Privacy policy

The short version

We collect three things when you run a scan: your business name, one contact detail (a WhatsApp number or an email address), and optionally your website address. That is all. We use them to run the scan and send you the result.

We do not sell your details, we do not add you to a mailing list, and if you do not reply we do not chase you.

What we collect, exactly

From the scan form: the business name you type, the contact you give us, and the website address if you provide one. Nothing else is requested and nothing else is stored from the form.

From your web server, automatically: when you give us a website address, our scanner requests that page the way any browser would, plus its robots.txt and sitemap.xml, and follows up to eight links on it to check they are not broken. Your server records our visit in its own logs, exactly as it records every other visitor.

Technical data our host keeps: Vercel, who host this site, log the IP address and browser of requests for security and abuse prevention. We use that only to rate-limit the scan so it cannot be pointed at someone else as an attack.

Cookies and analytics — your choice, and nothing before it

We use Google Analytics to see which pages people find useful. It sets cookies. Nothing loads until you press Allow on the banner — not Google Analytics, not Google Tag Manager, nothing. If you press No thanks, or simply ignore the banner, no analytics code is ever downloaded and no cookie is ever set.

That is stricter than most sites, which load the tags immediately and merely withhold the cookies. We would rather nothing contacted Google at all until you agreed.

Separately, and for everyone, we count page views using Vercel Web Analytics — the company that hosts this site. It sets no cookies, stores nothing in your browser, and cannot follow you to any other website. It tells us how many people visited a page and roughly which country they came from, and nothing that identifies you. Because it stores nothing on your device and cannot track you elsewhere, it runs whether or not you allow the Google cookies. If you would rather it did not count you, most content blockers stop it.

Your choice is remembered in your browser’s local storage, not in a cookie, so declining genuinely stores nothing that travels to a server. Clearing your browser data resets the question.

When analytics is allowed, Google receives the pages you viewed, roughly where you are, and what kind of device you used. It does not receive your name, your phone number or anything you typed into the scan form. IP addresses are anonymised.

What we never collect

No Facebook pixel, no fingerprinting, no session recording, no heatmaps, no third-party advertising trackers.

We do not ask for and never want your passwords, card details, bank details, Aadhaar, PAN or GST credentials. If work later requires access to your Google or advertising accounts, you grant it through those platforms’ own permission screens, in your name, and you can revoke it at any time without asking us.

Where your details go

Your scan submission is sent to our own workflow tool (n8n) which creates a task for us and emails the details to the founder. Depending on configuration it may also send a notification to our business WhatsApp number, through Meta’s official WhatsApp Business API.

Those are the only third parties that receive your details, and they receive them only so that a human here sees your enquiry. They are processors acting for us, not buyers of your data.

The site itself is hosted by Vercel. Email is handled by Google.

How long we keep it

Enquiries are kept for as long as there is a live conversation, and for up to twenty-four months afterwards so that we can find what we told you if you come back. After that they are deleted.

Repeat submissions from the same business and the same number within twenty-four hours are recognised and not re-sent, so you do not get logged twice for pressing a button twice.

Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Message the WhatsApp number or email address in the footer and quote your scan reference if you have one — it looks like OZ-XXXXX. We will action it within thirty days and we will not ask you why.

Deletion is genuine deletion, not a flag. If you ask, the enquiry is removed from our task list, our records and our inbox.

Children

This is a service for businesses. It is not directed at anyone under eighteen and we do not knowingly collect information from children. If you believe a child has submitted details, tell us and we will delete them.

Scanning someone else’s website

The scanner only reads what is already public — the same pages any visitor or search engine can see. It does not attempt to log in, does not submit forms, does not test for vulnerabilities, and refuses to fetch private or internal network addresses.

It is rate-limited. Please do not use it to load-test a site you do not own.

Changes, and how to reach us

If this policy changes materially, the date at the top changes with it. There is no version history yet because there has only been one version.

Questions about any of this go to the contact details in the footer, and reach the founder directly rather than a support queue.