Privacy Policy

[DRAFT — not legal advice. See “Still missing from Jorge” list for items requiring review.]

This policy explains how SEMORA, S.A. de C.V., La Libertad, El Salvador, handles personal data on ratsweepr.com and in the RatSweepr software. Contact: hello@ratsweepr.com.

1. The scanner runs on your server

RatSweepr runs entirely on your own hosting account. By default it sends nothing about your site, files, database or users to us.

2. Email signups (free guide and updates)

When you request the free guide or join the list, we collect your email address and the language of the page you used, so we send content in English or Spanish. We use EmailIt as our email provider to store the list and send messages. You can unsubscribe from any email with one click.

3. Purchases

RatSweepr Cleanup Kit

Processed by Polar (merchant of record). We receive your name, email and order details from Polar; we never see your full card details. Polar’s privacy policy applies to the checkout.

Done-For-You Cleanup

Paid through Wompi (payment gateway). Once we’ve agreed on scope, we email you a Wompi payment link. We receive your name, email and payment confirmation from Wompi; we never see your full card details. Wompi’s privacy policy applies to that payment.

4. Opt-in research data sharing

A future version of RatSweepr will offer an optional setting to share scan results so we can improve detection.

• Off by default. Nothing is sent unless you explicitly turn it on, and you can turn it off at any time.
• You see it first. RatSweepr shows you exactly what will be sent before sending.
• What’s collected: detection results (rule names, severities, file hashes, suspicious code snippets, relative file paths within the WordPress install), the RatSweepr, WordPress and PHP versions, and a random install ID.
• What’s removed before sending (anonymization): domain names, URLs, IP addresses, usernames, email addresses, absolute server paths, database contents and customer data. Snippets are reduced to the malicious pattern where possible.
• Retention: research submissions are kept and then deleted or aggregated into statistics that cannot identify anyone.
• Deletion: email hello@ratsweepr.com with your install ID (shown in RatSweepr) and we will delete your submissions within 30 days.

5. Website analytics, spam protection and contact form

• Google Analytics loads only if you click “Accept” on the cookie notice. Your choice is stored in the rs_consent cookie for 180 days; clear your cookies to change it.
• Cloudflare Turnstile checks that signups come from a person, not a bot. It may process technical signals (such as IP address and browser data) under Cloudflare’s privacy policy.
• DeftForm hosts the contact form. What you type there is sent to DeftForm and then to us.
• The functional cookie rs_lang remembers your language choice.

6. Legal basis and sharing

We process data with your consent (email list, research sharing) or to fulfil a purchase. We do not sell personal data. We share it only with the providers listed above (EmailIt, Polar, Wompi, Cloudflare for hosting and Turnstile, DeftForm, and Google Analytics if you accept it).

7. Your rights

You can ask to access, correct, export or delete your personal data at any time by writing to hello@ratsweepr.com.

8. Changes

We’ll update the date at the top of this page when this policy changes.