Privacy
Little data, held deliberately.
The assessment collects the minimum needed to read your public site and send you the report, on the basis of legitimate interest. The controller is Gautam Khorana, London, United Kingdom, under UK GDPR. There is no advertising tracking, no data sale and no profiling, and analytics cookies are set only if you accept them. Last updated 27 October 2026.
What is collected, and why?
Website address
Assessment request: Run the public read and store the report of record.
Work email and organization
Assessment request: Send the report link once and one follow-up from a person.
Assessment findings
Observation of public pages: Evidence and computed score that form your report.
IP address
Assessment request: Rate limiting, and bot verification via Cloudflare Turnstile when enabled. A salted hash of the address is stored with the request.
Account and saved sites
Passwordless sign-in and dashboard: Store your verified email, private workspace, up to three active sites and account reports. Saving a site does not publish it.
Rechecks and progress alerts
Optional dashboard settings and private assessment history: Store your recheck consent, email preferences, comparison baselines and delivery receipts. Resend receives your email and the private progress message. Rechecks never publish a new public snapshot.
Sign-in and session records
Necessary HttpOnly session cookies and verification requests: Keep you signed in, revoke sessions and prevent sign-in abuse. Verification attempt records contain keyed email/address hashes, not raw addresses.
Support actions
Authorised staff operations: Record account restrictions and service pauses with the reason for each action. Staff cannot change assessment scores through these controls.
Ownership and publication
Domain-control proof, snapshot approval and moderation: Publish only the exact snapshot you approve after domain verification and staff review. Claims, requests and approval history stay in your account. Operational action logs retain the hostname, action and reason with a deleted actor unlinked.
Cookie choice
Cookie banner: Remember whether you accepted analytics cookies or chose necessary only. Stored in your browser, not sent to us.
Comparison authorization
HttpOnly cookie audit-owner-<id>: Set when you request an assessment. Proves you requested it so this browser can start one competitor comparison.
Competitor assessment
Comparison requested from your report: Uses your original email and consent. The competitor result is emailed to you, with a link to the comparison.
Earlier scores
Previous completed assessments of the same site using the same email: Later reports show earlier scores, dates and pillar changes. Anyone with the later report link can see this history.
Shortcut visit
Session storage in your browser: Remembers a shortcut visit until you accept analytics, so it can be counted once. No event is sent before consent.
Usage analytics, only if you accept
Google Analytics cookies (_ga, _ga_<id>): Count visits, pages viewed and where visits came from, so the written pages can be improved. Google signals and ad personalization are off. Nothing loads until you accept.
Product analytics, only if you accept
PostHog cookie and browser storage (ph_<key>_posthog): Count visits, pages viewed and clicks on the public site, so the pages and the form can be improved. Nothing loads until you accept, and it never loads in your account or the staff workspace.
Who processes your data?
Hosts the site and runs the assessment. United States, under its data processing addendum.
Stores assessment requests, paired competitor reports and earlier scores. Dedicated project hosted in London, United Kingdom. It also provides account authentication and private workspace storage.
Sends passwordless sign-in codes/links, report links and lead notifications. A competitor assessment sends one comparison email to you. United States.
The model that scores the sampled public pages against a fixed schema. Only public page content and measurements are sent, never your email.
Bot verification on the form, when enabled. Receives the IP address and browser signals.
Retrieves sampled public website content for the assessment and supports research for written pages. It receives website addresses, not your account email.
Counts visits and pages, only after you accept analytics cookies. Google LLC, United States, under its data processing terms.
Counts visits, pages and clicks on the public site, only after you accept analytics cookies. Not loaded in your account or the staff workspace. PostHog Inc., United States data region, under its data processing terms.
What are your rights?
Under UK GDPR you hold the following over anything stored about you. Every request is acknowledged by a person within one working day and fulfilled within one month. No decision with legal effect on you is made automatically.
ask what we hold about you.
ask us to fix inaccurate records.
ask us to delete your report and contact details.
ask us to stop using your data for a stated purpose.
ask us to limit how we use your data while a dispute is resolved.
ask for a copy of the data you gave us in a usable format.
How do you make a request?
To withdraw or give consent to analytics cookies, change your choice here. It deletes the Google Analytics and PostHog cookies and asks again.
New reports requested inside your signed-in dashboard require your account. Public guest report links remain unlisted: anyone with a link can read them. Saving an existing guest report does not change that visibility. Deleting an account removes its workspace and private account reports from the live database; it does not silently delete original guest reports. Backups and email providers follow their own retention schedules. Private account pages do not load our analytics scripts.
Public profiles are optional and separate from private reports. Read the public profile policy for verification, approval, withdrawal and record retention.
For any privacy request, including erasure of your report, write to hey@websites.new. If you believe the reply was not handled properly, you can raise the matter with the Information Commissioner's Office.
Free automated assessment