Data Processing

Controller details

Data controller: Jan Duch, trading as Tons Of Experience. Business address: International House, 64 Nile Street, London, N1 7SR, United Kingdom. Contact: support@sitesimple.io.

What data is processed during an audit

When you submit a URL for audit, the following processing takes place:

• An HTTP request is made from our server to the target URL
• The HTML content of the response is analysed
• HTTP response headers are inspected
• Page content is scanned for specific patterns and elements
• Supporting public pages, such as privacy, terms and contact pages, may also be checked
• Paid audits use Anthropic for AI analysis; free audits do not use AI

What we do NOT do

• We do not log in to the target website
• We do not modify any content on the target website
• We do not access private or authenticated areas
• We do not store any credentials for the target website
• We do not track individual visitors to the target website. Public content we read may contain names or contact details

Server-side processing

All audit processing happens on our servers, not in your browser. Your browser only sends the URL to our API and receives the completed results.

Data retention

• Free audits: results are retained while your account exists. You can delete individual audits from your dashboard.
• Paid users: data is retained while your account exists. Cancelling billing does not delete the account or automatically erase audit results. To take a copy with you, use the “Download my data” button on the My Account page in your dashboard at any time. You can also email support@sitesimple.io if you need help, and we will respond within one calendar month, in line with UK GDPR Article 15 (right of access) and Article 20 (right to data portability).
• Account deletion: you can delete your account and its saved audit, Google and advisor data from your account settings, or by emailing support@sitesimple.io. Limited fraud-prevention and acceptance records can remain; see the privacy policy for the exceptions and retention information.
• Search Console traffic history: where Google Search Console is connected, one row per site per day holding site-level totals only (clicks, impressions, click-through rate, average position). Retention limit: 400 days. Deleted on account deletion. Google disconnection stops future access; to erase saved history sooner, email support@sitesimple.io. The daily history contains no query-level or page-level rows. Saved explanations and advisor conversations may include search terms and page information.
• Advisor conversations: questions and replies are saved with your account until account deletion, included in your data export and erased by account deletion. Disconnecting Google does not erase information already included in those conversations.

Sub-processors

The third parties below process some of your data so we can run the service. Most act as our processors and must handle personal data under appropriate processing terms. A few act as independent or joint controllers of their own data rather than our processors (noted in their entries below - Stripe for payments, Google for Search Console, and Meta for ad measurement); for those, their own terms govern the data rather than a processing agreement with us. Our canonical, more-detailed list lives in our privacy policy; the summary here is for technical-procurement reviews.

• Supabase - database, authentication and sessions. EU-hosted project. Its published standard DPA names Supabase Pte. Ltd., Singapore, with SCCs and the UK Addendum for relevant transfers; the applicable account agreement governs.
• Vercel Inc. - application hosting, request metadata, IP, headers. Region: US. Transfer mechanism: UK-US Data Bridge (under the Data Privacy Framework).
• Anthropic - paid audit analysis, Google explanations and advisor questions, history and findings. Published UK commercial terms identify Anthropic Ireland Limited; processing can involve Anthropic PBC in the US. Published DPA safeguards include SCCs and the UK Addendum; the applicable account agreement governs.
• OpenAI (OpenAI OpCo, LLC, US) - helps the advisor search our guidance library by processing search text, which may include details from your question or website. Under its published API policy, submitted data is not used to train or improve models unless the API customer explicitly opts in. Abuse-monitoring logs may include submitted content and are kept by default for up to 30 days, or longer where required by law or reasonably needed to protect OpenAI's services or others from harm. OpenAI OpCo, LLC is the contracting entity for UK business customers under the published DPA. UK data transfers use EU standard contractual clauses with the UK Addendum, which provide contractual safeguards for processing outside the UK. See OpenAI's API data policy and Data Processing Addendum.
• Cloudflare, Inc. - browser rendering for JavaScript-dependent audit checks; receives the submitted URL and the resulting page content only. Region: US. Transfer mechanism: UK-US Data Bridge where its Data Privacy Framework (UK Extension) certification is confirmed active, otherwise UK IDTA + Transfer Risk Assessment. Transient - not retained after the render. DPA in place.
• Sentry (Functional Software, Inc. / Sentry GmbH) - error monitoring; receives stack traces, pseudonymous account identifier (still personal data), and URL paths from failures. Region: US / EU. Transfer mechanism: UK-US Data Bridge. Retention: 90 days.
• Stripe Inc. - payment processing; card, billing address, email. Region: US. Transfer mechanism: UK-US Data Bridge. Stripe is an independent controller, not our processor.
• Resend (Plus Five Five, Inc., under its published DPA) - transactional and marketing email delivery; email address, content, delivery metadata. Region: US. Published DPA safeguards include SCCs and the UK Addendum; the applicable account agreement governs.
• Google LLC - Sign-in-with-Google OAuth, Google Analytics 4 cookies on opt-in, Google Search Console + PageSpeed Insights API responses. Region: US. Transfer mechanism: UK-US Data Bridge. For Google Analytics, Google is our processor under the relevant data processing terms. For Google Search Console, Google is the independent controller of your site's search data under its own terms and we only receive read-only reports, so that is a controller-to-controller relationship with no data processing agreement. Search Console site-level daily totals are stored by us for up to 400 days to provide traffic-trend tracking and change alerts; the daily history stores totals only. Saved explanations and advisor conversations may include search terms and page information.
• Meta Platforms Ireland Ltd / Meta Platforms Inc. - optional advertising measurement when configured, not a sign-in method. Browser Pixel and server-side Lead events require Accept-all consent. These can include IP addresses, user agents, click IDs and campaign information; Lead also sends hashed email and account identifiers. Server-side Subscribe measurement is separate, under the legitimate interest described in the privacy policy: hashed email/account identifiers, an opaque event identifier, timestamp and subscription metadata. Subscribe does not send IP addresses or campaign cookies. Objections received at support@sitesimple.io are recorded as an account suppression preference. Hashes and subscription identifiers remain personal or pseudonymous data. No audit content or plaintext email is sent. See the privacy policy for the paths, rights and Meta terms; Article 26 joint-controller arrangements are distinct from Article 28 processor terms.

Data deletion

You can request deletion of your audit data at any time by emailing support@sitesimple.io. We will process deletion requests within one calendar month, in accordance with UK GDPR.