Legal
Last updated: September 2026
This Privacy Policy describes how Drubix ("we," "us," "our") collects, uses, and shares information through the Drubix website and the Drubix monitoring service (together, the "Service"). It applies to agencies and individuals who use the Service, and describes the data we collect about the Drupal sites submitted to it.
When you create an account or contact us, we collect information like your name, email address, and company name.
When you submit a site's URL, we collect publicly reachable information about it: the site's URL, detected Drupal core version, detected contrib module names (without needing credentials), HTTP response headers, and the presence of certain publicly exposed paths (used only to flag them as findings, not to access their contents).
If you install our optional Drupal module on a site, we additionally collect: exact installed module versions, PHP version, and configuration drift information (which configuration objects differ between the active and last-exported configuration — we do not collect the contents of your site's database, user accounts, or content). This is more detailed than passive scanning and is only collected if you choose to install the Connector.
Payment is processed by Paddle.com Market Ltd., our merchant of record. We do not collect or store your payment card details — Paddle handles this directly, under its own privacy policy.
Like most web services, our servers log standard technical data (IP address, browser type, pages visited, timestamps) for security and operational purposes.
We do not sell your data, and we do not use the site data we collect to train unrelated products or to advertise to you.
Our benchmarking feature compares a site's findings against an aggregate of other monitored sites. This only ever shows a percentile figure (e.g. "top 12%") — it never reveals which other sites contributed to that figure, and only computes a result at all once enough sites exist in the comparison set to keep any individual site from being identifiable.
We do not share your site data with other customers, and we do not sell data to third parties.
We retain account and site data for as long as your account is active, plus a reasonable period afterward for backups and legal/accounting purposes. You can request deletion of your account and associated data at any time (see Section 8).
[Placeholder — describe where data is actually hosted and, if customers or their end clients are in the EU/UK, what transfer mechanism applies (e.g. Standard Contractual Clauses) once confirmed with a lawyer and your actual hosting setup.]
Depending on where you're located, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. We extend these rights to all users regardless of location as a matter of practice, not only where legally required. To exercise any of these, contact us at hello@drubix.com.
If you submit a site you don't personally own (e.g. a client's site), you're responsible for ensuring you have the appropriate basis to have that site's data processed by Drubix under your agreement with that client. We process that data as instructed by you, the account holder — we don't have a direct relationship with your client and won't act on instructions from them regarding data we hold on your account.
We use reasonable technical and organizational measures to protect the data we hold, including encryption in transit and signed, verified communication for automated data submission (the Connector module and payment webhooks). No system is completely secure, and we can't guarantee absolute security.
The Drubix marketing website does not currently use tracking or advertising cookies. If this changes (e.g. adding analytics), this policy will be updated accordingly before that happens.
The Service is intended for business use and is not directed at individuals under 18. We don't knowingly collect personal data from children.
We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.
Questions about this policy or your data: hello@drubix.com.