What we collect, and what we don't.

Last updated 13 September 2026. This page describes what this website collects and what happens to it. It is written to match what the site actually does rather than to cover every theoretical case.

When you fill in a form

The contact and free-audit forms ask for your email address, and depending on the form your name, a subject, a message, and your website address. We store exactly those, plus:

• which page you submitted from, and which form it was;
• your browser's user-agent string;
• a one-way cryptographic hash of your IP address — not the address itself. It is keyed with a secret, so it cannot be reversed back into an IP. We use it only to rate-limit abuse.

That record is stored in our database and a copy is emailed to us so a person can read and reply to it. We use it to answer you and, if you become a client, to do the work. We do not sell it, and we do not send marketing email to addresses collected this way.

When you use the website checker

The checker on the home page fetches the address you type and reports what it finds. The address you check is not stored. The only thing written down is the same one-way hash of your IP and a timestamp, used to stop the tool being abused. Nothing about you is kept until you choose to give us an email address.

Analytics and cookies

We use Google Analytics 4 to count visits and see which pages get read. It sets cookies in your browser (_ga and a related identifier) and gives us aggregate figures: pages viewed, approximate location derived from IP, browser and device type, and the site you arrived from. We do not use it to build advertising profiles.

If your browser sends a Global Privacy Control signal, we do not load Google Analytics at all. Not a reduced version of it — the script is never requested, so no cookie is set and Google is not told you visited. Firefox, Brave and DuckDuckGo send this signal by default; most other browsers offer it as a setting or an extension. This is the simplest way to opt out and it requires nothing from you on this site.

You can also block or delete cookies in your browser settings. The site works normally without them.

Spam protection

The forms are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a bot. Cloudflare receives your IP address and some technical signals about your browser to make that judgement, and may set its own cookies on Cloudflare's domain as part of the check. It is used only to verify the submission.

Who else sees it

We do not sell or rent personal information. It reaches these service providers only because they run parts of this site:

• Vercel — hosting. Serves the pages and keeps standard server request logs.
• Supabase — the database the form submissions are stored in.
• Resend — delivers the notification email to us.
• Google Analytics — traffic measurement, unless you send a Global Privacy Control signal.
• Cloudflare — the Turnstile anti-bot check.

How long we keep it

Enquiries are kept while there is a reason to — an open conversation, an active engagement, or our own business records. Ask us to delete yours and we will. Analytics data is retained according to the setting on our Google Analytics property.

Your choices

• Opt out of analytics — turn on Global Privacy Control in your browser, or block cookies.
• See what we hold about you, have it corrected, or have it deleted — email us and we will do it.
• California residents have rights to know, delete, correct, and to opt out of sale or sharing under the CCPA/CPRA. We do not sell or share personal information for cross-context behavioural advertising, and we honour Global Privacy Control as an opt-out signal.

Children

This is a service for businesses. It is not directed at children and we do not knowingly collect information from them.