Privacy Policy

PageDiff is operated by 34MOJI MEDIA SRL, a company established in Romania (Trade Register J2017002728227, VAT RO 38116640), with its registered office at Jud. Iaşi, Municipiul Iaşi, Strada VASILE CONTA, Nr. 1, TR. 2, MEZANIN, Bl. D2. We are the data controller for your account and billing data.

For any privacy question or to exercise your rights, contact us through our contact page using the “Privacy & data request” topic, where our privacy contact handles all data-protection matters.

We keep data collection to what we need to run the service:

• Account data (name, email, hashed password): to create and secure your account and provide the service. Lawful basis: performance of our contract with you.
• Billing data (name, email, billing address, VAT/tax details): handled by Lemon Squeezy as Merchant of Record to take payment and meet tax obligations. Lawful basis: contract and legal obligation.
• Technical & usage data (IP address, request logs, and cookieless, aggregate analytics): to keep the service secure and reliable. Lawful basis: our legitimate interest in operating and protecting the service.
• Monitored content (the URLs you ask us to watch, plus the screenshots, HTML, and detected changes captured from them): processed on your instructions to deliver monitoring. This may incidentally contain personal data; for it, you are the controller and we act as your processor (see Subprocessors below). A data processing agreement is available on request. Each check is dispatched to Cloudflare, which processes the monitored URL and the page content fetched from it on our behalf as a subprocessor.
• Support messages (the content of your contact-form messages): to respond to you. Lawful basis: our legitimate interest in handling support.

We use only a single essential session cookie to keep you signed in. It is strictly necessary and does not require consent. Our product analytics run on a cookieless, self-hosted Umami instance that collects only aggregate, non-identifying data. Because we set no advertising or tracking cookies, we do not show a cookie-consent banner.

Page snapshots and change history are kept according to your plan: 30 days on Starter, 90 days on Pro, and 365 days on Business. They are then deleted automatically.

When you delete your account, your personal data is permanently purged after a 30-day grace period (which guards against accidental deletion and abuse). Billing and tax records are retained for as long as the law requires; most of these are held by Lemon Squeezy as Merchant of Record. Content sent to our AI subprocessor is handled as follows: It is retained for up to 30 days, during which it may be accessed for safety and security purposes, and is then deleted.

We use a small number of third-party processors to deliver the service. The current list is on our Subprocessors page, with what each does, the data it touches, and where it is located. We will notify customers of changes to this list and give an opportunity to object, as required by the GDPR.

We never sell your personal data.

Your primary data is currently held in the European Union (hosted with Hetzner in Germany and Finland), and page snapshots are stored in Cloudflare R2 pinned to the EU. This describes our infrastructure today rather than a guarantee. If it changes, we will update this page and notify you as described in sections 5 and 10. A limited set of subprocessors, our payment provider and our AI subprocessor, process some data in the United States. In addition, the checks that fetch your monitored pages run on Cloudflare's global edge network, so both the monitored URL and the page content retrieved during a check may be processed outside the EU. Each of these transfers is covered by Standard Contractual Clauses, and additionally by the EU–US Data Privacy Framework where the provider is certified under it. The basis that applies to each provider is listed on our Subprocessors page.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent.

To exercise any of these, contact us via our contact page (“Privacy & data request”). We may need to verify your identity before we act.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania, www.dataprotection.ro.

Our Security page describes how we store and protect your data, covering EU hosting, access isolation, hashed passwords, and clear deletion.

PageDiff is intended for users who are 18 or older. The service is not directed to anyone under 18, and we do not knowingly collect data from them.

We may update this policy from time to time. If we make material changes, we will notify you before they take effect, for example by email or an in-app notice, and we will update the “Last updated” date above.