Privacy Policy

Data Controller

The controller responsible for your personal data is Marwan Akhandaf, sole proprietor, enterprise number 0768.807.647, VAT BE0768.807.647, operating under the trade name PageChange.

Contact: [email protected].

Information We Collect

Account data: name, email address, and profile information provided through Google sign-in when you sign in.

Billing data: subscription status, plan details, and payment metadata processed by Stripe. We do not store your full credit card number.

Monitor data: URLs, CSS selectors, alert settings, notes, snapshots, change history, and notification delivery records that you create while using the dashboard.

Newsletter data: email address if you subscribe to product updates.

Optional analytics data: fixed page categories, feature-interest signals, approximate connection country, device category, language, timestamps and pseudonymous browser/session identifiers. We do not collect monitor content, customer URLs, query strings, form text, payment fields or session recordings for analytics.

Technical data: IP address, browser type, device information, authentication session cookies, and server logs collected automatically when you use the service.

Legal Bases for Processing

Contract performance (Art. 6(1)(b) GDPR): processing your account, subscription, monitors, alerts, and support requests is necessary to deliver the service you signed up for.

Legitimate interests (Art. 6(1)(f) GDPR): we process technical data and logs to maintain security, prevent abuse, debug issues, and improve service reliability. Our legitimate interest is operating a secure, functional, and improving service.

Legal obligation (Art. 6(1)(c) GDPR): we retain invoicing and billing records as required by Belgian tax and accounting law.

Consent (Art. 6(1)(a) GDPR): we rely on opt-in consent for optional browser analytics. Use Privacy choices to reject or withdraw at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Service Providers and Recipients

We share personal data with the following categories of processors to operate PageChange:

Google: identity verification for Google sign-in. Cloudflare: application authentication, session management, and encrypted D1 storage.

Stripe (Stripe, Inc., US): payment processing. Receives billing details and subscription metadata.

Convex (Convex, Inc., US): backend database and serverless functions. Stores monitor data, snapshots, notification records, and account information.

Cloudflare (Cloudflare, Inc., US): DNS, CDN, transactional email delivery, and the monitoring fetch proxy (Worker). Processes request metadata, fetched page content, recipient email addresses, and alert content.

Hetzner (Hetzner Online GmbH, Germany): VPS hosting for the application server.

We do not sell your personal information. We may disclose information if required by law, to protect rights or safety, or as part of a business transfer such as a merger, acquisition, or asset sale.

International Data Transfers

Several of our processors are based in the United States: Google, Stripe, Convex and Cloudflare. Transfers to the US are covered by the EU-US Data Privacy Framework where the processor is certified, or by Standard Contractual Clauses (SCCs) adopted by the European Commission.

Hetzner processes data within the European Economic Area (Germany).

You may request a copy of the applicable transfer safeguards by contacting [email protected].

Cookies and Analytics

Strictly necessary cookies: we use cookies for authentication (application session), security, and theme preferences. These are required for the service to function and do not require consent.

Optional first-party analytics is off until you accept. A browser token is then stored locally. Privacy choices lets you reject and remove this browser’s detailed optional history; a pending deletion token is retained locally for retry if the network is unavailable. Do Not Track and Global Privacy Control prevent collection. Cloudflare stores the observations privately. We do not join browsers by IP address or device.

We do not use advertising cookies, marketing trackers, or social media pixels.

Data Retention

Account data: retained while your account is active. After account deletion, personal data is removed within 30 days, except where longer retention is required by law.

Monitor deletion removes the monitor from the dashboard and queues its captured objects for background cleanup, including a short safety grace period.

Billing and invoicing records: retained for 7 years after the end of the relevant billing period, as required by Belgian tax and accounting law (Art. 60 Belgian VAT Code).

Server logs: retained for up to 90 days for security and debugging purposes, then automatically purged.

Optional detailed events and sessions: retained for up to 90 days. Browser identifiers: retained for up to 180 days after last observation. A scheduled cleanup runs every five minutes. Withdrawal removes this browser’s detailed optional history; necessary account, security and billing records remain separate.

Newsletter subscriptions: retained until you unsubscribe or request deletion.

Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

Right of access (Art. 15): request a copy of the personal data we hold about you.

Right to rectification (Art. 16): request correction of inaccurate or incomplete personal data.

Right to erasure (Art. 17): request deletion of your personal data, subject to legal retention requirements.

Right to restriction (Art. 18): request that we restrict processing of your data in certain circumstances.

Right to data portability (Art. 20): receive your personal data in a structured, commonly used, machine-readable format.

Right to object (Art. 21): object to processing based on legitimate interests. We will stop processing unless we demonstrate compelling legitimate grounds.

Right to withdraw consent: where processing is based on consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact [email protected]. We will respond within one month. We may need to verify your identity before processing your request.

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données):

Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium. Telephone: +32 (0)2 274 48 00. Email: [email protected]. Website: www.gegevensbeschermingsautoriteit.be.

Automated Decision-Making

PageChange does not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

Children

PageChange is not directed to children under 16, and we do not knowingly collect personal data from children under 16, in accordance with Article 8 GDPR and Belgian law.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and post the revised version on https://page-change.com. If changes significantly affect how we process your data, we will notify you by email where possible.

Contact

For privacy questions or requests, contact [email protected].