Privacy
Effective date: September 2026 · Version 2026-09
This notice covers how the modpagespeed.com website and its services process personal data, and what the software you install does with data. We-Amp B.V. operates several websites; this page is the specific notice for modpagespeed.com. For the company-wide policy, see the We-Amp B.V. privacy policy, of which this is a part.
Who is responsible
The data controller is We-Amp B.V., a company registered in the Netherlands.
- We-Amp B.V., Castricum, the Netherlands
- KvK (Chamber of Commerce): 57898138
- VAT (BTW): NL852784429B01
- Privacy contact: privacy@we-amp.com
The software you run
mod_pagespeed 2.1 runs on your servers. It sends no telemetry to us and opens no outbound connection of its own accord. The only traffic that leaves a host is what you, the operator, configure: fetches to your own origin for the resources it optimizes and, when you enable browser analysis, requests to the pages you point it at (and whatever those pages load). Your visitors’ data never reaches We-Amp B.V., and we have no way to see it. This is true with or without a support subscription.
The predecessor lines — mod_pagespeed 1.15 and ModPageSpeed 2.0 — behave the same way for installs that run without a paid license: they never sent us anything. Installs of predecessor releases sold a production license may still contact our retired license-renewal endpoints; those endpoints no longer record anything and are being switched off as the last legacy terms expire.
Because of this, for most deployments We-Amp B.V. is not a processor of your visitors’ data at all. Where we do act as a processor for a business customer — for example during a support engagement in which you share logs or configuration with us — a Data Processing Agreement is available on request at privacy@we-amp.com.
What the website processes, and why
We keep data collection to the minimum each service needs. The activities below cover everything modpagespeed.com does with personal data.
Website analytics
We use a self-hosted Umami instance (umami.we-amp.com) to count page views and see which pages are useful. Umami is cookieless and does not build a profile across sites. It records aggregate signals such as page path, referrer, approximate region, browser and device type, plus a few named interactions on this site (for example, clicks on a download button). We do not use this data to identify individuals.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving the site, balanced against the low-impact, cookieless design.
Server logs and IP geolocation
Like any web server, ours keeps standard access logs: the connecting IP address, the request line, a timestamp, the referrer and the user agent. The server also looks up the connecting IP address in two DB-IP Lite databases held on the server itself (country, and autonomous-system number), refreshed monthly. The lookup happens on our server; the address is not sent to DB-IP or to any other third party for this. We use the country to show prices in your region where the site displays them, and to limit the administrative interface of our self-hosted analytics to addresses in the Netherlands (no visitor-facing effect). We use the network number to leave visits from datacenter and cloud-provider networks out of the site analytics; such visits are simply not counted, and an address that cannot be resolved is never dropped.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in operating and securing the site and in keeping its analytics meaningful.
PageSpeed Insights proxy (/analyze)
When you submit a URL on the /analyze page, our server forwards that URL to Google’s PageSpeed Insights API (operated by Google in the United States) and returns the result. The URL you submit may itself contain personal data if you choose to enter such a URL — please don’t. We also log and rate-limit by your IP address to prevent abuse of the shared API access.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in offering the tool and protecting it from abuse. Use of Google’s API is also subject to Google’s own terms and privacy policy.
AI-readability scanner (RenderPeek)
The AI-readability scanner renders a URL you submit so we can report how it looks to automated agents. Rendering runs on Google Cloud Run. As with the PageSpeed Insights proxy, we process the submitted URL and your IP address for the request and to rate-limit abuse. We do not retain the rendered page content beyond what is needed to return your result.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in offering the tool and protecting it from abuse.
Subscriptions
When you take out a support subscription or a hardened-builds subscription, we process your name, email address, organization and order details to provide the subscription, to give you access to the subscriber repository, and to invoice. Where a merchant of record handles the payment (currently FastSpring), it is the seller of record and an independent data controller for the billing, payment and tax data it collects under its own privacy policy; we receive the order and subscription record.
Lawful basis: performance of a contract (Art. 6(1)(b) GDPR) and our legal obligations for bookkeeping and tax (Art. 6(1)(c) GDPR).
When you contact us
If you email us or use the contact form, we process the message and your contact details to reply and keep a record of the correspondence. When you submit the contact form, your name, email address, chosen topic and message are posted to a We-Amp contact-handling endpoint, which delivers the message to us (as a Telegram notification) and logs it so we can follow up. If that submission fails, or if JavaScript is disabled, the form falls back to opening a pre-filled email in your own mail client instead.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in responding to your request, or steps toward a contract (Art. 6(1)(b) GDPR) where relevant.
Marketing and product updates
Where a form on this site offers it — the newsletter signup in the footer and at the foot of blog posts, or asking for a full RenderPeek report — you can opt in to receive product and web-performance updates by email. Opting in is always a separate, un-ticked choice. While we set up a dedicated email tool, we record your address and consent through the same contact-handling endpoint described above. We only send these updates to people who have opted in; every message will include an unsubscribe link; and we do not sell or share your address with third parties for their own marketing.
Lawful basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by emailing privacy@we-amp.com (and, once we start sending updates, via the unsubscribe link in any message).
How long we keep data
We retain personal data no longer than necessary for the purpose it was collected.
- Analytics: aggregate event data is retained on a rolling basis and is not tied to an identified person.
- Server access logs (including PageSpeed Insights / scanner requests): access and rate-limit logs are kept short-term for abuse prevention and operations, then rotated out.
- Subscriptions, orders and invoices: retained for as long as your subscription is active and afterward as required by Dutch tax law (a 7-year retention obligation applies to accounting records).
- Correspondence: kept as long as needed to handle your request and for a reasonable period afterward.
- Newsletter / marketing consent: your email address and consent record are kept for as long as you remain subscribed. While we set up a dedicated email tool, these are held in the interim server-side log described above; once that tool is live we migrate your record to it and remove the interim copy.
Sub-processors
We rely on a small number of third parties to run modpagespeed.com. Each processes data only as needed for its function.
| Provider | Purpose | Location |
|---|---|---|
| Google (PageSpeed Insights API) | Scores URLs submitted to /analyze | United States |
| Google Cloud (Cloud Run) | Hosts the AI-readability scanner that renders submitted URLs | United States (us-central1) |
| DB-IP | GeoIP databases (IP-to-Country Lite and IP-to-ASN Lite) held on our own server for regional price display and analytics filtering; no data is sent to DB-IP | N/A (local lookup) |
| Telegram (Telegram FZ-LLC) | Delivers contact-form and newsletter-signup messages to us as a notification (the message also resides in our server-side log, which is the durable record) | Outside the EU/EEA |
Payments for subscriptions are handled by a merchant of record (FastSpring) as an independent data controller — not a processor acting on our behalf — so it is described under “Subscriptions” above rather than listed here. We self-host our analytics (Umami) on our own infrastructure, so analytics is not handled by a third-party processor.
GeoIP data is provided by DB-IP.com under the Creative Commons Attribution 4.0 International License.
International transfers
Some of the third parties we work with are based outside the EU/EEA — in the United States (FastSpring and Google) and elsewhere (Telegram, which relays contact-form and newsletter-signup notifications). Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the providers’ certification under the EU–U.S. Data Privacy Framework.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. To exercise any of these, email privacy@we-amp.com. We will respond within the timeframe required by law.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Cookies and storage
Our analytics (Umami) is cookieless — browsing modpagespeed.com does not set tracking cookies. We use strictly necessary browser storage to remember preferences such as light or dark mode. If you take out a subscription through our merchant of record, its checkout may set its own cookies or browser storage as part of the payment flow, governed by its privacy policy.
Changes to this notice
We may update this notice as our processing changes. The version identifier at the top of this page will be updated when we do.
Contact
Questions about privacy? Reach us at privacy@we-amp.com.