What we keep, and for how long.

Smart Capture Studio operates this site and the scanner behind it, and is the controller of the personal data described on this page. There is no parent company and no group — it is one product, run by the people who built it.

Anything on this page — a copy of what we hold, a deletion, a question you cannot find the answer to — goes to [email protected], and a person answers it. We aim to reply within a few days and will always be inside one month, which is the limit the GDPR sets.

A report is deleted the moment it reaches your browser. Scans live in the memory of the running process, are never written to a database, and the findings and the screenshot of your site are erased in the same request that hands them to you. After that the only copy is the one in your browser tab.

What briefly outlives it on our side is the address you scanned and the list of links found on it, because a crawl needs them if you unlock one. That goes as soon as the crawl finishes, and a scan nobody comes back for is swept within fifteen minutes.

The hashed rate-limit record lasts one hour, because that is the window the limit is measured over. The one thing we deliberately keep is an email address you chose to give, which is forwarded to Netlify Forms and held until you ask us to delete it.

A report you pressed Share on is the exception to all of the above: it is stored for 30 days and then deleted automatically. Sharing asks for your email address and will not store a report without one — a copy we keep for a month is a copy we keep for someone we can reach. Unlocking a crawl stores one the same way, because the report we email you has to exist somewhere for the link to open. Those two, and the two account settings below, are the only things that create a stored report. That copy lives in a database we run on Supabase, who host it on our behalf and do nothing else with it. It contains the report and nothing about you — no address, no IP, no email. The address you gave goes to our list, not into the report.

If you turn on keeping your own reports, available on a paid plan, your browser saves a copy of each report you open to your account. We still erase our copy the moment it reaches you — that does not change on any plan — so what is stored is the copy your browser already had, minus the screenshot. It is off until you turn it on, off again in any other browser until you turn it on there, and you can delete any of it, or all of it, from your account.

An owner of an account on a paid plan can also turn on keeping the report of every scheduled check. Then each scheduled re-scan of a watched site keeps its full report (again without the screenshot) alongside the ones your browser kept, within the same allowance; when that is full, the oldest report kept this way is deleted to make room, and one a person kept by hand never is. It is off until an owner turns it on, and the reports are deleted the same way as any other kept report.

If you create a badge from a shared report, we store the hostname, the score and the dates it was measured, and we keep them for as long as the badge is meant to work — a badge that expired would break the page displaying it. That record is the score and the site name and nothing else: no findings, no evidence, no page content, and nothing about you. The shared report it was made from still expires after 30 days.

If you ask us to watch a site, we store its address, your email address so we can tell you when the score drops, and the last score we measured. Not the reports: a scheduled scan is delivered and erased exactly like a manual one, and the score is the only thing kept, because a drop cannot be recognised without the number before it. Stop watching a site and the row goes with it.

Accounts are opened by invitation. If we invite you, we store your email address and the invitation. If you complete the registration form it links to, we store what you put on it — your name, your organisation, the website you want watched, and, if you gave them, your job title, a phone number and your message — so we can decide whether to open the account. If we open it, the registration stays with the account and is deleted with it. If we decline it or the invitation is withdrawn, we keep it so we do not invite you twice by mistake, and delete it when you ask.

An owner of an account can ask us to invite a colleague. We then hold that colleague’s email address and the role asked for, as an invitation, and it follows the same rules as any other invitation above. Please only give us the address of somebody who expects to hear from us.

To answer a support question, we can open a read-only view of your account — what your people see in Website Health. It changes nothing, and every time we open it is recorded in your account’s activity log, where everyone in your organisation can see it.

If you sign in, we store your email address and your scan history. The history is not your reports: for each site, it is the score, the six category scores, the identifiers of the checks that failed, and the hostname. No finding text, no evidence, no screenshot, no page content. It is enough to tell you what changed since last time and not enough to rebuild a report — reports are still delivered once and erased, and signing in does not change that. You can delete all of it from your account page, and deleting the account itself — also on that page, also immediate — takes the history, the watched sites, the kept reports, the API keys and the alert endpoint with it.

An account keeps an activity log: who changed what, and when — a site watched or its alerts changed, a check muted, an API key made or revoked, the webhook set, somebody added or their role changed, the plan changed. It names the person by the address they sign in with, and everyone in your organisation can read it; a change we make shows as Smart Capture Studio. It never holds a key, a webhook’s full address (only its host) or a report. It lives as long as your organisation does, and when somebody deletes their account their address is removed from every entry, by them or about them.

When something breaks, we keep an error report: what went wrong, where in our code, the page’s path (never its query string), and the browser’s user agent. Email addresses, tokens and anything that looks like a secret are stripped before it is stored. It holds no IP address and nothing that says who you are. The same error is counted rather than stored again, and an error nobody has seen for 90 days is deleted.

Under the UK and EU GDPR, and the equivalents elsewhere, holding personal data needs a reason the law recognises. Ours are these, and there are only four.

Wherever you are, you can ask us for a copy of what we hold about you, to correct it, to delete it, to hand it over in a portable format, to restrict what we do with it, or to object to it. Where we rely on consent you can withdraw it, and withdrawing it does not make what we did before unlawful.

Most of it you can do yourself, immediately, without asking us: Settings downloads everything your organisation’s account holds as one file (a portable copy, built in your browser), the account pages delete your history, your watched sites, your kept reports and your API keys, and deleting the account takes all of it with you. For anything else, write to [email protected]. We do not charge for it, we do not make you prove your identity beyond controlling the address in question, and we do not treat you differently for asking.

There is no automated decision-making here. A health score is arithmetic over a published set of checks, about a website rather than a person, and nothing about you is profiled, scored or used to decide anything.

If you think we have got this wrong, you can complain to your data protection authority — in the UK the Information Commissioner’s Office, in the EU your national regulator. We would rather you told us first, but it is your right either way.

We run on other people’s infrastructure, and it would be dishonest to describe what we keep without naming who it sits with. Each of these acts on our instructions and does nothing else with it. This list changes when our infrastructure does, and the date at the top of the page moves with it.

A scan does not stay entirely between your browser and us. To measure things that need a real rendering engine, we ask Google to load the address you entered, and we ask a public DNS resolver about its domain. We send the address and nothing else — no email, no IP, nothing that identifies you.

This site can count visits with Google Analytics 4, so we can tell which pages people actually use. It is the only third-party script on the site, and it measures this site — it has nothing to do with the site you scan, and it is never injected into it.

It does not load until you say yes. We ask once, in a bar at the bottom of the page. Until you accept there is no Google script on the page at all — nothing is deferred, nothing is queued, and nothing is sent. Declining costs one click, same as accepting, and you can change your mind here at any time. Your answer is kept in your browser’s local storage rather than a cookie, so refusing does not set the thing you refused.

The date at the top moves whenever it does, and the rule this project holds itself to is written into the file: a change to what the code stores and a change to this page go in the same commit. A privacy page describing a previous version of the product is worse than none.

If a change materially affects you — a new processor, a longer retention, a new category of data — we will tell anyone with an account by email before it takes effect, rather than relying on you to re-read this page.

The scanner requests pages the way any browser would, identifying itself in its user agent, and stays within a strict budget: the entered page free under a sixty-second budget, up to ten more if a crawl is unlocked under ninety, following only same-origin links. On the free scan it reads the page and a capped sample of the stylesheets, scripts and images it declares. It does not attempt to log in, submit forms, or reach anything a normal visitor could not.

If you operate a site and want it excluded, or you want a report deleted, or you want an email address you gave us erased, write to [email protected] with the URL or the report link.