Privacy policy

• The website you ask us to check — its address, the public pages our crawler reads from it (up to 25), and the findings and scores we calculate. This is mostly information about a website, not a person. But the pages may include personal data their owner has published, such as the names, job titles, photos or contact details of staff, and where the site belongs to a sole trader the address alone may identify somebody. After the check itself is deleted we keep a short record that the website was checked: its address, when it was checked, how many times, and the scores. That record says nothing about who asked for the check.
• Your details, if you ask for a fix plan or about a package — your name, email address, business name and phone number (both optional), what you asked for, any message you write, and which website you checked. We keep a copy of your result’s scores and findings with your enquiry so we can answer it.
• Messages you send us through the contact form — your name, email address, business name and website (both optional), what it is about, and your message.
• Technical data — your IP address, scrambled one way with a secret key so that it cannot be turned back into the address, even by somebody holding a copy of our database. We keep it with any details or message you leave, and briefly in memory to count how often the forms are used, so we can limit abuse. We do not store your raw IP address, and our own logs do not record it. Our network and hosting providers keep short-lived access logs, including IP addresses, for security.

You do not have to give us any personal data to run a check. If you want a reply from us, we need your name and email address; without them we cannot reply.

We do not use third-party analytics or advertising trackers on this site.

This site sets no advertising or analytics cookies and keeps nothing of its own in your browser. The forms on this site use Cloudflare Turnstile to tell people from bots, and Cloudflare sits in front of the site. Cloudflare may set cookies of its own that are strictly necessary for those security checks and nothing else; see Cloudflare’s cookie policy for their names. They are not used for advertising or to profile you, so we do not ask for consent to them.

• To run the check you asked for and show you the result. Lawful basis: performance of our agreement with you (our terms of use), and our legitimate interest in providing a free tool that shows businesses what they could improve.
• To read the pages of the website being checked, including any personal data published on them. Lawful basis: our legitimate interest in assessing a public website at somebody’s request. We use those pages only to produce the findings and do not build any profile of the people named in them.
• To answer your request for a fix plan or about a package. Lawful basis: taking steps at your request before entering into a contract, and our legitimate interest in replying to an enquiry you made.
• To reply to a message you send us. Lawful basis: our legitimate interest in answering enquiries.
• To keep the site secure and prevent abuse of a free service that fetches other people’s websites. Lawful basis: our legitimate interests.
• To comply with the law and to establish, exercise or defend legal claims. Lawful basis: legal obligation and our legitimate interests.

We reply by hand to what you asked about. We do not add you to a mailing list or send you marketing emails unless you agree to it, and you can ask us to stop contacting you at any time.

Where we rely on legitimate interests, we have weighed them against your rights and expect the use to be one you would reasonably expect. You can object at any time (see “Your rights”).

The check scores websites automatically. The scores are about a website, not about you, and we do not use them to make any decision that has a legal or similarly significant effect on you.

• Scan results, including the pages read, are deleted 30 days after the check.
• The record that a website was checked (its address, when, how many times, and its scores) is kept for as long as we run this service, so we know which sites have been checked. It holds nothing about who asked. The owner of a website can ask us to remove it.
• Details and messages you leave, and the copy of your result kept with an enquiry, are kept while we are in contact about your enquiry and for up to 24 months after our last contact, unless you become a client, in which case our client terms apply.
• Hashed IP addresses are kept with the details or message you leave, and deleted with them.
• We may keep data longer where the law requires it, or for as long as needed to deal with a legal claim.

We use these providers to run the service. Each acts on our instructions under a written contract and must keep the data secure.

• Render Services, Inc. — Application hosting, database and backups. Data: Scan results, the details and messages you leave, and hashed IP addresses.
• Cloudflare, Inc. — Network security, bot protection (Turnstile), DDoS protection and content delivery. Data: IP addresses and request metadata.
• Postmark (ActiveCampaign, LLC) — Email: delivering your contact-form messages and enquiries, with your check's findings, to our inbox. Data: Names, email addresses, phone numbers, message content and the findings of your check.
• Google LLC (PageSpeed Insights) — Page-speed measurement: Chrome UX Report field data and a Lighthouse test of a few pages per audit. Data: Public page URLs only — no personal data. When page-speed measurement is enabled.

We may also share personal data with our professional advisers (such as lawyers and accountants), with a regulator, court or law enforcement agency where the law requires it, or with a buyer of our business, who would have to treat it as this policy says. We do not sell personal data.

Some of our providers are based in, or process data in, the United States or elsewhere outside the UK. Where they do, the transfer is covered by UK adequacy regulations (including the UK–US data bridge, for providers certified to it) or by the UK International Data Transfer Agreement or Addendum, which require the data to be protected to UK standards. You can ask us for more detail.

The site is served only over encrypted connections, the data is held by our hosting provider with access limited to the people at Deplova who need it, and result pages can be opened only with their private, unguessable link. No system is perfectly secure, but we take appropriate technical and organisational measures to protect personal data.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete it;
• ask us to restrict how we use it;
• object to our using it on the basis of legitimate interests, and to any direct marketing;
• ask for data you gave us in a portable format, where the law gives that right;
• withdraw any consent you have given, at any time.

Send a request through our contact form. It is free, and we will reply within one month. We may need to confirm who you are first. If you are unhappy with how we handle your data, please tell us; you also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Anyone can ask us to check a public website. If a website you own was checked by somebody else and you would like the results and our record of the check deleted, or you would like our crawler not to read your site, use our contact form or see our crawler information page for how to block it. Our crawler obeys robots.txt.

If your personal data appears on a website that was checked, we held it only as part of that site’s pages, for the purpose described above, and it is deleted with the scan after 30 days. You have the same rights over it as described in “Your rights”.

The site is meant for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children.

We will update this page when the service or the way we use personal data changes. The date at the top says when it last did.