Privacy policy · UK GDPR
Privacy policy.
The data controller is the sole trader named on the about page, registered as a data controller with the UK Information Commissioner's Office. We collect the data we need to deliver an audit, keep it for twelve months, and delete it. We use AI (Anthropic's Claude) to generate your audit; we do not sell your data or use it to train AI models. This page details the rest.
Who we are
Small-Site Audit is a trading name of a UK sole trader — legal name PLACEHOLDER, registered address PLACEHOLDER. Contact: privacy@smallsiteaudit.co.uk. ICO registration PLACEHOLDER.
What data we collect, and why
- Intake data you enter into the form: business name, primary service, locations, URLs, enquiry goal, name, email. Lawful basis: contract — necessary to provide the audit you have ordered.
- Data from optional integrations you authorise: a Search Console performance export (CSV) you choose to upload. Lawful basis: contract; consent is separate for each integration and you can revoke access at any time.
- Payment data: processed directly by Stripe; card details never touch our servers. We receive from Stripe: the last four digits of your card, cardholder name, billing address for VAT purposes, and Stripe's payment reference. Lawful basis: contract + legal obligation (invoice and tax records).
- Site email correspondence: your emails to and from hello@smallsiteaudit.co.uk. Lawful basis: legitimate interest — responding to enquiries.
- Analytics on this site: we use privacy-conscious, cookieless analytics that collect no personal data. If this changes, this page will be updated first.
What we don't collect
- Passwords for any of your accounts.
- Data about your own customers, unless you share it deliberately during an audit and mark it as sharable.
- Cookies for advertising, tracking, or profiling.
- Anything about visitors to your website — we only crawl your own public pages.
How long we keep it
- Intake, crawl output, and delivered reports: twelve months from delivery. After that, deleted from active systems within 30 days.
- Payment records: retained for six years for UK tax compliance. Cardholder data is with Stripe, not us.
- Email correspondence: retained for two years, then deleted.
- You can request earlier deletion at any time by emailing privacy@smallsiteaudit.co.uk. We will confirm within 30 days.
Where data lives
All data lives on servers in the United Kingdom. Stripe processes payments in the UK/EU. We do not transfer personal data outside the UK/EU without a UK-adequacy or explicit consent basis.
Who we share it with
- Stripe — payment processing.
- Anthropic (AI provider) — generates the audit text from your crawl data. International transfer safeguard: PLACEHOLDER — to be confirmed before launch.
- Email service (PLACEHOLDER) — email delivery.
- Cloudflare (hosting) — where the site, audit data and reports are stored and served from. Storage region: PLACEHOLDER.
- Nobody else. We do not share data with advertising networks, tracking networks, or third-party data brokers.
Your rights under UK GDPR
You have the right to:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct or delete personal data.
- Ask us to delete an optional file you uploaded (e.g., a Search Console export).
- Object to processing.
- Ask us to port your data to another service.
- Complain to the UK Information Commissioner's Office at ico.org.uk if you are unhappy with how we've handled your data.
Requests are handled within 30 days without charge. Email privacy@smallsiteaudit.co.uk.
Cookies
This website does not set marketing, advertising, or tracking cookies. The intake form uses browser localStorage to save your progress as you type — this stays in your browser only and is not sent to us until you submit. Clearing your browser's storage will clear it.
Changes to this policy
Substantive changes will be dated at the bottom of the page and, for anyone with an active audit or on the mailing list, notified by email. Last reviewed: 23 September 2026.