What we collect, and what we do with it.

1. Who we are

Pressfort is a service from Launch Creative Ltd, a company registered in England and Wales (company number 09758806).

For the personal data described in this policy, Launch Creative Ltd is the data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). If you have a question about your data, email hello@getpressfort.com.

2. What we collect and why

If you ask for a free security check

• What: your name, email address and website address, plus how many sites you have and your message if you give them.
• Why: to check your site, email you the report and reply to any questions. The check only looks at what your site shows publicly. It doesn't log in or change anything.
• Lawful basis: our legitimate interest in answering your request, which you've asked us to do.
• We also keep a scrambled (hashed) version of your IP address to stop the form being misused. We can't turn it back into your IP address.

If you buy Pressfort

• What: your name, email address, country, the website you're protecting and your subscription details, such as the renewal date and currency.
• Why: to set up and run the service, send you sign-in links, alerts, reports and renewal reminders, and fix your site if it's hacked.
• Lawful basis: to perform our contract with you.
• We don't see or store your card details. Paddle, our payment partner, handles payments. See section 4.

When you sign in

We use your email address to send you a one-time sign-in link, and a cookie to keep you signed in. There are no passwords to store.

Emails we send

We only send emails about your security check or your subscription, such as reports, alerts and renewal reminders. We don't send marketing emails, and we don't track whether you open our emails or click their links.

We don't sell your data, use it for advertising or make automated decisions about you that have legal or similarly significant effects.

3. Data on your website

To protect your site, Pressfort takes backups, scans files, keeps an activity log and may log in to fix problems. Your site may hold personal data about your own customers or visitors, such as orders, form entries or user accounts.

For that data, you are the controller and we act as your processor. We only use it to provide Pressfort, following your instructions under our terms. We don't look through it unless we need to fix something, and we never use it for anything else. We keep it confidential and use the providers listed below, who are bound to protect it.

4. Who we share it with

We use a small number of trusted providers to run Pressfort. They only get the data they need to do their job.

• Paddle sells Pressfort to you as our reseller and handles payment, tax and invoices. Paddle collects your payment and billing details directly and is responsible for them under its own privacy policy.
• WP Remote (run by BlogVault) powers the protection: updates, backups, scanning, the firewall, monitoring and reports. It holds your site's backups and data about your site.
• Cloudflare hosts this website, stores files and protects our forms from spam with Turnstile, which checks your browser for signs of a bot.
• Supabase hosts our database and handles sign-in.
• Postmark sends our emails.

We may also share data if the law requires it, or with a buyer if the business is ever sold, in which case this policy would still apply.

5. Data outside the UK

Some of our providers store or process data outside the UK, including in the United States and India. When that happens, we make sure it's protected: either the UK government has recognised the country as having adequate protection (including the UK-US data bridge), or we rely on the UK's approved contract terms for international transfers.

6. How long we keep it

• Free security checks: 12 months, then deleted automatically.
• Your account and subscription details: while you're a customer and for up to 2 years after your last subscription ends, in case you come back or there's a question about the service. You can ask us to delete them sooner.
• Backups of your site: up to 90 days on a rolling basis. When your subscription ends, we remove your site from WP Remote, which deletes its backups.
• Payment records: Paddle keeps these for as long as the law requires.

7. Cookies

We only use cookies the site needs to work. We don't use analytics or advertising cookies, so there's nothing to accept or decline.

• Currency choice (pf_country): remembers the currency you picked, for 6 months.
• Sign-in (names starting sb-): keeps you signed in to your account.
• Checkout and spam protection: Paddle may set cookies while you're paying, and Cloudflare may set cookies to protect the site and our forms.

8. Your rights

You have the right to:

• ask for a copy of the data we hold about you
• have it corrected if it's wrong
• have it deleted
• object to us using it, or ask us to limit how we use it
• receive it in a format you can take elsewhere

Email hello@getpressfort.com and we'll reply within one month. Some rights have limits. For example, we can't delete data while we still need it to run your subscription.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

9. Changes and contact

If we make important changes to this policy, we'll email customers before they apply. The date at the top shows when it was last updated.

Questions? Email hello@getpressfort.com.