How We Handle Your Privacy

We collect three categories of data, and that is it.

Information you give us. If you fill out the contact form on itreviews.co/contact/, we receive whatever you typed into the form — typically a name, email address, the company you mentioned, and the message body. People use this form to submit provider corrections, ask methodology questions, or send press inquiries.

Information collected automatically. When you load a page, our analytics setup logs standard request data: an anonymized IP address, browser and operating system, the page you viewed, the page that referred you, approximate city-level location, device type, screen size, and timestamps. This happens through Google Analytics 4 and basic web server logs from our host, Hostinger.

Information from cookies. A small set of cookies sit in your browser while you are on the site — WordPress functional cookies, Google Analytics measurement cookies, and a LiteSpeed Cache cookie that helps pages load faster. See section 3 for the full list.

CCPA / CPRA categories of personal information collected

For California residents, the following statutory categories under Cal. Civ. Code 1798.140(v) are collected, used for the business purposes described in section 2, and were not sold or shared for cross-context behavioral advertising in the past 12 months:

• Identifiers — name and email address (contact form), IP address (anonymized), online identifiers in cookies. Source: directly from you, or from your browser.
• Internet or other electronic network activity — pages viewed, referring URL, browser and device data via Google Analytics 4. Source: from your browser.
• Geolocation data — approximate city-level location derived from IP. Source: from your browser. We do not collect precise GPS coordinates.
• Commercial information — none collected. We do not sell anything.
• Audio, electronic, visual, thermal, olfactory, or similar information — none.
• Professional or employment-related information — only what you voluntarily include in a contact form message (e.g., your company name).
• Education information — none.
• Inferences — none. We do not build profiles or predict preferences.
• Sensitive personal information — we do not collect Sensitive Personal Information as defined under CPRA 1798.140(ae): no government IDs, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, health data, or sexual-orientation data.

We do not collect: government IDs, financial information, health data, biometric identifiers, precise GPS location, or any data from public profiles you have not voluntarily shared with us.

We use what we collect for four things:

• To answer you. If you submit the contact form, we reply by email. That email exchange becomes part of our correspondence record.
• To understand traffic patterns. Analytics data tells us which city ranking pages are read, where readers come from, and which sections lose attention. We use this to decide what to research and refresh next.
• To keep the site running. Server logs help us diagnose errors, fight spam, and detect abuse. LiteSpeed Cache cookies make pages load faster on repeat visits.
• To comply with law. If we receive a valid legal demand — subpoena, court order, regulator request — we will respond as required.

We do not provide your data to any third party for the purpose of training AI models, and we do not authorize our processors to use your data for model training beyond what is necessary to provide their service.

GDPR Article 6 lawful basis (EU / UK / EEA visitors)

For visitors covered by GDPR or UK GDPR, the lawful basis for each processing purpose is:

• Contact form replies and correspondence — Art. 6(1)(b) performance of pre-contractual or contractual steps at your request, and Art. 6(1)(f) legitimate interests in responding to inquiries directed at us.
• Google Analytics 4 measurement — Art. 6(1)(a) consent, captured through the cookie banner before any non-essential cookie is set.
• Server logs, security, spam prevention, and caching — Art. 6(1)(f) legitimate interests in maintaining a secure, performant site, balanced against the limited intrusiveness of the data involved.
• Legal and regulatory compliance — Art. 6(1)(c) compliance with a legal obligation to which we are subject.
• Business transfers (rare) — Art. 6(1)(f) legitimate interests of the parties to a corporate transaction.

You can withdraw analytics consent at any time through the cookie banner or browser settings, and you can object to legitimate-interest processing by emailing info@itreviews.co.

itreviews.co uses three categories of cookies. None are advertising cookies.

Strictly necessary cookies. WordPress sets a small number of session and security cookies (such as wordpress_test_cookie and CSRF tokens) so the site functions. These cannot be turned off without breaking the site.

Performance & caching cookies. LiteSpeed Cache uses lightweight cookies to serve faster page versions to repeat visitors. They do not identify you.

Analytics cookies. Google Analytics 4 sets cookies (_ga, _ga_*) that assign your browser a randomized ID and record page views. We have configured GA4 with IP anonymization enabled and Google Signals disabled, so no cross-device or ad-personalization profile is built.

Consent and EU/UK visitors. Non-essential cookies (analytics) are not set for EU/UK/EEA visitors until consent is captured through our cookie banner, in line with GDPR Art. 7 and the ePrivacy Directive Art. 5(3). Consent records are stored by the consent management platform and can be withdrawn at any time by clearing the consent cookie or re-opening the banner from the footer. If you are visiting from the EU/UK/EEA and the banner does not appear, treat that as a configuration issue and email info@itreviews.co so we can confirm and fix it.

You can clear or block cookies through your browser settings at any time. We also honor the Global Privacy Control (GPC) signal as a valid opt-out where required by state law.

The site runs on a short list of named services. Each is listed here with the role it plays and the data it processes.

Third-party processors (your data leaves our environment)

• Hostinger — web hosting. Sees server-level request logs (IP, request URL, user agent). Hostinger acts as our data processor under a standard hosting DPA.
• Google Analytics 4 — traffic measurement. Sees anonymized IP, browser, page views, referrer. We have a Google Analytics data processing addendum on file.
• Google Search Console — search performance reporting. Receives aggregated search query and click data from Google, not from your browser directly.
• Google Workspace — the email environment that receives forwarded contact form submissions and any reply correspondence. Covered by the Google Workspace DPA.
• Gravatar (Automattic) — profile image service used by WordPress when comments are enabled. Comments are disabled on ranking pages; Gravatar requests only occur on the rare pages where they are enabled.

Plugins and software operating locally (no data leaves our environment)

• WordPress core — the publishing platform. Stores published content and the contact form submissions in the WordPress database hosted by Hostinger.
• Yoast SEO — SEO plugin. Operates server-side; does not transmit visitor data to Yoast.
• LiteSpeed Cache — performance plugin. Operates within our hosting environment.

Provider screenshots embedded on ranking pages are static images we host ourselves. We do not load live iframes or remote scripts from MSP websites.

AI crawler treatment. Our robots directives and an llms.txt file at itreviews.co/llms.txt set out how we treat automated AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and similar). These bots may read public content for citation and answer-engine indexing; they do not receive any non-public personal data.

We do not sell, rent, lease, or trade personal information. We do not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have no advertising partners, no data brokers, and no affiliate marketing programs.

The narrow situations in which data may be shared:

• With service providers acting on our behalf. Hostinger and Google process data so we can run the site. They are contractually bound to use it only for the services they provide.
• To comply with law. We will disclose information when required by a subpoena, court order, or other lawful process, or to protect our rights, safety, or property.
• In a business transfer. If itreviews.co is acquired or merged, data may transfer to the successor entity. We will post a notice on the site if this happens.

That is the complete list. There is no fourth category.

California notice of right to opt out of sale or sharing

itreviews.co does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. California residents may still submit an opt-out request to info@itreviews.co and we will confirm our non-sale and non-share status in writing. A site-wide footer link labeled “Your Privacy Choices” points to this section so the disclosure is discoverable.

We hold on to data only as long as we need it for the purpose it was collected, plus any period required by law.

• Contact form submissions: 2 years from receipt, then deleted. If a thread is still active or has resulted in a published correction we may retain the record longer for editorial provenance.
• Email correspondence: retained in our email account per standard mailbox policy. You can ask us to delete a thread at any time.
• Google Analytics data: 14 months (the maximum standard GA4 retention; we have set this explicitly — the GA4 system default is 2 months).
• Web server logs: rotated by Hostinger per their standard retention, typically 30–90 days.
• Backups: WordPress backups are rotated on a 30-day cycle. Data deleted from the live site will persist in backups until the cycle completes.

If a longer period is required by law — for example, a litigation hold — we retain only what we have to and isolate it from operational systems.

The site is served over HTTPS with TLS encryption. Hostinger provides server-level security, DDoS protection, and isolation between accounts. WordPress is kept current; plugins are minimized and updated on a rolling basis.

Access to the WordPress admin and the underlying hosting account is restricted to authorized members of the editorial team, protected by strong passwords and two-factor authentication. Contact form submissions are stored in the WordPress database and forwarded to our editorial inbox.

No system is perfectly secure. If a breach occurs that affects personal data, we will notify the relevant supervisory authority within 72 hours of becoming aware, as required by GDPR Art. 33, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34). US state breach notification laws are followed in parallel where they apply.

Your rights depend on where you live. The block below this card lays them out by jurisdiction. To exercise any of them, email info@itreviews.co from the address you want us to look up. We will respond within 30 days (GDPR) or 45 days (CCPA/CPRA), and we will not charge you for a reasonable request.

We will verify your identity before acting on a request — usually by matching your email against records on file. We will not discriminate against you for exercising a privacy right — meaning we will not block you from the site, slow it down, or charge you for using a right the law gives you.

If we deny a request, we will explain why. EU/UK residents can complain to their local supervisory authority. California residents can contact the California Privacy Protection Agency.

itreviews.co is a B2B research site. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. We have no features — no accounts, no chat, no community — that would be of interest to children.

If you believe a child under 13 has submitted information to us through the contact form, email info@itreviews.co and we will delete the record. For California residents, we extend the same treatment to users under 16.

itreviews.co is operated from the United States. Hostinger hosts the site in their global infrastructure; Google Analytics processes data in the United States and other regions where Google operates.

If you access the site from the EU, UK, or EEA, your information will be transferred to and processed in the United States. We rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework as the legal basis for these transfers. Our processors (Google, Hostinger) maintain their own DPF or SCC commitments.

If you have questions about how a transfer affects you, email info@itreviews.co.

We update this page when our practices change or when the law requires it. Each update bumps the “Last updated” date at the top of the page, and material changes carry a separate “Effective” date that follows a 30-day notice window.

For material changes — new categories of data, new processors, or new sharing — we post a notice at the top of the site for at least 30 days before the new effective date. The current effective date is June 11, 2026.

Continued use of the site after the effective date indicates you have had notice of the update. Where processing requires consent (such as analytics cookies for EU/UK visitors), we will request renewed consent through the cookie banner. If you object to a change, your options are to stop using the site or to email info@itreviews.co and ask us to delete any data we hold on you.