Privacy notice

• AgoraScan is run by Grid Design Agency Limited, a company in England. We are responsible (the "controller") for the personal data described here, except where we process data for an agency or platform customer, explained below.
• When you scan a website, our servers open that page in a browser, take screenshots and send the screenshots and page text to an AI service (Anthropic's Claude) to write the review.
• Free scan reports can be seen by anyone who has the link. Full audits are private unless you share the link.
• We store IP addresses only as a scrambled code (a hash) to stop abuse. We never keep your IP address in plain form.
• We use only the cookies needed to sign you in and remember your scans. Our visitor statistics don't use cookies.
• Card details are handled by Stripe. We never see or store your full card number.
• We don't sell or share your personal information, and we don't use it to train AI models.
• You can contact us at hello@agorascan.ai about anything in this notice.

AgoraScan is a trading name of Grid Design Agency Limited, registered in England and Wales with company number 14577642. Registered office: 124 City Road, London, EC1V 2NX, United Kingdom. VAT number: GB445881953.

We are registered with the UK Information Commissioner's Office (ICO) under registration number [ICO registration number].

Privacy contact: hello@agorascan.ai. Post: Privacy, Grid Design Agency Limited, 124 City Road, London, EC1V 2NX, United Kingdom. We have not appointed a data protection officer because the law doesn't require one for our business; [name or role, e.g. our Managing Director] is responsible for privacy.

Our representative in the European Union (under Article 27 of the EU GDPR) is [EU representative name, address and email], which you can contact instead of us if you are in the EU or EEA. [Delete this paragraph if no representative has been appointed.]

Visitors who run a free scan without an account:

• The web address you enter, and the report we create (scores, findings, screenshots and text from the page).
• A hashed code made from your IP address, used to limit how many free scans one person can run in a day and to stop abuse.
• A cookie listing the ids of your recent free scans, so you can get back to them and move them into an account if you sign up.

Account holders:

• Your email address and name, and your company name if you add one.
• If you sign in with Google: your name, email address and Google account id (and profile picture if Google sends it). We never see your Google password.
• Sign-in and security records kept by our sign-in provider, Clerk, such as the device, browser, IP address and time of sign-in, to keep your account safe.
• The websites you audit, your reports, which findings you mark as fixed, and your credit history.
• Branding you add for white-label reports (logo text, colour, contact line).
• Your plan, Stripe customer and subscription ids, what you bought, when and how much you paid, your billing country and, for business customers, your VAT number.
• Messages you send us, and notes from any expert review call you book.

People who appear on websites we scan: the pages we check are public, but they can include personal data such as staff names and photos, contact details, reviews or testimonials. Our screenshots and the page text we analyse may capture this. We use it only to produce the report the user asked for, we don't look for or extract information about individuals, and we don't use it for any other purpose. See "If you appear on a website we scanned" below.

People who use an agency's website scanner: if an agency or web designer has put our website check on their own site and you use it, we collect your email address and the web address you entered and pass them to that agency. The agency decides what happens to your details and is responsible for them (see "Agencies, platforms and the website scanner").

Website visitors in general: our hosting provider, Vercel, processes your IP address and browser details to deliver pages and protect the service, and keeps short-lived server logs. We use Vercel Web Analytics to count page views. It doesn't use cookies, doesn't store anything on your device, and gives us only totals such as pages viewed, referring site, country, browser and device type. If you accept analytics cookies, we also use Google Analytics, which records how you use the site (pages, where you came from, device) against a cookie ID; Google processes this for us, its advertising features are switched off, and we strip private report links and email addresses first. Our cookies notice has the details.

We don't knowingly collect special category data (such as health, religion or ethnicity). It could appear by chance in a screenshot of a public page; we don't use it.

To write the expert-style review in your report, we send screenshots of the pages and the text and structure of the page to Anthropic's Claude models, either directly or through Vercel's AI Gateway. The AI rates the website against our published rules. It doesn't make any decision about you.

Anthropic processes this data for us under a data processing agreement. Under Anthropic's commercial terms, data sent through its API is not used to train its models. Anthropic keeps it for [up to 30 days / not at all under a zero data retention arrangement: confirm with Anthropic and Vercel before launch] for safety and abuse monitoring, then deletes it.

AI output can be wrong. Parts of each report written by AI are labelled as such. A person from Grid Design only reviews a report if you buy an expert review.

Data protection law requires us to have a lawful basis for each use of personal data. Ours are:

• Running a free scan you ask for, without an account: legitimate interests (providing the check you requested).
• Running scans, audits, Watch re-checks and white-label reports for account holders: contract (to provide the service you signed up for).
• Processing personal data that appears on scanned websites: legitimate interests (producing the website review the user asked for). The data is already public, we use only what's on the pages requested, and we keep it for a limited time.
• Sending screenshots and page text to our AI provider: the same basis as the scan or audit it is part of.
• Taking payments, issuing receipts and invoices, and keeping tax records: contract and legal obligation (UK tax law requires us to keep VAT records for 6 years).
• Service emails (report ready, receipts, Watch alerts, renewal reminders, changes to terms): contract, and legal obligation for renewal reminders and order confirmations.
• Limiting free scans, blocking abuse, keeping the service secure and checking which sites we won't scan: legitimate interests (protecting our service, our users and the websites being scanned).
• Counting visits with cookieless analytics and improving the service: legitimate interests.
• Google Analytics, only if you accept analytics cookies: consent, which you can withdraw in Cookie settings.
• Building anonymous, aggregated statistics about websites (for example, the average score of online shops) for benchmarks in reports and our annual study: legitimate interests. The results are about websites, not people, and never identify you.
• Emailing customers about similar AgoraScan products and tips: legitimate interests, with a choice to opt out when you sign up and in every email. Where the law of your country requires consent, we ask for it first.
• Tips after a free check: only if you tick the box and then confirm by clicking "Yes, send me tips" in the email we send you (double opt-in). That's consent, and you can withdraw it with the unsubscribe link in every email.
• Emailing new editions of our State of websites study: only if you sign up and then confirm by pressing the button in the email we send you (double opt-in). That's consent, and every email has an unsubscribe link.
• Answering questions you ask about your full audit: contract. We keep the question and answer to apply the daily limit and improve answers.
• Handling questions, complaints and legal claims: legitimate interests and legal obligation.

You can ask us for details of how we balanced our interests against yours for any use based on legitimate interests.

You need to give us your email address to create an account and buy from us. Without it we can't provide the service.

We don't make decisions about people based solely on automated processing that have legal or similarly significant effects. The scores rate websites, not individuals.

Some customers use AgoraScan to process personal data for their own purposes: agencies who run audits of their clients' websites, agencies who put our website scanner on their site to collect enquiries, and platforms that use our API. For that data, the customer is the controller and we are their processor, acting only on their instructions under our Data Processing Addendum.

If you used a website check on an agency's site, the agency receives your email address, the web address you checked and a link to your report. Contact that agency about how they use your details; their privacy notice should be linked next to the form. We keep your details only to provide the service to the agency and delete them when the agency deletes them or closes its account. We also use a hashed version of your IP address to stop abuse, as described above.

We don't contact people who appear on websites we scan, because we don't extract or know who they are and it would be impossible or take disproportionate effort. This section is how we tell you instead.

We capture public pages only. We don't sign in to websites or get past paywalls. Screenshots and page text are kept only as long as the report (see "How long we keep data"). If you're shown in a report and want it removed or the image hidden, email hello@agorascan.ai with the report link. If you own a website and don't want it scanned, tell us and we'll add it to our list of sites we won't scan.

Own a website someone has checked? You can ask us to make reports of it private and stop checking it at agorascan.ai/remove. If you use an email address on the website's own domain, we email you a link and it happens as soon as you click it. Otherwise a person checks the request first.

• A free scan report is public: anyone with the link can see it. It isn't listed in search engines, but anyone you send it to can pass it on.
• If you have an account you can delete your account and its reports in Settings, or ask us to delete a single report.
• Full audits are private. Only you, your team, and anyone you give the share link to can see them. You can [reset the share link] at any time.
• Score badges you embed on your own site show the score and link to the public report.

We use trusted service providers ("sub-processors") to run AgoraScan. They may use your data only to provide their service to us, under contracts that protect it. The current list, with what each one does and where, is on our sub-processors page:

• Vercel (hosting, file storage, AI gateway, visitor statistics).
• Neon (database, London).
• Anthropic (AI review).
• Clerk (sign-in and accounts).
• Stripe (payments, tax calculation and invoices).
• Resend (sending emails).
• Google (only the web address, for real-visitor speed data from the Chrome UX Report).

Stripe and Google (when you choose "Sign in with Google") also use some data as independent controllers under their own privacy policies, for example for fraud prevention and to run your Google account.

We also share data: with agencies and platforms as described above; with professional advisers (lawyers, accountants, insurers) under confidentiality; with the police, regulators or courts when the law requires it; and with a buyer if Grid Design sells AgoraScan, who would have to keep to this notice.

We don't sell personal information, rent mailing lists or share personal information with advertisers.

We're based in the UK. Our database and report files are stored in London. Some of our providers are in the United States, so your data may be processed there (for example by Anthropic, Clerk, Resend and Stripe, and by Vercel's servers [if any processing runs outside London]). When data leaves the UK or the European Economic Area we protect it with one of:

• An adequacy decision (the EU recognises the UK as adequate; the UK recognises the EEA as adequate).
• The EU-US Data Privacy Framework and its UK Extension, where the US provider is certified.
• The EU Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement, plus an assessment of the risks.

Ask us for a copy of the safeguards that apply.

• Free scan reports, screenshots and page text: [12 months] after the scan, then deleted, unless you've moved the scan into your account.
• Full audit reports and screenshots: while your account is open, then deleted [30 days] after you close it. You can delete individual reports sooner.
• Account details: while your account is open, then deleted [30 days] after you close it.
• Leads from an agency's website scanner: until the agency deletes them or closes its account, then within [30 days].
• Hashed IP codes used for limits: [90 days].
• The anonymous-scans cookie: 30 days.
• Payment, invoice and tax records: 6 years after the end of the financial year they relate to (UK tax law).
• Emails and support messages: [2 years] after the conversation ends.
• Backups: deleted data can remain in encrypted backups for up to [30 days] until they are overwritten.
• Data sent to our AI provider: see "How the AI review works".

Aggregated statistics that don't identify anyone may be kept indefinitely.

You have the right to:

• Ask for a copy of your personal data (access).
• Ask us to correct data that's wrong or incomplete.
• Ask us to delete your data.
• Ask us to limit how we use your data while a concern is looked into.
• Object to us using your data based on legitimate interests, and object at any time to marketing.
• Receive data you gave us in a reusable format, or ask us to send it to someone else (portability).
• Withdraw consent at any time, where we rely on consent.

Email hello@agorascan.ai to use any of these rights. We'll reply within one month (we can extend this by up to two more months for complex requests, and we'll tell you if we do). We may need to confirm who you are. It's free unless a request is clearly unfounded or excessive.

If we process your data for an agency or platform, we'll pass your request to them, because they decide what happens to it.

Please tell us first at hello@agorascan.ai so we can put things right. We'll acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You can also complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113. If you're in the EU or EEA, you can complain to the data protection authority where you live or work.

This section applies to residents of California and other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon), to the extent those laws apply to us.

In the last 12 months we have collected these categories of personal information: identifiers (name, email, account ids, hashed IP code); commercial information (purchases and plan); internet or network activity (scans you ran, sign-in records, aggregated page views); geolocation at country level (billing country); professional information (company name, VAT number); and any personal information visible on public web pages you ask us to scan. Sources, purposes and retention are described above. We don't collect sensitive personal information for the purpose of inferring characteristics about you.

We disclose personal information for business purposes only to the service providers listed on our sub-processors page, under contracts that restrict their use of it.

We do not sell your personal information and we do not share it for cross-context behavioural advertising, and we haven't done so in the last 12 months. We don't use or disclose sensitive personal information except to provide the service. We have no actual knowledge of selling or sharing information about anyone under 16.

Depending on where you live, you have the right to: know what personal information we collect, use and disclose; access it and get a portable copy; correct it; delete it; opt out of sale, sharing, targeted advertising and certain profiling (we don't do any of these); limit use of sensitive personal information; and not be treated differently for using your rights. We honour Global Privacy Control signals as an opt-out of sale or sharing, though we don't sell or share.

To use your rights, email hello@agorascan.ai. We'll confirm your identity by asking you to reply from the email address on your account or to sign in. You can use an authorised agent, who must show us your signed permission. If we refuse your request, you can appeal by replying to our decision with "Appeal" in the subject; we'll answer within 60 days (45 days in some states). If you're not satisfied, you can contact your state Attorney General.

We handle personal information of people in Canada in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec's privacy law. By using AgoraScan you consent to the uses described in this notice; you can withdraw consent at any time, subject to legal or contractual limits, though we may then be unable to provide the service.

Your information is stored in the United Kingdom and may be processed in the United States by our service providers, where it can be accessed by courts, law enforcement and national security authorities under local law. You can ask to access and correct your information and ask about our providers outside Canada by emailing hello@agorascan.ai. Our person accountable for privacy is [name or role]. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

We send commercial emails to people in Canada only with consent as required by Canada's anti-spam law, and every one has an unsubscribe link.

We aim to handle personal information in line with the Australian Privacy Principles. We may disclose your information to service providers in the United Kingdom and the United States (see our sub-processors page). You can ask to access or correct your information, or complain, by emailing hello@agorascan.ai. We'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

If you're in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you rights to: confirmation that we process your data; access; correction; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with consent; information about who we share data with; information about the consequences of refusing consent; and to withdraw consent. Our legal bases are the equivalents of those listed above: performance of a contract, legitimate interests, compliance with a legal obligation, and consent where we ask for it.

Our contact for data protection matters (encarregado) is [name or role, privacy@agorascan.ai]. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

Wherever you are, you can ask us to access, correct or delete your personal information, and we'll handle your request in line with this notice and your local law. If your local law gives you extra rights (for example in Switzerland, Japan, Singapore, South Africa or India), contact us and we'll help. Our providers process data in the United Kingdom and the United States.

We protect data with encryption in transit (HTTPS) and at rest, private file storage, access limited to the people who need it, sign-in protection from Clerk, hashed rather than raw IP addresses, and checks that stop our scanner reaching private or internal network addresses. No system is perfectly secure; if a breach puts your rights at risk we'll tell you and the regulator as the law requires.

AgoraScan is a tool for businesses and is not meant for children. You must be 18 or over to create an account or buy from us. We don't knowingly collect personal information from anyone under 13 (or under 16 in some countries). If you think a child has given us information, contact us and we'll delete it.

We use only cookies that are needed to sign you in, keep the service secure and remember your free scans. We don't use advertising cookies. We ask before using Google Analytics cookies, with "Reject all" next to "Accept all". Our cookies notice lists every cookie.

We'll update this notice when our service or the law changes, and change the date at the top. If we make an important change, such as using your data for a new purpose, we'll email account holders before it takes effect.