This describes the service as built. It is not yet an approved notice, and sales are closed.
What we collect and why
| Data | When | Why | Proposed retention (awaiting approval) |
|---|---|---|---|
| Your email address | When you order | To send your receipt, sign-in links and your report (contract) | With your order records |
| Business facts you give us (business name and type, what you sell, where your customers are, the pages you choose, website platform, who edits the site, your notes) | Intake | To carry out the review you ordered (contract) | With your order records |
| The public content of the pages you select | When we collect evidence | To base each finding on dated evidence (contract) | Raw page copies about 30 days; observations with your report |
| Messages, answers to our questions, correction and refund requests | When you contact us about an order | To support your order (contract) | With your order records |
| Your IP address | Fit check, sign-in and forms | To prevent abuse (legitimate interests). Stored only as a salted hash inside short-lived counters | About 7 days |
Two strictly necessary cookies (sfp_session for sign-in, sfp_anon to link your fit check to your checkout) | Fit check and sign-in | To keep you signed in and your order secure | Sign-in: up to 7 days idle / 30 days; fit-check link: 7 days |
| Card details | Payment | Taken by Stripe on Stripe’s own page. We never see or store your card number | Stripe’s policy |
We keep a minimum financial record of each order (reference, amounts, dates and payment identifiers) for accounting. The exact retention periods above are proposals and will be confirmed with our accountant and legal adviser before sales open; “as long as the law requires” is not a period, so we will publish actual durations.
Who else processes your data
- Cloudflare — hosting, database and private file storage for the website and your report.
- Stripe — card payments and refunds.
- Anthropic — optional wording polish of already-selected fix tickets after payment (Claude API). A data processing agreement is not yet recorded on this draft page.
- An email delivery provider — to send your receipt, sign-in links and report notices. The provider will be named here once chosen and tested.
- Our reviewing practitioner — reads your intake and evidence to review your report.
We do not use analytics, advertising or tracking cookies, call tracking or third-party scripts on the pages where you order. Optional AI (Anthropic Claude) may polish already-selected fix-ticket wording after payment; it does not choose findings. Transfer safeguards and processor terms for each provider are being checked before sales open.
Automated steps and human review
Our software collects evidence from the pages you choose and proposes up to three evidence-backed fixes using fixed rules. Optional AI (Anthropic Claude) may polish the wording of already-selected tickets; validated packs are released automatically without a named human practitioner gate (owner decision, 5 October 2026). Significant decisions about refunds and support remain with the human operator. When AI polish is enabled, selected page excerpts and ticket text may be sent to Anthropic (Claude API) as a processor to rewrite wording only. A data processing agreement and retention terms with Anthropic are not yet recorded on this page. This privacy notice remains a draft for legal review.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Signed-in customers can request deletion from their account settings; you can also use the contact page. We confirm within one month and explain any records we must keep, such as accounting records. You can also raise a concern with the Information Commissioner’s Office (ico.org.uk).
Do not send sensitive information
Use only public business-page addresses. Do not send passwords, private document links, customer information or addresses containing private tokens.
Still to be approved before sales open
- Final legal wording of this notice.
- Actual retention periods, confirmed with the accountant.
- Named email provider and processor terms for each provider.
- Whether the ICO data protection fee applies.