Privacy Policy

Last updated 4 August 2026.

This describes what the service actually does today. It has not yet been reviewed by a privacy lawyer, and it does not attempt to make jurisdiction-specific promises. Have it reviewed before scaling outreach or entering a new market.

1. What we collect

If you have an account

Your email address, and your name if you give it.
An address you nominate for account notices, if different.
The address you nominate to receive website enquiries, once you confirm it.
Your sites, domains, change requests, and the history of what we did to them.
A security log: sign-ins, claims, billing events, and domain changes, with the IP address they came from.

We never see or store your password. Authentication is handled by Google Firebase Authentication; if you sign in with Google, we receive your email address and name and nothing else. We do not store card numbers.

Before you have an account

We build previews from publicly available business information — a business name, address, phone number, opening hours, services and a public contact address, along with a record of where each fact came from. We do not bypass access controls and we do not collect from private or prohibited sources.

If you would rather we held none of this, tell us. We will delete the record and add you to a permanent do-not-contact list. You do not need an account to ask, and we do not need a reason.

Visitors to your website

When someone fills in your contact form, we process what they typed in order to deliver it to you. We are the delivery mechanism; the enquiry is yours.

2. Why we hold it

To run your account and your site — the whole point of the service.
To deliver your leads — and to prove delivery when something goes missing.
To keep the service secure — rate limiting and the audit log exist to detect abuse and to reconstruct what happened after an incident.
To contact you about your site, your trial, and anything that needs your decision.

We do not sell your data, and we do not use it to train models.

We use a small number of processors, each for one job:

Google Firebase — accounts, database, file storage.
Vercel — hosting and domain routing.
Resend — sending account email and delivering your contact-form enquiries.

We share what each one needs to do its job and nothing more. We will disclose data if the law genuinely requires it, and we will tell you unless we are forbidden from doing so.

4. How long we keep it

Account and site data — while your account is open, then deleted within 30 days of closure.
Contact-form submissions — delivered to you and retained for 90 days so we can re-send a lost one.
Security and audit logs — 12 months.
Suppression / do-not-contact records — kept indefinitely, on purpose. It is the only way to guarantee we never contact you again.
Unclaimed previews — deleted when the claim token expires, or sooner if you ask.

5. Your rights

You can ask us for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Email us and we will do it — we will not make you go through a form or justify the request.

Account holders can also export or delete from Settings in the dashboard.

6. Security

Everything is served over HTTPS.
Access to your data is enforced on the server and in database rules, not by hiding buttons in the interface.
Claim tokens and email-confirmation codes are stored only as keyed hashes, are single-use, and expire.
Sign-in, password reset, claim and form endpoints are rate limited.
Changing your password signs you out on every device.

No system is perfect. If we discover a breach affecting your data, we will tell you what happened, what was involved, and what we did about it.

7. Cookies and tracking

We use browser storage only to keep you signed in and to carry a claim token between the claim page and signup. There are no advertising cookies and no third-party analytics trackers on the dashboard or the claim flow.

8. Email

Account email — claim links, password resets, receipts, and your leads — is transactional, and you receive it because you have an account or asked for it. Any marketing email we send has a working unsubscribe link, and we honour it everywhere, permanently, not just for that campaign.

9. Contact

Any question about your data: get in touch.