How I handle your information.

In short

• I collect what you give me and what a scan reads from public web pages. Nothing else.
• Your email address, your messages and your orders stay with me and with the services that run this site for me.
• The services that measure websites get public pages and questions about your market, never your email or your messages.
• No tracking cookies, no ad networks, and I never sell or rent anything about you.
• Ask me what I hold about you, or ask me to delete it, and I will.

What I collect

The website you scan

The address you enter and what the scan reads from that site’s public pages, including the contact details the business publishes there. A scan needs no email address.

Your email address

Only when you give it: to get the full report, write to me, ask me to run an audit by hand, book a call, buy, or sign up for the monthly briefing. I check that it can receive mail and turn away throwaway inboxes.

What you write

Your letter or request, your company and website, and your time zone, so I reply at a sensible hour for you.

Orders and invoices

What you bought, the amount, your company, billing address and VAT ID, and the confirmations you ticked. Card details go to Stripe; I never see them.

How you found me

The page you arrived on and the campaign tag in the link, if there was one, kept with a scan or an order so I know which pages work.

Network details

IP addresses only as one-way hashes, to limit how often one connection can scan or send, and to stop abuse. Page events (a button clicked, a form step reached) are counted without cookies or anything that identifies you.

What I use it for

• Replying to you and preparing for our conversation.
• Delivering the audits and the work you ordered, and invoicing them.
• A few short follow-up notes after a report or a purchase. Every one has a link that stops them in one click. The monthly briefing goes only to people who confirmed it.
• Keeping the site safe: rate limits, the bot check and refusing throwaway addresses.
• Getting in touch by hand with a business whose site was scanned, through the details it publishes itself. I never say who ran the scan, and I never put a scanned business on an email list.

I don’t sell, rent or trade anything about you, I don’t use ad networks, and I don’t add you to anything you didn’t ask for.

Who handles it for me

I don’t run my own servers. These services do part of the work for me and see what that part needs:

Cloudflare

Hosting, the database, sending email, the bot check on the audit and letter forms, and counting page events without cookies. What it sees: What is stored on this site, because this is where it lives.

Stripe

Payments, receipts and invoices. What it sees: Your email address, company name, billing address, VAT ID and card or bank details. Card details go straight to Stripe; I never see them.

Cal.com

Booking a call. It loads only when you open the calendar. What it sees: What you type into the booking form.

WhatsApp (Meta)

Messages and calls, when you choose to message me there. What it sees: Your phone number and what you write.

My own mailbox

Where notices of new letters, requests and orders arrive. What it sees: The same details you sent through the site.

How I protect it

• Every connection to this site and between its services is encrypted.
• Only I can open the admin side, with a one-time code sent to my email for every sign-in.
• Report, payment and stop links are long random codes that can’t be guessed. Your email address never appears in a link.
• No tracking cookies and no ad networks. The only outside script that loads by itself is Cloudflare’s bot check on the audit and letter forms; the booking calendar and videos load only when you click them.

How long I keep it

A daily job deletes old records on its own:

Letters and order requests

24 months, unless we work together; then for as long as we do and my accounts require.

Scans and report emails

12 months, together with the address the report went to, any request to run the audit by hand, and the contact details the scanned site publishes; a report with a paid audit stays 12 months from the payment. A record of the emails I sent: 12 months.

Orders and invoices

Kept for my accounts, at least as long as tax law requires, together with any credit they carry. The files of a Premium AI Audit (the public page content it read, the screenshots and the PDF) are kept with the order.

Rate-limit hashes

2 days.

Your contact entry

Your email address and time zone stay in my contact list until you ask me to delete them. If you asked me to stop writing, I keep a note of that, so the address stays stopped.

The monthly briefing

Your address while you’re subscribed. A sign-up that is never confirmed is deleted after 30 days.

See, correct or delete it

Ask me what I hold about you, to correct it, or to delete it. Message me on WhatsApp or write through the contact page; once we’re talking, my direct email is in every reply and you can simply answer that. Personal reply within one business day.

I delete everything except what tax law makes me keep for orders and invoices, and the note that keeps a stopped address stopped.

Who is responsible

I decide what this site collects and why, and I’m the person who answers for it. Who runs this site · Terms of sale

Changes to this page

When I change how I handle information, this page changes first and the version date at the top moves.