1. Introduction

itbit.cc ("we", "us", "our") operates the WP Security Auditor service. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller for your personal data is itbit.cc. For all privacy-related inquiries, contact us at help@itbit.cc.

3. Data We Collect

We collect the following categories of personal data:

Account data: Email address, first name, and authentication credentials.
Scan data: Website URLs submitted for scanning and resulting security findings.
Payment data: Billing information processed securely through Stripe. We do not store credit card numbers.
WordPress connection data: Site URLs, usernames, and encrypted application passwords for auto-fix features.
Usage data: Pages visited, features used, and timestamps for service improvement.

4. Legal Basis for Processing

We process your data based on:

Consent: When you explicitly agree to data processing (e.g., during scan submission).
Contract performance: To provide the services you have purchased or signed up for.
Legitimate interest: For fraud prevention, security, and service improvement.

5. How We Use Your Data

Your data is used to:

Provide, maintain, and improve the Service.
Process payments and manage subscriptions.
Send transactional communications (scan results, account notifications).
Detect and prevent fraudulent or unauthorized activity.
Generate anonymized, aggregated analytics.
Send occasional marketing communications about new features, promotions, or service updates. You may opt out at any time.

6. Data Sharing

We do not sell your personal data to third parties. We share data only with:

Stripe: For payment processing.
Infrastructure providers: For hosting and database services, under strict data processing agreements.
Legal authorities: When required by law or to protect our legal rights.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Scan history is automatically cleaned up after a defined retention period. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law.

8. Your Rights (GDPR)

Under the GDPR, you have the right to:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your personal data ("right to be forgotten").
Restriction: Request limitation of data processing.
Portability: Receive your data in a structured, machine-readable format.
Objection: Object to processing based on legitimate interest.
Withdraw consent: Withdraw consent at any time without affecting prior processing.

To exercise any of these rights, contact us at help@itbit.cc. We will respond within 30 days.

9. Cookies

We use only strictly necessary cookies required for the Service to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. A cookie consent banner informs you of this upon your first visit.

10. Data Security

We implement industry-standard security measures including encryption in transit (TLS), encrypted storage of sensitive credentials, row-level security policies on all database tables, and regular security reviews. Despite best efforts, no system is 100% secure.

11. International Transfers

Your data may be processed in countries outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

12. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. It is your responsibility to review this page periodically for any changes. The "Last updated" date at the top of this page indicates the most recent revision. Continued use of the Service after any changes constitutes your acceptance of the updated policy.

14. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

15. Contact

For any privacy-related questions or requests, contact us at help@itbit.cc.