Privacy Policy for SiteVitals

1. Information We Collect

We collect and process the following types of information:

1. Information you provide directly:
   • Website URLs and account registration details such as name, email address, and password.
   • Content submitted for monitoring, including configurations and preferences.
   • Questions you send to our Ask Me Anything clinic, our replies, and any follow-up messages between us.
   • Technical and business data:
     We also process publicly available or customer-submitted technical and business information, such as website URLs, domain information, DNS records, SSL certificate data, HTTP headers, performance metrics, and configuration settings. This information usually doesn't relate to an identifiable individual. Where it does, for example if your website address includes your name, we treat it as personal data.
2. Information collected automatically:
   • Usage and technical data, such as IP addresses, browser and device information, pages visited, and interactions with the Service, including where permitted, marketing and conversion data.
   • We store your navigation history on your device temporarily to help us understand how you found us. This is only sent to us if you create an account.
3. Payment information:
   • Billing and payment details processed securely via Stripe.

2. How We Use Your Information

1. To provide, maintain, and improve the Service, including uptime, security, and SEO monitoring.
2. To process payments and manage subscriptions.
3. To communicate with you about updates, support, or service notifications.
4. To comply with legal obligations and enforce our Terms of Service.
5. To analyse usage, detect security issues, improve the Service, and use automated or AI-assisted tools where appropriate to support these activities.
6. To measure the effectiveness of our marketing campaigns and understand how users find and interact with the Service, where consent has been given.
7. To answer questions you send to our Ask Me Anything clinic.
8. To create anonymised content, such as blog posts, newsletters and social media posts, from clinic questions and our answers. We remove anything that could identify you or your business before publishing (see Section 7 of our Terms of Service).

3. Legal Basis for Processing

We process your personal data under the following lawful bases:

1. Consent: Where required, such as for marketing and advertising cookies, you provide consent via our cookie controls.
2. Contractual necessity: Processing is required to provide our Service and manage subscriptions, including answering your clinic questions.
3. Legal obligation: To comply with applicable laws and regulations.
4. Legitimate interests: To secure, operate, and improve the Service effectively, and to create anonymised content from clinic questions.

4. Sharing and Disclosure

1. We do not sell or rent your personal data to third parties.
2. We may share data with third-party service providers (e.g., Stripe, hosting providers) to provide the Service.
3. We may disclose data if required by law or to protect our rights, property, or safety.
4. Aggregate or anonymised data may be shared for analytics, research, or service improvements.
5. This may include marketing and advertising partners where you have provided consent.
6. We may use artificial intelligence service providers, including Anthropic and OpenAI, to help us operate and improve SiteVitals and to assist our team with tasks such as analysing website information, researching issues, drafting explanations or responses, and answering Ask Me Anything clinic questions. Where personal data is involved, we only share information that is reasonably necessary for the task and take steps to minimise it before it is sent. For example, we remove contact details where they are not needed. We may share website addresses and other information where they are necessary to analyse a website or answer a question. AI-generated material is reviewed where appropriate before we rely on it or send it to you. We do not use AI to make solely automated decisions about you that produce legal or similarly significant effects.
7. Some of our service providers, including Stripe and AI service providers such as Anthropic and OpenAI, may process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK-approved contract terms or, where applicable, the UK-US data bridge.

5. Data Retention

We retain personal data and monitoring information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. If you cancel your subscription, we may retain limited information for record-keeping and legal compliance.

We keep clinic questions and our replies for as long as your account is open, so we can pick up the conversation where we left off. Anonymised content created from them doesn't identify anyone, so it isn't personal data and may be kept indefinitely.

6. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

1. Access the personal data we hold about you.
2. Request correction of inaccurate or incomplete data.
3. Request deletion of your personal data (subject to legal obligations).
4. Object to or restrict processing in certain circumstances.
5. Withdraw consent at any time where processing is based on consent.
6. Request portability of your data.
7. Complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your data. We'd appreciate the chance to put things right first, so please do contact us.

7. Security

We implement reasonable technical and organisational measures to protect your data against loss, theft, unauthorised access, disclosure, or modification. However, no method of transmission over the Internet or electronic storage is completely secure.

8. Cookies and Tracking

We use cookies and similar technologies to maintain the security and functionality of the Service. With your consent, we also use optional marketing and advertising cookies to measure the effectiveness of our campaigns and understand how users interact with SiteVitals.

1. XSRF-TOKEN: Used to prevent Cross-Site Request Forgery (CSRF) attacks and ensure the security of your account actions.
2. sitevitals_session: Maintains your login session and keeps you authenticated while using the Service.
3. sv_newsletter_subscribed: Set when you confirm your blog newsletter subscription. Used to avoid showing the newsletter signup form to existing subscribers. This cookie does not track you and contains no personal data - it stores only a flag indicating that a subscription confirmation has taken place on this device.
4. sv_upgrade_dismissed: Set when you dismiss the upgrade offer banner. Used to avoid showing the banner again for 14 days. This cookie does not track you and contains no personal data — it stores only a flag indicating that the banner was dismissed on this device.

Marketing and advertising cookies:
With your consent, we use marketing and advertising technologies provided by third parties such as Meta (Facebook) to measure conversions, understand how users arrive at our Service, and evaluate the effectiveness of advertising campaigns. These technologies may set cookies or use similar identifiers on your device. You can withdraw your consent at any time via our cookie controls.

You can manage or delete cookies via your browser settings. Please note that disabling these cookies may affect the functionality and security of the Service.

Cookie names and technical details may change over time as third-party services are updated; we describe cookies by purpose rather than maintaining a fixed list.

9. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

10. Browser Extension

SiteVitals offers a companion browser extension ("SiteVitals AI Audit") available via the Firefox Add-ons store and the Chrome Web Store. The extension performs all analysis entirely within your browser using only the content of the page currently open in your active tab. It does not automatically collect, transmit, store, or share any data — including page content, URLs, or browsing history — with SiteVitals or any third party. No personal data is processed by the extension without your action. If you choose to click through to SiteVitals from within the extension panel, the URL of the page currently being audited may be included as a query parameter in that request, solely to pre-populate the sign-up or audit form. No data is transmitted automatically or in the background.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any material changes will be communicated via email or through the Service. Continued use of the Service after changes indicates your acceptance of the new policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]
Address: 1 Cornhill, Ilminster TA19 0AD
Phone: 01179 680989