Privacy policy
We collect the minimum needed to patch your site and keep you informed. No more, no less.
Last updated: October 28, 2026
1. Overview
Patchwise ("we", "us") collects the minimum data needed to patch your PHP site, deliver our service, and keep you informed. We never sell your data. We never share your data with third parties for marketing. This policy explains what we collect, why, how long we keep it, and the rights you have over it.
2. What we collect
Account data: your name, email, company, and phone (optional). Site data: the URL and platform you submit for scanning or patching. Scan data: results and findings from passive external checks. Order and payment data: package purchased, amount, payment provider metadata (we do not store full card numbers or PayPal passwords — only transaction references). Communication data: messages you send us via contact forms, tickets, or email. Usage data: anonymized analytics about page visits, used to improve our content.
3. Why we collect it
To run scans, deliver the patching and hardening service, contact you about your case, process payments, issue invoices, send follow-up communications, comply with tax and accounting obligations, and improve our website and articles. Each data type has a specific purpose — we do not collect data "just in case."
4. Legal basis (GDPR)
Under the GDPR, we process your data on the following legal bases: (a) Performance of a contract — to deliver the service you purchased. (b) Legal obligation — to retain tax and accounting records. (c) Legitimate interest — to respond to your inquiries and improve our service. (d) Consent — for passive scans, marketing emails, and non-essential cookies. You can withdraw consent at any time without affecting the lawfulness of prior processing.
5. Scans and consent
We run passive external scans only with your written consent — the checkbox on the scan form constitutes that consent. We do not guess paths, scan ports, or probe for exploits. We only scan the specific URL you submit. You confirm you own or are authorized to authorize scanning of the target site.
6. Data retention
Lead and scan data: 12 months from last interaction, then deleted or anonymized. Order and payment data: 7 years (required for tax and accounting). Account data: retained while your account is active; deleted 90 days after account closure unless legal retention applies. Communication data: 24 months, then archived. You can request earlier deletion of non-tax data at any time.
7. Cookies
We use essential cookies for authentication and session management (required for the app and checkout to work). We use optional analytics cookies to understand which content is useful — these are disabled by default and only enabled if you consent. We do not use advertising or tracking cookies. See our full Cookie Policy for details.
8. Data sharing
We share data only with: our payment processor (PayPal) to process transactions — they receive payment metadata, not your site data; our email provider to send transactional and follow-up emails; and hosting and infrastructure providers that store our database and run our edge functions. All providers are bound by data processing agreements. We never sell your data to anyone.
9. International data transfers
Our database and infrastructure may process data in regions outside your country of residence. We rely on standard contractual clauses and provider-level safeguards to ensure your data is protected to a standard equivalent to your home jurisdiction. If you have questions about specific transfers, contact us.
10. Data security
All credentials and secrets are stored server-side with row-level security — they are never exposed to the browser. Payment gateway keys are encrypted at rest and accessible only through server-side functions. Access to customer data is restricted to named engineers and admin staff. We use HTTPS for all connections. See our Security page for more details.
11. Your rights
Depending on your jurisdiction, you have the right to: access your data, correct inaccurate data, delete your data (where legal), restrict processing, data portability, object to processing, and withdraw consent. To exercise any right, email us at the address on our contact page. We respond within 30 days. You can also unsubscribe from follow-up emails at any time using the link in every email.
12. Children
Our services are intended for businesses and adults. We do not knowingly collect data from children under 16. If you believe we have collected data from a minor, contact us and we will delete it.
13. Changes to this policy
We may update this policy. Material changes will be notified by email to active customers at least 14 days before they take effect. The "last updated" date below reflects the most recent revision.
14. Contact
For privacy questions or data requests, email us at the address on our contact page. If you are in the EU or UK and are not satisfied with our response, you have the right to complain to your local data protection authority.