Privacy
Effective date: June 2026 · Version 2026-06
This notice covers how the modpagespeed.com website and its services process personal data. We-Amp B.V. operates several websites; this page is the specific notice for modpagespeed.com. For the company-wide policy, see the We-Amp B.V. privacy policy, of which this is a part.
Who is responsible
The data controller is We-Amp B.V., a company registered in the Netherlands.
- We-Amp B.V., Castricum, the Netherlands
- KvK (Chamber of Commerce): 57898138
- VAT (BTW): NL852784429B01
- Privacy contact: privacy@we-amp.com
What we process, and why
We keep data collection to the minimum each service needs. The activities below cover everything modpagespeed.com does with personal data.
Website analytics
We use a self-hosted Umami instance (umami.we-amp.com) to count page views and understand which pages are useful. Umami is cookieless and does not build a profile across sites. It records aggregate signals such as page path, referrer, approximate region, browser, and device type. We do not use this data to identify individuals.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving the site, balanced against the low-impact, cookieless design.
PageSpeed Insights proxy (/analyze)
When you submit a URL on the /analyze page, our server forwards that URL to Google's PageSpeed Insights API (operated by Google in the United States) and returns the result. The URL you submit may itself contain personal data if you choose to enter such a URL — please don't. We also log and rate-limit by your IP address to prevent abuse of the shared API key.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in offering the tool and protecting it from abuse. Use of Google's API is also subject to Google's own terms and privacy policy.
AI-readability scanner (RenderPeek)
The AI-readability scanner renders a URL you submit so we can report how it looks to automated agents. Rendering runs on Google Cloud Run. As with the PageSpeed Insights proxy, we process the submitted URL and your IP address for the request and to rate-limit abuse. We do not retain the rendered page content beyond what is needed to return your result.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in offering the tool and protecting it from abuse.
Purchases and checkout
Payments are handled by FastSpring, our Merchant of Record. As Merchant of Record, FastSpring is the seller of record and acts as an independent data controller — not a processor acting on our behalf — for the billing details, payment information, and tax data it collects and processes under its own privacy policy. We receive order and subscription records (such as your name, email, and what you purchased), for which We-Amp is the controller, so we can provision and support your license.
Lawful basis: performance of a contract (Art. 6(1)(b) GDPR) and our legal obligations for bookkeeping and tax (Art. 6(1)(c) GDPR).
License heartbeat
The ModPageSpeed software you install renews its license token with our API and, during the same call, reports a pseudonymous instance identifier, the product identifier (e.g., “mps2”), the software version, and basic build information about the package (server type, operating system, architecture, and distribution). The identifier is a SHA-256 hash derived from your subscription ID and a locally generated random UUID — no hostnames, MAC addresses, or other machine-identifying information leave your server. We use it only to count concurrent instances per subscription. See the Terms of Service for the contractual side.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in license compliance in a B2B context. You can object by contacting privacy@we-amp.com.
When you contact us
If you email us or use the contact form, we process the message and your contact details to reply and keep a record of the correspondence. When you submit the contact form, your name, email address, chosen topic, and message are posted to a We-Amp contact-handling endpoint (our render service), which delivers the message to our team (as a Telegram notification) and logs it so we can follow up. If that submission fails, or if JavaScript is disabled, the form falls back to opening a pre-filled email in your own mail client instead. We use the details only to reply and keep a record of the correspondence.
Lawful basis: legitimate interest (Art. 6(1)(f) GDPR) in responding to your request, or steps toward a contract (Art. 6(1)(b) GDPR) where relevant.
Marketing and product updates
Where a form on this site offers it — for example, the newsletter signup in the site footer and at the foot of blog posts, or asking for the full RenderPeek report or to be notified about AI-readability updates — you can opt in to receive product and web-performance updates by email. Opting in is always a separate, un-ticked choice; we never add you without it. While we set up a dedicated email tool, we record your address and consent through the same contact-handling endpoint described under “When you contact us” above (our render service, which notifies our team and keeps a server-side log). We only send these updates to people who have opted in; once we begin sending them, every message will include an unsubscribe link; and we do not sell or share your address with third parties for their own marketing.
Lawful basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by emailing privacy@we-amp.com (and, once we start sending updates, via the unsubscribe link in any message).
How long we keep data
We retain personal data no longer than necessary for the purpose it was collected.
- Analytics: aggregate event data is retained on a rolling basis and is not tied to an identified person.
- PageSpeed Insights / scanner request logs: server and rate-limit logs are kept short-term for abuse prevention and operations, then rotated out.
- License heartbeat: heartbeat records expire after a period of inactivity (currently around 30 days) so short-lived instances do not accumulate.
- Orders and invoices: retained for as long as your subscription is active and afterward as required by Dutch tax law (a 7-year retention obligation applies to accounting records).
- Correspondence: kept as long as needed to handle your request and for a reasonable period afterward.
- Newsletter / marketing consent: your email address and consent record are kept for as long as you remain subscribed (until you withdraw consent or unsubscribe). While we set up a dedicated email tool, these are held in the same interim server-side capture log described above; once that tool is live we migrate your record to it and remove the interim log copy.
Sub-processors
We rely on a small number of third parties to run modpagespeed.com. Each processes data only as needed for its function.
| Provider | Purpose | Location |
|---|---|---|
| Google (PageSpeed Insights API) | Scores URLs submitted to /analyze | United States |
| Google Cloud (Cloud Run) | Hosts the AI-readability scanner that renders submitted URLs | United States (us-central1) |
| DB-IP | Offline GeoIP database (IP-to-Country Lite) for regional pricing and approximate region; no data is sent to DB-IP | N/A (local lookup) |
| Telegram (Telegram FZ-LLC) | Delivers contact-form and newsletter-signup messages to our team as a notification (the message also resides in our server-side log, which is the durable record) | Outside the EU/EEA |
Payments are handled by FastSpring as our Merchant of Record. As an independent data controller for the payment transaction — not a processor acting on our behalf — FastSpring is described under “Purchases and checkout” above, and is not listed as a sub-processor here.
We self-host our analytics (Umami) on our own infrastructure, so analytics is not handled by a third-party processor.
GeoIP data is provided by DB-IP.com under the Creative Commons Attribution 4.0 International License.
Data Processing Agreement
Where we act as a processor for business customers, a Data Processing Agreement (DPA) is available on request. Email privacy@we-amp.com. Note that ModPageSpeed runs on your own servers and does not send your visitors' data to us, so for most deployments the processing footprint is limited.
International transfers
Some of the third parties we work with are based outside the EU/EEA — in the United States (FastSpring and Google) and elsewhere (Telegram, which relays contact-form and newsletter-signup notifications). Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the providers' certification under the EU–U.S. Data Privacy Framework.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any of these, email privacy@we-amp.com. We will respond within the timeframe required by law.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Cookies and storage
Our analytics (Umami) is cookieless — browsing modpagespeed.com does not set tracking cookies. We may use strictly necessary storage to remember preferences such as light or dark mode.
When you proceed to checkout, FastSpring may set its own cookies or browser storage as part of the payment flow, governed by FastSpring's privacy policy.
Changes to this notice
We may update this notice as our processing changes. The version identifier at the top of this page will be updated when we do.
Contact
Questions about privacy? Reach us at privacy@we-amp.com.