Last updated October 29, 2026.
1. Who We Are
MountDev is operated by Cascadia Web Services, LLC, a Delaware limited liability company registered to do business in the State of Oregon ("MountDev," "we," "us," or "our"). This Policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights you have. It covers mountdev.app, the MountDev workspace, the Site Care plugin, the MountDev API, and the Services described in our Terms of Service.
2. Our Two Roles
- For our own customers (agencies) and visitors to mountdev.app, we decide how personal information is used. We are the controller.
- For Client Data (the content, users, form entries, orders, and other personal information on the websites agencies add), the agency or its client decides, and we process it only on their instructions to provide the Services. We are the processor, under the Terms and our Data Processing Agreement. If you are a visitor to or user of one of those websites, contact the website's owner first; we will help them answer you.
3. What We Collect
From agencies and their team members:
- Account details: name, business name, email address, phone number if given, and sign-in records.
- Billing details: billing contact and address, and payment records. Card and bank details are collected and stored by Stripe, not by us.
- Support messages and the records of work we do on your sites.
- API use: which key made which request, and when.
From visitors to mountdev.app:
- What you send in a form, such as your name, email address, website address, and message.
- When you run a free tool: the website address you check and its results, and your email address only if you ask for the report by email.
- When you ask to be told when sign-up opens: your email address, used only for that one email.
What you send through a form on mountdev.app is kept in MountDev's own records. It is never sent to a third party for marketing, and never sold.
- Security and server logs kept by Cloudflare (IP address, browser, and the page asked for), used only to keep the site safe and working.
From the websites we look after (as processor):
- The files and databases we back up, which may include the site's users, customers, orders, and form entries.
- Site activity records (who changed what, and when), sign-in attempts the sign-in guard sees, and the results of our checks, including small screenshots of pages and forms.
- Email the site sends through our sending (the recipient, subject, and delivery result; never kept as marketing lists).
We do not knowingly collect special category data, and we ask agencies not to put payment card numbers, health records, or government ID numbers anywhere the Services do not need them.
4. How We Use It
- To provide, secure, and support the Services, including the nightly work, checks, reports, and hosting.
- To bill agencies and keep accounting and tax records.
- To answer questions, and to follow up with people who asked us to through a form on mountdev.app.
- To meet legal obligations and to protect our rights and the rights of others.
We never use Client Data for our own marketing, and we never sell it.
5. Legal Bases (EEA, UK, and Switzerland)
Where these laws apply, we rely on: performing our contract with you; our legitimate interests in running, securing, and improving the Services; your consent where we ask for it; and legal obligations. For Client Data, the controller's basis applies.
6. No Tracking
mountdev.app, the workspace, and the reports and portal agencies' clients see do not use advertising trackers, third-party analytics, or tracking cookies. We use only the cookies the workspace needs to keep you signed in. We count tool runs and sign-ups in our own records, without following people from site to site.
7. Who We Share It With
We share personal information only with the providers that help us run the Services (subprocessors), under contracts that limit their use of it, and when the law requires.
| Provider | What it does for us | Where |
|---|---|---|
| Cloudflare | The network in front of mountdev.app and the sites we look after, DNS, our own databases, backup storage, browser checks, and our own email | United States and Cloudflare's global network |
| WP Cloud (Automattic) | Hosting for sites on MountDev Hosting: the site's files, database, and server | The data center the site is hosted in |
| Amazon Web Services | Amazon SES, which delivers site email | United States |
| Stripe | Card and bank payments | United States |
| Anthropic | Wording the "work we did" lines of monthly reports from our own work records; not used to train models | United States |
| PageSpeed measurements of public pages, and Web Risk checks of a site's address | United States | |
| Telnyx | Phone numbers and calls, only for agencies that use the Calls app in their workspace | United States |
Public vulnerability and version data comes from WordPress.org, Wordfence, and WPVulnerability. We send them only plugin and theme names and versions, never personal information.
We may disclose information to comply with a valid legal demand, to protect the safety or rights of people or the Services, or to a successor if MountDev is sold or reorganized, with notice to you.
8. Credentials and Security
Each backup is encrypted with its own key. Access to sites runs through the Site Care plugin or our hosting platform, never through stored passwords where we can avoid them, and sign-in links work once and expire after 60 seconds. Our team uses multi-factor authentication. No system is perfectly secure; we will tell affected agencies without undue delay of a security incident involving their data.
9. How Long We Keep It
- Backups: for the history each site's Services and Add-Ons include (Maintenance 180 days, Hosting alone 30 days, longer with an Add-On), then deleted.
- A site's final backup after its Services end: 90 days unless an Add-On says longer, then deleted.
- Check results, screenshots, and site activity records: 90 days.
- Speed measurements: 400 days.
- Account records: while the account is open and for up to two years after, to handle disputes and reinstatement.
- Billing and tax records: at least seven years.
- Form messages from people who did not become customers: up to 24 months.
After closing an account, you can export everything for 30 days.
10. International Transfers
We are based in the United States and keep data there. Where we receive personal information from the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where it applies.
11. Your Rights
Depending on where you live, you may have the right to know what we hold about you and get a copy, correct it, delete it, receive it in a portable format, object to or restrict some uses, and withdraw consent. We do not sell or share personal information for advertising, and we do not use it for automated decisions with legal effects. We will not treat you differently for using these rights.
Agencies can export every record, report, and file in their account at any time, from the workspace. To use your rights, email help@mountdev.app. We may need to confirm who you are. If your information is on a website an agency added, we will pass your request to that website's owner and help them answer it.
12. Email From Us
We send agencies the email the Services need (sign-in codes, invoices, alerts, and reports). Any other email from us has an unsubscribe link.
13. Children
The Services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you think a child has given us information, tell us and we will delete it.
14. Changes and Contact
We may update this Policy. The current version is always at mountdev.app/legal/privacy/ with its date. For material changes, we will email agencies before they take effect.
Questions, requests, and security reports: help@mountdev.app.