Privacy Policy

Who we are

sitesimple.io is a website audit tool operated by Jan Duch, trading as Tons Of Experience. Business address: International House, 64 Nile Street, London, N1 7SR, United Kingdom. Contact: support@sitesimple.io. We scan websites and provide scores, findings, and recommendations across SEO, performance, security, accessibility, and more. This policy explains what data we collect, how we use it, and your rights.

What we collect

Free audit (free account required)

• The website URL you submit for auditing
• Audit results generated from that URL (scores and findings)
• Your IP address - used at the moment you submit an audit for rate limiting and abuse detection. We also record the IP address you signed up from and retain it for up to 12 months from your last sign-in for fraud and abuse prevention. We may cross-reference signup IP addresses against other accounts on the service to detect duplicate or fraudulent signups. See "Legal basis for processing" below for the lawful basis we rely on.
• A salted hash (a coded value) derived from your email address, used as an abuse-prevention ledger. When you run a free audit, we normalise your email (lowercased, trimmed, and with Gmail plus-tag suffixes such as "+anything" stripped so that you+one@gmail.com and you+two@gmail.com resolve to the same person), then store its salted hash alongside an audit count and timestamps. This lets us detect if the same person tries to open multiple free accounts to evade free-tier audit limits. The ledger is used for abuse prevention and is not shown to other users or used for marketing. Your data export includes your matching ledger record, with internal account-linking identifiers removed. We retain each record for up to 6 months from the last time we saw it, after which it is automatically deleted. See "Legal basis for processing" below for the lawful basis.

Signed-in users

• Email address (from your Google account or email sign-up)
• All audit results linked to your account
• AI advisor conversations: your questions, the advisor's replies and the website being discussed. We store these with your account so you can continue the conversation. The advisor can use your audit findings and connected Google Analytics and Search Console information to answer you.
• GA4 property ID, if you choose to connect Google Analytics
• Google Analytics data - accessed read-only; we never modify your analytics account
• Service-usage metrics linked to your account - which features you use, how many AI-powered analyses run for your audits, and roughly how much each analysis costs us to run. We use this internally to plan capacity, keep things fair across paying users, and stop a single heavy run from slowing the service for everyone. We keep this for 90 days, then delete it automatically. We also delete it immediately if you close your account.
• Search Console traffic history - if you connect Google Search Console, we keep a daily record of your site's overall search figures: the date, how many people clicked through to your site from Google, how many times you appeared in search results, what percentage of those turned into clicks, and your average position. We keep these day-by-day totals so we can spot when your traffic moves away from your own normal pattern and tell you about it. This daily history stores site totals, not individual visitor records or search terms. Separate saved Google explanations and advisor conversations can include search terms and page information.

What we collect during audits

When you submit a URL for auditing, we:

• Fetch the URL and analyse the page HTML and HTTP response headers
• Run automated checks against the content (SEO tags, security headers, accessibility markers, etc.)
• On paid plans, send relevant portions of the HTML to our AI partner (Anthropic) to generate plain English explanations. Free audits do not use AI.
• Store the audit results - scores, findings, and recommendations - linked to your account

We do not track individual visitors to the audited website. Public page content may include personal information, such as names or contact details. Alongside the submitted page, our checks may request supporting public pages, such as privacy, terms and contact pages.

How we use anonymised audit data

We aggregate anonymised audit data across all users to improve the service. For example, we may analyse which checks fail most often across audited sites, or which recommendations are most followed. This helps us prioritise improvements and write better guidance.

Anonymised means: no URLs, no account identifiers, no personally identifiable information. We never share individual audit data with third parties for their own use.

What we do NOT collect

• We do not install tracking on the audited website or collect its individual visitor activity
• A free account is required to run audits - no credit card needed
• We never sell your data to third parties

Age limit

sitesimple.io is intended for business users aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has signed up, please email support@sitesimple.io and we will delete the account.

Legal basis for processing

Under UK GDPR, we must have a legal basis for processing your personal data. Here is the basis for each type of processing:

• Account creation and management - Contract (we need your details to provide the service)
• Providing audit reports - Contract (delivering the service you signed up for)
• Sending service updates to subscribers - Contract (part of the subscription service)
• Rate limiting by IP address - Legitimate interest (protecting the service from abuse)
• Signup IP retention and cross-referencing for fraud and abuse prevention - Legitimate interest under UK GDPR Article 6(1)(f). We record the IP address you signed up from, retain it for up to 12 months from your last sign-in, and may compare it against other accounts to detect duplicate or fraudulent signups. We have carried out a Legitimate Interests Assessment (LIA) weighing this against your rights and concluded that this processing is necessary, proportionate, and would be reasonably expected by users of a free SaaS service. You have the right to object to this processing under Article 21 - email support@sitesimple.io.
• Normalised signup-email ledger for duplicate-account and free-tier abuse detection - Legitimate interest under UK GDPR Article 6(1)(f). We record a salted hash derived from the normalised email addresses of users who run free audits, retain each entry for up to 6 months from last seen, and use it only to flag repeat signup attempts that would otherwise evade free-tier limits. We have carried out a Legitimate Interests Assessment (LIA) and concluded that this is necessary (no less intrusive alternative reliably detects Gmail plus-alias evasion), proportionate (single field, short retention, internal use only, no third-party disclosure), and reasonably expected by users of a free SaaS with abuse controls. You have the right to object under Article 21 - email support@sitesimple.io.
• Internal usage statistics - Legitimate interest (improving the service)
• Server-side ad-measurement of paying customers (Meta CAPI Subscribe events) - Legitimate interest under UK GDPR Article 6(1)(f). We have completed a Legitimate Interests Assessment weighing this against your rights and concluded it is necessary, proportionate, and reasonably expected by customers of our subscription service. You have the right to object under Article 21 by emailing support@sitesimple.io.
• AI processing of website HTML - Contract (generating the audit you requested)
• Google explanations and the AI advisor - Contract (UK GDPR Article 6(1)(b)), to provide the paid features you request. This includes sending relevant questions, conversation history, audit findings and connected Google information to Anthropic, and using OpenAI to help search our guidance library. Please avoid including sensitive personal information in your questions.
• Responding to contact form messages - Legitimate interest (responding to your enquiry)
• Marketing communications - Consent under UK GDPR Article 6(1)(a) and PECR regulation 22. You opt in via an unticked checkbox at signup, on the newsletter form, or by toggling marketing preferences on in your account. You can withdraw consent at any time, and it is as easy to withdraw as it was to give: (a) click the one-click unsubscribe link at the bottom of any marketing email (no login required), or (b) sign in and switch off "Marketing emails" on your account page. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew, and does not affect service emails that form part of your subscription.
• Service administration and monitoring - Legitimate interest (we access aggregated statistics and recent audit data to monitor service health, identify errors, and improve the platform. We do not routinely access your email address or account details through this monitoring.)
• Service-usage logging (records of AI analysis work and running cost) - Contract (necessary to deliver the audit you requested, enforce per-user cost caps under our pricing terms, and prevent service degradation for other users).
• Storing your Search Console traffic history and alerting you when it changes - Contract (UK GDPR Article 6(1)(b)). Traffic tracking and alerts are part of the paid plan you subscribed to, and we cannot tell you your traffic has moved unless we keep a record of what it used to be. This daily history stores only your site's totals. Saved explanations and advisor conversations are described separately below. You can disconnect Google from your Account page to stop future access. To erase saved history as well, email support@sitesimple.io or delete your account.

Emails we send

The categories below explain which emails we send and why. Weekly and monthly email digests are paused; they are not currently part of the live subscription service.

1. Transactional emails (contract, Article 6(1)(b))

These are essential to operating your account. We do not need consent to send them, and you cannot opt out of them while you have an account.

• Welcome email after a paid subscription checkout
• Email address verification, password resets, and sign-in links
• Payment confirmations, failed payment notices, refund notices, and cancellation confirmations
• Important changes to these terms or to this privacy policy
• Confirmation that we received your contact-form enquiry (legitimate interest in responding to your enquiry, not marketing)

2. Subscription product emails (contract, Article 6(1)(b))

If you are on a paid plan (Starter or Pro), the following emails form part of the product you have paid for. Each one delivers the audit insights, monitoring and reporting your subscription includes, so we send them on a contract basis rather than as marketing.

• Algorithm change alerts when a known search or platform update may affect your site
• Search traffic alerts, when your site's Google traffic moves noticeably away from its own recent pattern - including where that lines up with a known Google update

If you do not want to receive these but want to keep your subscription, email support@sitesimple.io and we will switch them off for your account.

3. Onboarding emails for new free accounts (consent, Article 6(1)(a) + PECR Regulation 22)

When you create a free account, you may - if you ticked the marketing opt-in at signup - receive up to two short onboarding emails during your first week (typically one after 24 hours and one after 7 days). These include your audit score, highlight issues we found, and promote our paid plans. They are marketing emails that you have consented to receive. If you did not tick the marketing opt-in, you will not receive these. You can withdraw consent at any time using the one-click unsubscribe link in either email or from your account page.

4. Marketing emails (consent only, Article 6(1)(a) + PECR)

We only send marketing emails if you have ticked the marketing opt-in checkbox at signup, signed up to the newsletter, or switched marketing preferences on in your account. Marketing emails include:

• Product updates and new features that are not part of a paid subscription
• Tips, guides, and SEO or performance advice
• Promotional offers and upgrade opportunities

Every marketing email includes a one-click unsubscribe link that requires no login. You can also turn marketing emails off at any time from your account page. Withdrawing marketing consent has no effect on transactional or subscription product emails described above.

Data retention

Your data is stored securely in Supabase (EU region) with row-level security enabled. All connections are encrypted in transit using TLS.

• Free audits: results are retained while your account exists. You can delete individual audits from your dashboard.
• After a subscription ends: cancelling billing does not delete your account or automatically erase your audit results. They remain available while your account exists. Use “Download my data” or delete your account from My Account. You can also request erasure by emailing support@sitesimple.io.
• Account deletion: you can delete your account and its audit results, saved Google data and advisor conversations from your account settings page, or by emailing us at support@sitesimple.io. Deletion is permanent and cannot be undone. Limited fraud-prevention records can survive account deletion: the salted email ledger and its internal account links are retained for up to six months from last use. Acceptance evidence (version, time, method, IP hash and browser metadata) and restricted abuse records may remain where needed to evidence agreements, prevent abuse or deal with legal claims. These are personal or pseudonymous records, not anonymous data. Contact support for access, erasure or retention information. Some data may persist in our sub-processors' systems after deletion, for example Stripe payment records (which Stripe retains for accounting and tax compliance) and Resend email delivery logs (typically up to 30 days).
• Lead capture emails: the former report-email form is no longer available. Addresses collected through that form have a 12-month retention limit; contact support if you previously used it or want earlier erasure.
• Google Analytics snapshots: if you have connected Google Analytics, we cache a copy of your dashboard's aggregated metrics (the “snapshot”) in our database. We store a fresh snapshot when you generate a new audit or view your Google Analytics dashboard, so the dashboard is fast to load on subsequent visits. We retain snapshots for as long as your account exists and delete them when you delete your account, in line with the general retention rules above.
• Search Console traffic history: if you have connected Google Search Console, we store one row per day for each connected site, holding only your site's overall totals - clicks, times shown, click-through rate, and average position. We keep these for 400 days, a little over a year, so we can compare this month against the same month last year and tell the difference between a real problem and a normal seasonal dip. The retention limit for these rows is 400 days. The 400 days is a maximum for stored daily history. Account deletion erases it sooner. Disconnecting Google stops future access but does not automatically erase this history; you can request earlier erasure by emailing support@sitesimple.io.
• AI-generated explanations: the plain-English explanations shown on your Google Analytics and Search Console pages are reused for up to 24 hours per date range you view, after which they are refreshed on demand. This refresh interval is not a deletion deadline. Saved explanations may include search terms and page information. The narrative cache is deleted when you delete your account.

Business statistics after deletion

Business statistics after deletion. Before account deletion we record a row of bucketed statistics: deletion month, broad tenure, plan, usage, revenue and referral bands. It contains no account identifier or email. Bucketing alone does not guarantee anonymity, particularly for small groups; these records must be assessed for singling-out and linkage risks before being treated as anonymous or used in shared reports. Limited retained personal records are described above, separately from these statistics.

Data breaches

A data breach means personal data being lost, stolen, changed, or seen by someone who should not have access to it. If a breach happens, we assess what was affected and how serious it is. Where the breach is likely to put your rights or privacy at risk, we report it to the Information Commissioner's Office (the UK regulator) within 72 hours of becoming aware of it, as required by UK GDPR Article 33. Where a breach is likely to put you at high risk, we also tell you directly and without undue delay, in plain language, so you can take steps to protect yourself, as required by UK GDPR Article 34.

Third-party processors

We use the following third-party providers to operate sitesimple.io. Most act as processors and must handle personal data under appropriate processing terms. A few act as independent or joint controllers of their own data rather than our processors (this is noted in each provider's entry below, and applies to Stripe for payments, Google for Search Console, and Meta for ad measurement); for those, their own terms govern how they use the data, not a processing agreement with us.

• Supabase - hosted database, authentication and file storage for account data, audit results and session tokens. Our project uses the EU region. Supabase's published standard DPA identifies Supabase Pte. Ltd. in Singapore and uses standard contractual clauses with the UK Addendum for relevant transfers. See its published DPA; a specific account agreement can differ.
• Vercel (Vercel Inc., US) - application hosting and edge infrastructure. Processes request metadata (IP address, user agent, request headers) for security, debugging, abuse prevention, and operational purposes. May also generate aggregated traffic statistics for us. We do not use this data to build advertising profiles or to identify individual visitors. For full details see Vercel's privacy notice at vercel.com/legal/privacy-policy. Transfer mechanism: UK-US Data Bridge (DPF-certified).
• Anthropic - AI explanations for paid audits and connected Google data, and advisor questions, conversation history and findings. Its published commercial terms identify Anthropic Ireland Limited for UK customers; processing can involve Anthropic PBC in the US. Its published DPA includes standard contractual clauses and the UK Addendum. Provider retention depends on the API feature and applicable account agreement; contact support for details.
• OpenAI (OpenAI OpCo, LLC, US) - helps the advisor search our guidance library by processing search text, which may include details from your question or website. Under its published API policy, submitted data is not used to train or improve models unless the API customer explicitly opts in. Abuse-monitoring logs may include submitted content and are kept by default for up to 30 days, or longer where required by law or reasonably needed to protect OpenAI's services or others from harm. OpenAI OpCo, LLC is the contracting entity for UK business customers under the published DPA. UK data transfers use EU standard contractual clauses with the UK Addendum, which provide contractual safeguards for processing outside the UK. See OpenAI's API data policy and Data Processing Addendum.
• Cloudflare (Cloudflare, Inc., US) - page rendering for JavaScript-dependent checks. For some audits we need to load the page the way a real browser would (running its JavaScript) so our checks see the finished page rather than the raw code. To do this we send the single URL you submitted, and the resulting page content, to Cloudflare's browser-rendering service. This is transient: Cloudflare renders the page in the moment and we do not ask it to retain the URL or page content after the render completes. We do not send your account details or email through this service. DPA in place. Transfer mechanism: UK-US Data Bridge where Cloudflare's Data Privacy Framework (UK Extension) certification is confirmed active; otherwise the UK International Data Transfer Agreement (IDTA) with a Transfer Risk Assessment.
• Sentry (Functional Software Inc. / Sentry GmbH, US / EU) - error monitoring and performance tracing. Receives stack traces, a pseudonymous account identifier (which is still personal data), URL paths, and basic browser metadata. Client-side performance tracing runs only after you grant analytics consent; server-side operational tracing (request paths, timings) runs under legitimate interest for service reliability, with user IDs stripped. Error capture runs under our legitimate interest (see "Legitimate interest for error monitoring" below). Error data is retained for 90 days. Transfer mechanism: UK-US Data Bridge (DPF-certified).
• Stripe (Stripe Inc., US) - payment processing. Processes your payment details (card number, billing address, email) to handle subscription payments. Stripe acts as an independent data controller for payment data under their own privacy policy. We do not store your full card details. Transfer mechanism: UK-US Data Bridge (DPF-certified).
• Resend (Plus Five Five, Inc., US, under its published DPA) - transactional and marketing email delivery. Processes your email address, the email content we send, and delivery metadata to deliver messages and report on deliverability. Its published DPA provides standard contractual clauses and the UK Addendum for relevant transfers; the applicable account agreement governs.
• Google (Google LLC, US) - (a) OAuth authentication when you sign in with Google; (b) Google Analytics 4 when you grant analytics consent - GA4 cookies are only placed after you accept via our cookie banner; (c) Google Search Console API - when you connect your GSC account on a paid plan, we query the Search Console API read-only to show your keyword and page performance inside your dashboard, and we store a daily record of your site's overall totals only (clicks, times shown, click-through rate, and average position) so we can track your trend over time and alert you when it changes. The daily traffic-history table does not store query-level or page-level rows; saved explanations and advisor conversations can include search terms and page information; (d) Google PageSpeed Insights API - called during every audit to retrieve Core Web Vitals and performance metrics for the URL you submit. All four product API calls are handled by the same Google LLC legal entity. For Google Analytics, Google acts as our processor and the relevant data processing terms are in place. Google Search Console is different: Google is the independent controller of your site's search data and decides how it processes that data under its own terms, while we only receive read-only performance reports - so this is a controller-to-controller relationship and no data processing agreement applies. Transfer mechanism: UK-US Data Bridge (DPF-certified).
• Meta Platforms Ireland Limited (Facebook, Instagram) - optional advertising measurement when configured. This is not a Facebook or Instagram sign-in method. After you choose "Accept all", browser Pixel events can send page URLs, actions, campaign information, cookies and the browser's IP address and user agent to Meta. A normal email/password registration can also send a server-side Lead event: hashed email and account identifier, raw IP address and user agent, event identifiers and campaign codes (including click IDs). Hashing does not make these identifiers anonymous. Choosing Analytics only or Reject all does not permit these Pixel or Lead events.

  Server-side Subscribe measurement is separate from cookie consent and uses our legitimate interest described above. It sends hashed email and account identifiers, a stable opaque event identifier, timestamp, currency, amount and subscription identifier. This server-side Subscribe path does not send IP addresses, browser cookies, page URLs or campaign codes. You can object by emailing support@sitesimple.io; we record a suppression preference for your account and stop these events. This does not affect your subscription or payment processing.

  We do not send audit content, scores or plaintext email through these measurement paths. Meta's collection and subsequent processing are governed by its Business Tools Terms and applicable Controller Addendum, including the division of responsibilities for joint processing and applicable transfer safeguards. Joint-controller arrangements under Article 26 are distinct from processor terms under Article 28. Meta's privacy policy explains its processing and retention. We do not maintain a dedicated 90-day local Meta-event archive.

  You can withdraw browser ad-measurement consent using "Cookie preferences" in the footer or the cookie control. You can contact us or Meta to exercise rights concerning the processing each party controls.

Because several of these providers are US-based, personal data is transferred outside the UK. See "International data transfers" below for the safeguards we rely on.

Legitimate interest for error monitoring

Legitimate interest for error monitoring. Even if you decline analytics consent, sitesimple.io captures unhandled errors (exceptions) via Sentry to diagnose and fix production faults. The processing is narrow: stack traces, a pseudonymous account identifier (which is still personal data), the URL path where the error occurred, and basic browser metadata. We do not capture form values, chat contents, or audit payloads. Error data is retained for 90 days. You can request erasure of your error data by emailing support@sitesimple.io. This falls under our legitimate interest under UK GDPR Article 6(1)(f) in maintaining service reliability; we have balanced this against the low privacy impact of error metadata and concluded that users benefit from a working product more than they are harmed by this processing.

International data transfers

Several of our processors (Cloudflare, Vercel, Anthropic, OpenAI, Sentry, Stripe, Resend, Google, and Meta's US entity) are based in the United States, so some personal data is transferred outside the UK. UK law requires us to protect that data with a recognised safeguard, and the safeguard we use depends on the processor:

• UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework) - we rely on this only for processors whose Data Privacy Framework certification is currently confirmed as active. Because that certification must be renewed each year, we re-check it and fall back to the safeguard below for any processor whose certification is not active.
• UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, together with a Transfer Risk Assessment - we use this for every other US processor, and as our default whenever the Data Bridge is not available. These are the transfer agreements approved by the ICO.

The transfer mechanism we currently rely on for each processor is listed next to that processor under “Third-party processors” above. Our primary database project is hosted in the EU region. Supabase's published standard DPA identifies a Singapore entity and provides SCCs and the UK Addendum for relevant transfers, as described above.

Revoking Google access

If you have connected Google Analytics to your sitesimple.io account, you can withdraw consent and revoke that access at any time in two ways. Withdrawing consent does not affect processing that took place before you withdrew it; it stops future access.

1. From sitesimple.io: Go to your Account page, find the “Google Analytics” section, and click “Disconnect Google Analytics”. This immediately stops sitesimple.io from making any further automated requests to Google on your behalf, deletes your stored Google connection from our database, and tells Google's servers to revoke our access. Because Google Analytics and Search Console share the same Google connection in sitesimple.io, disconnecting also revokes our access to your Search Console data.
2. From your Google account directly: Visit myaccount.google.com/permissions, find “sitesimple.io” in the list of third-party apps, and click “Remove Access”. This revokes the permission you granted us, directly on Google's side.

Either method achieves the same outcome - we lose the ability to read your Google data. Encrypted backups of the saved connection may persist for up to 30 days before being overwritten in the normal backup rotation. Cached snapshots already stored in your sitesimple.io dashboard remain visible to you until you delete your account or run a new audit that overwrites them; you can request immediate deletion of cached snapshots by emailing support@sitesimple.io. For your broader rights under UK GDPR - including erasure, the right to object, and how to complain to the ICO - see the “Your rights (GDPR)” section below. Disconnecting Google stops future access. Saved Search Console history and advisor conversations are not automatically erased by disconnection; email support@sitesimple.io to request their deletion or delete your account.

AI processing

We use Claude by Anthropic to generate plain English explanations of paid audit findings. When you run an audit, relevant sections of your website's HTML are sent to Anthropic's API for analysis.

• Your website HTML is used only for your immediate audit request
• We use Anthropic's commercial API to provide these features, rather than a public chatbot account
• AI-generated explanations are stored in our database as part of your audit results

If you have connected Google Analytics, we also send your GA4 snapshot data (the same numbers shown on your dashboard) to Anthropic to generate the plain-English narratives and recommendations that explain what those numbers mean. We send the aggregated metrics, top traffic sources, top pages, device and geography summaries already visible in your dashboard. We do not send personally identifiable information about your individual visitors, raw event logs, IP addresses, user IDs, or any data that could re-identify visitors to your site. We reuse the generated explanation for up to 24 hours before refreshing it when needed; see “Data retention” for details.

On both Starter and Pro, the advisor can answer questions using your audit findings, Google Analytics figures and Search Console explanations, including relevant search terms and page information. Anthropic processes your question, relevant earlier messages and the information retrieved to answer it. OpenAI processes search text when the advisor looks up guidance. We store your messages and replies until you delete your account; they are included in “Download my data” and erased with the account. Disconnecting Google stops future access but does not erase Google information already included in saved conversations. You can request its deletion by emailing support@sitesimple.io.

We do not use your conversations or connected Google data to train our own AI models. Provider retention is separate from the copies we store in your account. OpenAI's published retention and transfer terms are explained in its entry above. Contact support@sitesimple.io for information about Anthropic's retention and safeguards. AI answers can be wrong; check important advice before acting on it.

Google user data (Limited Use)

When you connect Google Analytics or Google Search Console, sitesimple.io's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We use connected Google data to provide the features you request. Anthropic receives relevant Google Analytics figures and Search Console information to write explanations and answer advisor questions. Saved advisor replies may contain that information. The advisor may also use search text derived from the conversation to look up guidance through OpenAI. We do not sell connected Google data or use it for advertising or to train our own AI models.

We also store a daily record of your site's overall Search Console totals - clicks, times shown, click-through rate, and average position - for up to 400 days. This powers a feature you can see in your dashboard: your traffic trend over time, and the alerts that tell you when your search traffic moves away from its own normal pattern. We use this data only to provide that feature to you. We never use it, or anything worked out from it, for advertising, ad targeting, or building advertising audiences. We never sell it. We never combine it with other customers' data to build benchmarks or industry reports. Nobody at sitesimple.io reads your Search Console data except where you ask us for support, or where the law requires it. Disconnecting Google stops future access. To erase saved history, email support@sitesimple.io or delete your account.

Automated scoring

Our audit scores come from fixed automated checks. AI adds explanations and recommendations on paid plans; it does not decide the scores. No human reviews individual audit results before they are displayed. These scores describe a website, not a decision about a person, and are for information only.

Cookies

We describe four types of cookies:

• Essential cookies - used to maintain your login session (Supabase authentication). These are required for the service to function and cannot be disabled.
• Analytics cookies (Google Analytics) - we use Google Analytics to understand how visitors use our site. These cookies (_ga, _ga_*) are only placed after you give consent via our cookie banner.
• Ad-measurement cookies (Meta Pixel) - we use Meta Pixel to measure which adverts brought people to sitesimple.io and how those visits convert. The Meta browser cookie (_fbp) and click-ID cookie (_fbc) are only placed after you actively accept ad measurement via our cookie banner.
• Attribution cookie (sitesimple.io) - if you arrive from one of our adverts, we store a small first-party cookie called _attribution so that, if you later sign up or buy, we can tell which advert brought you here. It holds the campaign codes from the link you clicked (the utm_ tags, and Facebook's fbclid or Google's gclid if present). It lasts 30 days, is only readable by sitesimple.io, and is only placed after you choose "Accept all" via our cookie banner.

Because analytics and ad measurement are different purposes, our cookie banner gives you three choices (UK GDPR Article 7(2): consent must be specific to each purpose):

• Accept all - both analytics (Google Analytics) and ad measurement (Meta Pixel) are switched on.
• Analytics only - we measure how features are used so we can improve the service, but we do not load Meta Pixel or place ad-measurement cookies. Server-side payment measurement is separate, as explained below. If you've chosen this, you'll still see ads (everyone does) but they won't be tailored to you based on what you've done on sitesimple.io. No _fbp or _fbc Meta cookies are placed.
• Reject all - neither analytics nor ad-measurement cookies are placed. Essential login cookies and storage needed to remember your choice still operate.

You can change your choice at any time using the "Cookie preferences" link in the footer, which re-opens the same three-option banner. Server-side ad measurement of paying customers (Meta Conversions API for Subscribe events only) is described separately under "Legal basis for processing" above; that processing runs under our legitimate interest and has its own opt-out via email to support@sitesimple.io.

Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access - request a copy of the data we hold about you. You can download a copy at any time from the “Your data” section of the My Account page in your dashboard - the file is a structured JSON export covering audits, advisor conversations, settings, and history. If you prefer, you can also email support@sitesimple.io and we will respond within one calendar month.
• Rectification - ask us to correct inaccurate data
• Erasure - ask us to delete your data (“right to be forgotten”)
• Portability (Article 20) - receive a copy of the personal data you have given us in a structured, commonly used, machine-readable format. The fastest way is to use the “Download my data” button on the My Account page in your dashboard - it produces a JSON file you can keep or import elsewhere. You can also email support@sitesimple.io if you would like our help, and we will respond within one calendar month.
• Restriction - ask us to limit processing in the circumstances set out in Article 18
• Object - object to processing of your data in certain circumstances
• Withdraw consent - where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew.
• Complain - you have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled. Visit ico.org.uk, call 0303 123 1113, or write to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

To exercise any of these rights, email us at support@sitesimple.io. We will respond within one calendar month. For complex requests, this may be extended by up to two further months, in which case we will notify you within the first month.

How to complain to us

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. Email support@sitesimple.io with the words “Data complaint” in the subject line and a short description of the problem.

We will acknowledge your complaint within 30 days of receiving it and respond fully without undue delay. If we need more time because your complaint is complex, we will tell you and keep you updated.

If you are not satisfied with our response, you can escalate your complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator. You do not have to complain to us first, but we would prefer the chance to resolve it. You can reach the ICO at ico.org.uk, by calling 0303 123 1113, or by writing to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

Contact

Questions about this privacy policy or want to exercise your rights? Email us at support@sitesimple.io.