# Privacy Policy

**Last updated: June 2026**

This Privacy Policy explains how Qurmy (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use the Qurmy website at qurmy.com and the Qurmy platform at dashboard.qurmy.com (together, the “Service”).

Qurmy is operated from the United Kingdom. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any questions about this policy, please contact us at admin@qurmy.com.

## 1. Data Controller

Qurmy is the data controller responsible for your personal data. You can contact us at admin@qurmy.com for any data protection queries.

## 2. What Data We Collect

We collect the following categories of personal data:

**Account information.** When you register, we collect your name, email address, and password (stored in hashed form). If you subscribe to a paid plan, we also collect your billing details, which are processed by Stripe (we do not store your full card number).

**Website data you submit.** When you add a website to the Service, we collect and process publicly available data from that website, including page content, metadata, server response headers, SSL certificate details, and DNS records.

**Usage data.** We collect information about how you interact with the Service, including pages visited, features used, and actions taken. We use Plausible Analytics for this purpose, which does not use cookies and does not collect personally identifiable information.

**Contact form data.** If you contact us through the website, we collect your name, email address, and message content.

**Technical data.** We collect your IP address, browser type, and device information for security purposes (such as bot protection via Cloudflare Turnstile and rate limiting).

## 3. How We Use Your Data

We use your personal data for the following purposes:

**To provide the Service.** Processing your account registration, managing your subscription, running analyses on websites you submit, and delivering reports and alerts. The lawful basis for this processing is performance of a contract (Article 6(1)(b) UK GDPR).

**To communicate with you.** Sending account-related notifications (such as password resets, subscription confirmations, and monitoring alerts), and responding to your support enquiries. The lawful basis is performance of a contract and, where applicable, your consent.

**To improve the Service.** Analysing usage patterns (via Plausible Analytics) to understand how the Service is used and to identify areas for improvement. The lawful basis is our legitimate interest in improving the Service (Article 6(1)(f) UK GDPR).

**To ensure security.** Detecting and preventing fraud, abuse, and unauthorised access. The lawful basis is our legitimate interest in maintaining the security of the Service.

**To comply with legal obligations.** Where we are required to retain or disclose data by law.

## 4. Cookies

We use only essential cookies that are strictly necessary for the Service to function (such as authentication session cookies). We do not use tracking cookies or advertising cookies.

Our analytics provider, Plausible, is cookieless and privacy-focussed. No consent banner is required for essential cookies under UK GDPR.

Cloudflare may set a security cookie (\_\_cf\_bm) to distinguish between humans and bots. This is classified as a strictly necessary cookie.

## 5. Data Sharing and Third Parties

We do not sell your personal data to third parties. We share data with the following service providers, who act as data processors on our behalf:

**Stripe** (payments). Processes your payment information when you subscribe to a paid plan. Stripe’s privacy policy is available at stripe.com/privacy.

**Cloudflare** (security and content delivery). Provides CDN, DDoS protection, and bot management. Cloudflare’s privacy policy is available at cloudflare.com/privacypolicy.

**Plausible Analytics** (usage analytics). Provides privacy-focussed, cookieless analytics. Plausible does not collect any personally identifiable information. Their privacy policy is available at plausible.io/privacy.

We may also disclose your data where required by law, regulation, or court order, or where necessary to protect our legal rights.

## 6. Where Your Data Is Stored

Your data is stored on servers located in the United Kingdom and the European Union. We do not transfer your personal data outside the UK and EU unless required by a third-party processor (such as Stripe, which may process data in the United States under appropriate safeguards, including Standard Contractual Clauses).

## 7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you close your account, we will delete your personal data within 90 days, except where we are required to retain it for legal, accounting, or regulatory purposes.

Usage analytics data collected by Plausible is aggregated and does not contain personal data, so retention limits do not apply.

## 8. Your Rights

Under UK GDPR, you have the following rights:

**Right of access.** You can request a copy of the personal data we hold about you.

**Right to rectification.** You can ask us to correct any inaccurate data.

**Right to erasure.** You can ask us to delete your personal data (subject to legal retention requirements).

**Right to restriction.** You can ask us to restrict the processing of your data in certain circumstances.

**Right to data portability.** You can request your data in a structured, commonly used, machine-readable format.

**Right to object.** You can object to processing based on our legitimate interests.

**Right to withdraw consent.** Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at admin@qurmy.com. We will respond within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

## 9. Data Security

We take appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (TLS/SSL), hashed password storage, rate limiting, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

## 10. Children

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at admin@qurmy.com and we will delete it promptly.

## 11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date. We will make reasonable efforts to notify you of material changes. Your continued use of the Service after any changes constitutes your acceptance of the revised policy.

## 12. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at admin@qurmy.com.