Effective date: 27 September 2026
Data controller. Simplified Digital Agency doo Beograd, Jabuka 3, 11221 Beograd, Serbia, PIB 109210175, operator of ValidatorHQ. For any privacy question or request, email contact@validatorhq.com.
This notice explains what personal data we process when you use the ValidatorHQ website, app and API, why, and what rights you have. We process personal data in line with the Serbian Law on Personal Data Protection and, where it applies, the EU General Data Protection Regulation (GDPR).
1. What we collect
- Account data: first name, last name, email address and password (stored only as a secure hash).
- Billing data: your subscription plan and status, and the customer and subscription IDs we receive from Paddle. Payment card and bank details are collected by Paddle, not by us.
- Monitoring data: the website URLs you add, your check settings, and the results of the checks, including uptime and SSL status, performance and accessibility reports, browser console messages and screenshots of your pages. If your pages show personal data publicly, it may appear in these results.
- Technical and usage data: IP address, browser details, server logs, and records of emails we send you (such as alerts and password resets).
- Support messages: anything you send us when you contact us.
2. Why we use it and our legal basis
- To provide the Service: run your account, perform checks, show results and send alerts (performance of our contract with you).
- To handle subscriptions: link your purchases to your account and apply your plan (contract; legal obligations for accounting records).
- To keep the Service secure and working: prevent abuse, fix errors and protect accounts (our legitimate interests).
- To communicate with you: service messages, important changes and support replies (contract and legitimate interests). We do not send marketing emails without your consent, and you can opt out at any time.
We do not sell your personal data and do not use it for advertising.
3. Cookies
The ValidatorHQ app uses only a strictly necessary session cookie to keep you signed in. We do not use advertising or analytics cookies in the app. The checkout pop-up is provided by Paddle, which may set its own cookies needed for payment and fraud prevention.
4. Who we share data with
We use trusted service providers who process data on our behalf, under contracts that protect it:
- Paddle.com – payments, taxes and invoicing. As our Merchant of Record, Paddle processes your payment data as an independent controller under its own privacy policy.
- DigitalOcean – server hosting, including stored screenshots.
- MongoDB Atlas – database hosting.
- Brevo – sending transactional emails such as alerts and password resets.
- EasyCron – scheduling of your automated checks (receives technical job details, not your account profile).
- Google PageSpeed Insights – performance tests; the URLs of your monitored pages are sent to Google for testing.
We may also disclose data if required by law or to protect our rights, users or the public.
5. International transfers
Some of these providers process data outside Serbia and the European Economic Area, including in the United States. Where this happens we rely on appropriate safeguards, such as Standard Contractual Clauses or adequacy decisions.
6. How long we keep data
We keep your account and monitoring data while your account is active. If you ask us to delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law (such as accounting records) and backups, which are overwritten on a rolling basis. Billing records held by Paddle follow Paddle’s retention rules.
7. Security
We protect data with encryption in transit (HTTPS), hashed passwords, access controls and reputable hosting providers. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.
8. Your rights
You have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent where processing is based on consent. To use these rights, email support@validatorhq.com. We will reply within 30 days.
You may also complain to the Serbian supervisory authority, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs), or to the data protection authority in your EU country of residence.
9. Children
The Service is intended for businesses and professionals and is not directed at children under 16.
10. Changes
We may update this notice. We will post the new version here with a new effective date and, for significant changes, notify you by email or in the app.