This is a translation provided for convenience. If there is any discrepancy, the Spanish version prevails.
Who is the controller
Melopo (Venezuela), owner of melopo.com and Melopo Radar. For any privacy matter: privacidad@melopo.com.
1. Melopo Radar's two roles under the GDPR
Under the General Data Protection Regulation (EU GDPR 2016/679), Melopo Radar plays two clearly separated legal roles:
1. Melopo as Data Controller
For the data of our own customers and users: account creation, email address, billing records sent by Freemius and the IP address of the public scanner (where only a pseudonymous cryptographic fingerprint is kept), as well as the email of anyone who asks to receive the scanner report by email.
2. Melopo as Data Processor
For the information held in the WooCommerce stores our customers connect: catalog data, anonymised or aggregated orders and security login attempts. This role is governed by the Data Processing Agreement (Art. 28).
2. Processing, legal bases and retention periods
| Purpose | Data processed | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|---|
| Account management and access to the SaaS | Name, email address, encrypted password | Performance of the contract (Art. 6.1.b) | Until the user closes their account |
| Billing and payment (through Freemius) | Transaction ID, tax country, purchase history | Legal tax obligation (Art. 6.1.c) | 5 to 10 years depending on the applicable tax rules |
| Store health monitoring | Product catalog, issues, response times | Performance of the contract (Art. 6.1.b) | Free: 30 days • Pro: 1 year • Agency: 2 years |
| Public domain scanner | Scanned URL, pseudonymous IP fingerprint | Legitimate interest in security (Art. 6.1.f) | 30 days to prevent abuse |
| Emailing the scanner report (optional) | Email address, scanned URL and result | Consent when requesting it (Art. 6.1.a) | 12 months, or sooner if you ask |
| Tips and news from Melopo (only if you tick the box) | Email address and date of consent | Consent (Art. 6.1.a) | Until you unsubscribe, with the link in each email or by writing to privacidad@melopo.com |
3. Recipients and sub-processors
We do not share personal data with third parties for advertising purposes. To provide the technical service we use a restricted list of reliable technology providers that are reviewed periodically. You can see the full, up-to-date public list in Sub-processors.
Any international data transfer outside the European Economic Area is carried out under the Standard Contractual Clauses (SCC) approved by the European Commission.
4. Exercising your GDPR rights
Any user can at any time exercise their rights of access, rectification, erasure, restriction of processing, portability and objection by sending a signed request stating the right being exercised to:
Privacy email: privacidad@melopo.com or hola@melopo.com
Data subjects also have the right to lodge a complaint with the competent data protection supervisory authority (in Spain, the Agencia Española de Protección de Datos - AEPD at aepd.es).
Version history
- 09/28/2026: Version 1.0 (first publication).