Privacy Policy

Steady Drupal helps site owners move older Drupal sites onto a current, supported version. This policy explains what personal data I collect, why I collect it, and what rights you have under UK data protection law — the UK GDPR and the Data Protection Act 2018.

I am the data controller for the personal data described below. If anything here is unclear, or you'd like to get in touch about any of it, use the contact form on this website.

The website scanner

This website has a scanner that checks which version of Drupal a site is running. When you enter a website address and run a scan:

• It sends a handful of ordinary web requests to the address you give me — much like a browser would — and reads the public response to work out the likely Drupal version.
• It logs the domain, the detection result and the time — that's how it improves detection accuracy and understands who finds the tool useful.
• It doesn't log anything about you personally unless you choose to request a report, in which case it uses your email address to send it and, at most, one follow-up. No lists, no newsletters you didn't ask for.

To stop the scanner being abused, I do briefly keep a count of recent requests tied to your IP address, so I can cap how many scans run in a short window. An IP address counts as personal data, so to be clear: I process it only for this abuse-prevention purpose, under my legitimate interest, and these counts expire on their own after a short time.

The scanner only reads what a site already publishes openly. It doesn't try to reach private areas, log in, or pull content from the site being checked.

The contact form

When you message me through the contact form, I collect the name, email address, subject and message you send. I use these only to reply to you and, where it's relevant, to talk through a possible migration project.

Your message is stored on my website so I can read it and respond. My lawful basis is my legitimate interest in answering enquiries, together with taking steps at your request before entering into a contract.

Server logs

Like most sites, my server automatically records standard technical details — your IP address, browser type, and the pages requested. I rely on these to keep the service secure and running properly, which is my legitimate interest, and I hold them only as long as that purpose needs.

Cookies

I keep cookies to a minimum. The only ones I use are strictly necessary to operate the site and keep it secure — for example, a session cookie and a form security (CSRF) token — and these don't require consent. I don't use advertising cookies, I don't sell your data, and nobody can pay to influence what this site tells you.

Who I share data with

I don't sell your personal data. I share it only with the service providers who help me run the website — my hosting provider, for instance — and only as far as that requires. I may also disclose information where the law requires it.

My servers sit within the European Economic Area. Because I'm a UK controller storing data in the EEA, that data does leave the UK — a transfer the law permits, as the EEA benefits from UK adequacy. If any provider processes data beyond the EEA, I put appropriate safeguards in place (such as the ICO's International Data Transfer Agreement or standard contractual clauses) to keep it protected to the standard UK law expects.

How long I keep data

• Scan requests: not stored — only short-lived rate-limiting counts, which expire automatically.
• Contact form submissions: kept as long as I need them to handle your enquiry and any project that follows, then deleted.
• Server logs: kept only as long as security and troubleshooting require.

Your rights

Under UK data protection law you can ask to see the personal data I hold about you, have it corrected or erased, restrict or object to how I use it, and request portability — in the circumstances the law allows. To exercise any of these, get in touch through the contact form.

If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office (ICO), the UK's supervisory authority, at ico.org.uk. I'd appreciate the chance to put things right first, but that's your right either way.

Changes to this policy

I may revise this policy now and then. Any changes appear on this page, and the "last updated" date in the page header will reflect them.