answering the person who wrote to us. For visitors' and requesters' data on customers' websites, the customer, as controller, determines the legal basis and is responsible for informing them.

5. The Estimate Email

A quote form can email a requester their estimate when they ask for it. The form says what will be sent under the button before they press it. Requesters in the EU, the UK, Iceland, Liechtenstein, Norway and Switzerland are asked with an unticked checkbox instead. Wunderly sends no other email to requesters, and no marketing email to anyone. Every email to a requester contains a link to delete their data, which takes effect immediately.

6. Sharing and Subprocessors

The companies below process data on our behalf. We will announce any change on the changelog at least 30 days before it takes effect.

We may also disclose information where required by law, or where necessary to protect the rights, property or safety of Wunderly, our users or others.

7. Data Location and International Transfers

The Service's database, answers still being typed and nightly backups are held with Cloudflare in eastern North America. A request is handled by the Cloudflare location nearest the person making it. Our scheduled jobs, queues and the browser the site checks use run on Cloudflare's network, read from and write to that storage, and keep nothing elsewhere. Every email the Service sends goes through Cloudflare's email service, and Cloudflare keeps delivery records and our services' logs for a limited time under its data processing terms. When we access a workspace for support (Section 10), we read it from where we are.

Where personal data is transferred outside the EU, the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum) and, where a subprocessor is certified under it, the EU-U.S. Data Privacy Framework, as set out in our Data Processing Addendum.

8. Data Retention

• Each page a visitor opened, and each tap or form sent: 90 days.
• Daily totals per website (no keys, no addresses): 25 months.
• The daily random value behind visitor keys: deleted the day after its day.
• Unfinished answers: deleted 30 days after the requester last touched them. A count of where they stopped, with no answers or contact details, is kept for the customer's figures.
• Sent requests: until the customer deletes them, the website or their account.
• The weekly checks: a check's page details are deleted when it ends; what it found, once resolved, and accessibility results are kept 90 days; speed measurements 13 months.
• Free site check results: 7 days. Their counts per network address: up to a day.
• Sign-in links: valid for 15 minutes; used or expired links are deleted a day later. A sign-in lasts 30 days.
• Addresses that unsubscribed, bounced or asked to be deleted: kept as one-way hashes, so that we never email them again.
• Backups: a copy of the database is made every night and kept for 30 days, so deleted data may remain in a backup for up to 30 further days.
• Error records: for as long as necessary to diagnose and resolve the error. They contain no answers.

When a customer's plan ends, nothing is deleted early: their data stays under the periods above until they delete it.

9. Security

We protect personal data with HTTPS everywhere, encryption at rest by our host, sign-in links, sessions and emailed links stored only as hashes, a spam check on every form, rate limits, and nightly backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Access by Our Personnel

We access a workspace's data only to provide support, when the customer asks or a report requires it. Opening it is an explicit step in our operations console, lasts one hour, and is recorded in an audit log every time.

11. Your Rights

• Visitors can stop being counted by turning on Do Not Track or Global Privacy Control. Because the key that counts them can't be traced back to them, we cannot find one visitor's records; the website's owner is the place to ask (for usewunderly.com, that is us).
• Requesters may use the "Delete my data" link in any email from a form, or contact the website's owner. If the owner cannot be reached, write to us and we will handle the request.
• Customers may export their forms' requests as a spreadsheet, delete a website, or delete their whole account, and may ask us to delete any one request. Deletion is permanent, not hidden.
• Anyone may ask us what personal data we hold about them, ask us to correct or delete it, or object to its processing, at privacy@usewunderly.com. You also have the right to lodge a complaint with your data protection authority.

12. Children

Customer accounts are not intended for anyone under 18, the minimum age set out in the Terms of Service. We do not knowingly create accounts for children.

13. Changes to This Policy

When this Privacy Policy changes, the "Last updated" date above changes and the changelog describes what is different.

14. Contact Us

Requests and questions about this Privacy Policy may be sent to privacy@usewunderly.com.