Privacy policy
We collect what we need to test your site, send you the results and do the work you hire us for. We don't sell it, and we don't use it for advertising.
Last updated November 6, 2026.
When you request a free scan
The form asks for your website address, your email, and optionally your name, your platform and a note. We use them to:
- scan up to 50 public pages of the site you named, following its robots.txt;
- email you the report and a quote;
- send at most one reminder about the quote, with a link to stop it.
To stop abuse of the form, we keep a one-way hash of the internet address the request came from, never the address itself, and limit how many requests one address or email can make. Cloudflare Turnstile checks that the request comes from a person; Cloudflare processes the information its check needs.
When you hire us
- Your project page is a private link that expires after 60 days. We record when it is opened.
- Accepting a quote: we keep the name you type, the time, and a purchase order number if you give one.
- Payments go through Stripe. You type card or bank details on Stripe's page, and we never see them.
- Connecting WordPress: WordPress creates an application password for us. We store it encrypted, use it only to make and undo the fixes, and you can revoke it in WordPress at any time.
- Connecting GitHub: you install our GitHub App on the repository you choose. We keep the repository's name and your GitHub username. GitHub gives us access that lasts an hour at most, each time we open or check a pull request, and you can remove the app in your GitHub settings at any time.
- AI drafts: to draft image descriptions and control names, we send the image or the page snippet to Anthropic's Claude. A specialist reviews every draft before it reaches your site.
We keep a record of every change we make to your site (what changed, who approved it, and when) so we can answer for each fix and undo it. That record isn't deleted.
Who handles data for us
- Render hosts our workbench and its database in the United States.
- Resend sends our emails.
- Stripe handles payments and invoices.
- Cloudflare runs the bot check on the free-scan form.
- Anthropic runs the AI that drafts fix text.
- GitHub, if your site's code is there: our fixes reach you as a pull request on your repository.
- Netlify hosts this website.
Cookies and tracking
This website has no analytics or advertising trackers and sets no cookies of its own. Your project page sets one cookie that protects its forms from being submitted by other sites. While you connect GitHub, a second cookie remembers your project for up to 30 minutes, then it is deleted.
Your choices
To get a copy of what we hold about you, correct it, or have it deleted, reply to any email we have sent you. We delete what we are not required to keep, such as invoices for tax purposes and the record of changes made to your site.
Changes
If we change this policy, we update the date at the top of this page.