1. Contact form

Data collected: name, company (optional), email, message. A technical fingerprint (truncated IP) is kept to prevent abuse.

Purpose: reply to you, track sales conversations, prevent spam. Legal basis: legitimate interest (Art. 6.1.f GDPR). No marketing use without explicit consent.

Retention: 12 months maximum after the last exchange, then automatic purge.

2. Free Scan widget (automatic diagnosis)

The scan form collects: email address, URL of the analysed site, truncated IP address (partial anonymisation), overall score and issues detected during the diagnosis.

Two distinct purposes apply, both covered by your consent (Art. 6.1.a GDPR):

Technical purpose: produce and deliver the automatic diagnostic report to you.
Commercial purpose: contact you about this diagnosis and MLR Prod services. This follow-up only happens on the basis of the consent given at the time of the scan.

Retention: 12 months after the scan date, then automatic purge by cron job. You can request early deletion at any time.

3. Performance analysis via Google PageSpeed Insights

When the diagnosis runs, the public URL of the site you provided is sent to the Google PageSpeed Insights API (Google LLC, United States) to measure performance scores. Only the public URL is sent: no personal data about you (email, IP, identity) is transmitted to Google.

This transfer is covered by the EU / US Data Privacy Framework. The Google PageSpeed Insights call is optional: if no API key is configured, the performance analysis is run locally by Lighthouse. To be verified according to your compliance requirements.

Data hosting

Pocketbase self-hosted on Contabo VPS (EU datacenter, Nuremberg/Düsseldorf) through Coolify. Daily encrypted backup.

Contact requests and scan results are accessible to the MLR Prod administrator through a secured internal back-office (authenticated access, HMAC-SHA256 session).

Should the Pocketbase server be temporarily unavailable, scan leads are saved in a local fallback file on the server (never lost, purged beyond 12 months). This resilience measure does not affect the declared retention periods.

Sub-processors and transfers

The site relies on the technical sub-processors below. No data is sold or rented.

Pocketbase, self-hosted by MLR Prod on a Contabo VPS (EU): storage of contact requests and scan results.
Cloudflare Turnstile (Cloudflare, Inc., United States): anti-bot protection of the contact form and scan; processes an IP address and a validation token. Transfer covered by the EU / US Data Privacy Framework.
Google PageSpeed Insights (Google LLC, United States): performance analysis; receives only the public URL of the analysed site (no personal data). Transfer covered by the EU / US Data Privacy Framework. Optional service.
Appointment booking: booking a call currently goes through Google Calendar (Google LLC, United States); your name, email and chosen slot are then sent to it (transfer covered by the EU / US Data Privacy Framework). This component is being migrated to a European solution.

Your rights

Access, rectification, deletion, portability: write to contact@mlrprod.com. Response within 30 days max.

Cookies

This site uses no tracking cookies. Only local storage (`localStorage`) keeps your color palette preferences.