Privacy Policy

Last updated: 8 October 2026

This notice explains what personal data CapyFuel (capyfuel.com) collects when you visit the site, why we collect it, who receives it, how long we keep it and what rights you have. It describes what the site actually does today, and we update it when that changes.

Who we are

The controller responsible for your personal data is:

Malgorzata Biszewska, sole trader, trading as CapyFuel
9, Flat 3, Triq Amery, Sliema SLM 1706, Malta
VAT registration number: MT32867113
Email: [email protected]

CapyFuel is a price-comparison and guides site for sports supplements in Malta and Cyprus. It does not currently take orders: checkout is switched off, and you buy from the retailers we link to, not from us. We are established in Malta, so the Office of the Information and Data Protection Commissioner (IDPC) of Malta is our supervisory authority.

What we collect, why, and how long we keep it

Most of this happens automatically when your browser loads a page. Each item below says what is collected, why, on what legal basis (the numbers refer to Article 6(1) of the GDPR), who receives it and how long it is kept.

1. Server logs

What: every request to the site is written to a log on our server: your IP address, the page requested, date and time, response status, size of the response, the page that referred you and your browser’s identification string (user agent).
Why and legal basis: running and securing the site and finding faults. Legitimate interests (f).
Who receives it: nobody outside our hosting provider (see “Who receives your data”).
How long: about eight days. The log is rotated daily and seven rotated files are kept.

2. Copy of the server log in our analysis database

What: every ten minutes the new entries of that log are copied into a database on the same server, with the same kind of fields as the server log (full IP address, user agent, host, request method, page path, response status and size) plus content type, response timings and a flag saying whether the visitor looks like a search-engine or other bot. The referrer is not copied.
Why and legal basis: measuring how search engines and people use the site, and spotting abuse. Legitimate interests (f).
Who receives it: our hosting provider, and Google (Google Drive) through the database backups described below; only we can read the database itself.
How long: rows are deleted automatically after 30 days. The database is backed up every day and a copy is stored in a Google Drive account that we control; those copies are deleted after 30 days, so a deleted row can remain in a backup for up to a further 30 days.

3. Our own visitor statistics

What: a small script on every page sends our own server the page you viewed, how you arrived (referrer, campaign tags in the link), your country (taken from Cloudflare), a device type, a random session identifier and two values derived from your IP address and browser string. The session identifier is kept in your browser’s session storage, not in a cookie, and is discarded when you close the tab or after 30 minutes without activity. Each of the two derived values is combined with the current date, so the value differs from day to day and we cannot link you across days. They are not anonymous: anyone who already knows your IP address could recompute the value for a given day, so we treat them as personal data. The script also records the address of an external link when you click it. The server that receives this data (analytics.capybaraforge.cloud, run by us on the same hosting) also keeps an ordinary web-server access log containing the IP address, user agent and page address of each request, for about eight days.
Why and legal basis: understanding which pages are used and which outbound links are followed. Legitimate interests (f).
Who receives it: our hosting provider, and Google (Google Drive) through the database backups described under item 2.
How long: these records are kept until we delete them. There is no automatic deletion at present; we review this store at least once a year and delete records we no longer need. The access log mentioned above is kept for about eight days, and the database backups for 30 days.

4. Ahrefs Web Analytics

What: a script from Ahrefs Pte. Ltd. (Singapore) runs on every page. It does not use cookies or browser storage. It sends Ahrefs the page address, referrer, browser language, screen size and pixel ratio. It also records every link you click (the address the link points to, including links within our own site) and the address that a form is submitted to; it does not send what you type into forms. Ahrefs also necessarily receives your IP address and user agent, as with any request to its servers.
Why and legal basis: basic traffic measurement. Legitimate interests (f).
Who receives it: Ahrefs.
How long: Ahrefs’ privacy policy says it keeps data only as long as necessary and gives no fixed period.
Please note: this script and the statistics in item 3 run whether you click Accept or Decline on the cookie banner. The banner only controls Google Analytics (item 5). To object to items 3 and 4, email us (see “Your rights”).

5. Google Analytics – cookies only if you accept

What: before you decide, and if you click Decline, the page sends Google Analytics a cookieless measurement request: no cookie is set and no identifier is stored on your device. Like any request to a web server, Google receives the page address, device details and IP address. If you accept, Google Analytics 4 also sets its cookies (_ga, _ga_5334HKV3FS) so it can recognise a returning browser and how you interact with pages. Google signals, advertising features and ad personalisation are switched off.
Why and legal basis: statistics about how the site is used. Your consent (a), which you can withdraw at any time (see “Cookies and similar technologies” for how).
Who receives it: Google, which acts on our behalf.
How long: for the retention period set in our Google Analytics account.

6. Google Fonts

What: our pages load their typefaces from Google’s servers (fonts.googleapis.com and fonts.gstatic.com). Your browser therefore sends Google your IP address and browser details when each page loads. We do not set a cookie for this and our site sends no referrer to Google.
Why and legal basis: displaying the site in its intended typefaces. Legitimate interests (f).
Who receives it: Google.
How long: as set by Google.

7. Cloudflare

What: all traffic to capyfuel.com passes through Cloudflare, Inc., which acts as a content delivery and security layer. Cloudflare processes your IP address, the request and your browser details, and may receive network-error reports from your browser. It also serves a small script that protects email addresses on our pages from spam harvesters.
Why and legal basis: delivering the site quickly and securely. Legitimate interests (f).
Who receives it: Cloudflare, which acts on our behalf.
How long: as set by Cloudflare.

8. Comments and product reviews

What: product pages and some articles have a comment or review form. It asks for your name, email address, your comment and (for reviews) a rating. Name and email are required. WordPress also stores your IP address and user agent with the comment. A first comment is held for our approval. Once approved, your name, comment and rating are public; your email address is not shown. When an approved comment is displayed, WordPress asks Gravatar (Automattic Inc.) for a profile picture by sending it a one-way hash of your email address. When a comment is submitted, WordPress emails us a notice containing your name, email address, IP address and the comment; that notice goes to an administrator mailbox hosted by Google (Gmail). If you tick the “save my name, email and website in this browser” box, WordPress also stores them in cookies in your browser.
Why and legal basis: publishing the comment you chose to send: your consent (a). Keeping the IP address and user agent to moderate comments and deal with abuse: legitimate interests (f). If you do not provide a name and email address we cannot accept your comment.
Who receives it: the public (name, comment, rating), Gravatar, and Google (Gmail for the notice; Google Drive through the site backups in item 10).
How long: until we delete the comment or you ask us to. There is no automatic deletion. Copies in backups follow the periods in item 10.

9. Emails you send us

What: whatever you write to us, your email address and the message headers. The site has no contact form; you write to the address above. Messages arrive at our own mail server, hosted with our hosting provider.
Why and legal basis: answering you. Legitimate interests (f), or taking steps at your request before a contract where that applies.
Who receives it: our hosting provider, and Google (Google Drive), where the mail server’s mailboxes are backed up every night.
How long: in the mailbox, as long as needed to deal with your message and any follow-up; there is no automatic deletion, and we delete a conversation on request. The nightly mailbox backups are kept for 30 days, and a monthly copy is kept for 180 days.

10. Backups and order records

Order records: although checkout is switched off, our shop software still holds two order records dated 19 June 2026. They contain the details entered at checkout: name, billing and shipping address, email address, phone number, IP address and browser string. We keep them as a record of the shop’s own activity (legitimate interests (f)); if one of them relates to you, you can ask us to delete it. There is no automatic deletion.
Backups: we back up the site, the analysis database and the mailboxes so that we can restore them after a failure. Legal basis: legitimate interests (f). The copies are:

  • a daily backup of the site, files and database, which includes the comments in item 8 and the order records. It is kept on our server for 30 days, and a copy is stored in a Google Drive account that we control. We do not delete the Google Drive copies automatically: they are kept until we delete them, and we review them at least once a year;
  • a daily database dump made by our server control panel (CloudPanel), kept on our server with its retention set to 7 days;
  • a daily backup of our analysis database (items 2 and 3), kept on our server for 5 days and in Google Drive for 30 days;
  • a nightly backup of the mailboxes (item 9), kept for 30 days, plus a monthly copy kept for 180 days;
  • occasional copies of the site database taken before maintenance work, which stay on our server until we delete them by hand.

Cookies and similar technologies

Simply visiting the site sets no cookies. We use no advertising cookies and no cross-site tracking. Before you click Accept, Google Analytics receives a cookieless measurement request (item 5). The only things stored on your device are:

  • capyfuel_consent – our own cookie, set when you click Accept or Decline on the banner, to remember your choice. It lasts 180 days. To change your mind, delete this cookie (and any cookies starting with _ga) in your browser settings; the banner will then appear again.
  • _ga and _ga_ followed by an identifier – Google Analytics cookies, set only if you click Accept. Google’s default lifetime for them is two years.
  • cf_sid and cf_sid_t – entries in your browser’s session storage (not cookies) used by our own visitor statistics (item 3); removed when you close the tab or after 30 minutes without activity.
  • comment_author cookies – WordPress cookies holding your name, email and website, set only if you tick the box on the comment form. They last about 347 days.
  • WordPress login cookies – set only for site administrators who log in. Visitors cannot create accounts.

Who receives your data

We do not sell personal data. The companies that process it for us or receive it are:

  • Hostinger International Ltd. (Cyprus) – hosts the server that runs the site, our email and our databases (items 1, 2, 3, 8, 9, 10).
  • Cloudflare, Inc. (USA) – item 7.
  • Ahrefs Pte. Ltd. (Singapore) – item 4.
  • Google (Google Ireland Limited, and Google LLC in the USA) – Google Analytics (item 5), Google Fonts (item 6), Gmail for comment notices (item 8) and Google Drive for backups (items 2, 3, 8, 9 and 10).
  • Automattic Inc. (USA) – Gravatar profile pictures (item 8).

The site contains no advertising networks, social-media pixels, captcha service, newsletter service or embedded video. When you click a link to a retailer or another website, that site’s own privacy notice applies to what it collects from then on.

Transfers outside the European Economic Area

Some of the recipients above are outside the EEA, so your data can leave it:

  • Our server. Hostinger operates data centres inside and outside the EEA, and public IP-location records place our server’s address in the United States. Hostinger’s data processing addendum incorporates the European Commission’s standard contractual clauses.
  • Cloudflare (USA) relies on the EU–US Data Privacy Framework and the standard contractual clauses in its data processing addendum.
  • Ahrefs (Singapore) states in its privacy policy that it stores the data it collects in the United States and protects transfers with the European Commission’s standard contractual clauses.
  • Google and Automattic (USA) transfer data to the United States under the EU–US Data Privacy Framework or standard contractual clauses, as described in their own terms.

You can ask us for details of these safeguards by email.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict how we use it;
  • receive data you gave us in a structured, commonly used format;
  • object at any time to processing we base on legitimate interests (items 1 to 4, 6 to 10);
  • withdraw your consent at any time where we rely on it (items 5 and 8), without affecting what was done before.

To use any of these rights, email [email protected]. We reply within one month. We may ask you to prove who you are. Our server logs and statistics are indexed by IP address rather than by name, so to find your records we need your IP address and the approximate dates of your visits.

We do not take decisions about you by automated means, and we do not build advertising profiles.

Complaints

You have the right to complain to a supervisory authority. Ours is the Office of the Information and Data Protection Commissioner (IDPC), Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta (idpc.org.mt). You can also complain to the data protection authority in the EU country where you live or work. We would appreciate the chance to put things right first, so please write to us.

Changes to this notice

When what the site does with personal data changes, we update this notice and its “Last updated” date.