Last updated: July 2026
The short version
- This site sets no cookies and stores nothing on your device — no localStorage, no session storage, no identifiers of any kind.
- Your IP address is never stored by us. Geography is reduced to a two-letter country code at the network edge.
- Our performance measurements are processed on our own server in Germany, not sent to an analytics company.
- Visitors are counted with a daily-rotating, salted hash whose salt is destroyed every day — after that, the data can no longer be linked to anyone, including by us.
- No advertising, no cross-site tracking, no selling of data. Ever.
1. Who is responsible
The party responsible for data processing on this website (the "controller" under the GDPR) is:
[Company / sole trader name]
[Street address]
[Postal code, City, Country]
Email: privacy@siteflare.eu
Full company identification is on our Imprint page.
2. Hosting and content delivery
This website is delivered by Cloudflare (Cloudflare, Inc., USA — via its EU/global edge network), acting as our processor. Like virtually any host, Cloudflare processes technical request data (IP address, requested URL, time, user-agent) to deliver pages securely and defend against abuse, and may keep short-lived technical logs for that purpose. Cloudflare is certified under the EU–US Data Privacy Framework and offers standard contractual clauses for transfers.
- Purpose: serving the site fast and securely, DDoS protection
- Legal basis: our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR)
3. Performance monitoring on this site
We use our own monitoring tool — the same one we offer to clients — to measure how fast and stable this site is for real visitors. It is deliberately built so that ordinary browsing requires no consent banner: the script reads and stores nothing on your device (no cookies, no localStorage, no fingerprinting), so the "terminal equipment" rules of the ePrivacy Directive (§ 25 TTDSG) are not engaged, and the little data it processes is minimised as follows.
What the script measures and sends to our own server located in Germany:
- Performance metrics — Core Web Vitals (LCP, INP, CLS, FCP, TTFB), page-load and network timing, and summary statistics about resources the page loaded (counts and sizes, plus which page element drove a metric)
- Technical context — browser family and major version (e.g. "Firefox 128"), viewport size class (e.g. "phone"), connection type (e.g. "4g"), device class (mobile/desktop)
- Geography — a two-letter country code resolved from your IP at the network edge; the IP address itself is never stored, logged, or seen by our application
- Interaction structure — where on the page clicks happen (as percentages) and the clicked element's structural name (e.g.
a.nav-link) — never text you see, never anything you type — plus how far down the page you scrolled - JavaScript errors — the error message and type only, to catch broken pages
How visits are counted without identifying you: our server derives a short-lived visit key as a cryptographic hash of (site, country code, browser user-agent) together with a random salt that rotates and is destroyed every day. The user-agent is hashed and immediately discarded — it is not stored. Once a day's salt is deleted, that day's visit keys can never again be connected to any person or device, by anyone. There is no identifier that persists across days.
- Purpose: measuring and improving the speed, stability, and usability of this site
- Legal basis: our legitimate interest in understanding and improving our own service (Art. 6(1)(f) GDPR)
- Storage location: our own server in Germany — no analytics provider receives this data
- Retention: raw measurement data is deleted automatically after 13 months
One third-party request: the measurement script loads the open-source web-vitals library from the jsDelivr CDN (jsdelivr.com). Like any resource fetch, that request exposes your IP address and user-agent to jsDelivr's servers under jsDelivr's privacy policy. We plan to self-host this file to remove even that request.
4. Forms you submit
If you use the free-audit form or the contact form, we process only the information you choose to enter so we can respond to you.
- Free audit: the website URL you submit and, if you add it, your email address — stored on our server in Germany together with the generated report
- Contact: your name, email address, and message
Legal basis: taking steps at your request prior to entering a contract, and answering your enquiry (Art. 6(1)(b) and (f) GDPR). We do not use this information for marketing unless you separately and explicitly ask us to.
5. Monitoring we run for clients
Where our monitoring runs on a client's website, that client is the controller for their visitors' data and we act as their processor under a data-processing agreement (Art. 28 GDPR). The same technical guarantees described in section 3 apply: nothing stored on visitors' devices, no IP retention, daily-rotating salted visit keys, processing in Germany. This policy covers siteflare.eu itself; client sites carry their own privacy notices.
6. Sharing your data
We do not sell your data and do not share it for advertising. We share data only with the processors strictly needed to run the site — currently Cloudflare (site delivery) and jsDelivr (one script fetch, see section 3) — and where the law requires it. Our measurement data itself stays on infrastructure we operate.
7. Your rights
Under the GDPR (and equivalent UK law) you have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interest. You may also lodge a complaint with a supervisory authority — in Germany, the data-protection authority of your or our federal state.
A practical note: because monitoring data is stripped of identifiers by design (no IP, no persistent ID, daily-destroyed salt), we are typically unable to locate any individual's records in it — an inability the GDPR anticipates (Art. 11). Form submissions, of course, we can locate and will happily delete on request.
To exercise any of these rights, email privacy@siteflare.eu or use our contact form.
8. Changes to this policy
We may update this policy as our services or the law change. The "last updated" date above always reflects the current version.