What we collect, and what we do with it.

Plain English, and only what our software actually does today. Every line below was written from the code that does the work.

Two different kinds of information.

About the business you check

All of it is public. We read the Google listing, open the website pages the way a customer would, run searches for the area, and measure page speed. We do the same for up to two competitors. We do not log in anywhere, and the only thing we click is a cookie banner that would otherwise cover the page.

About you

There is no account and no password. You do not have to type anything about yourself to run a check. Here is what we hold.

Your email address, your phone number, or both: Only if you type them into a form on a report or on the contact page. One of the two is enough; we do not need both.
The message you write on the contact page: Stored as you typed it, with your name and business if you gave them, so we can read it and reply.
Where the visit came from: If you arrive from a link carrying campaign tags, they are saved with the scan so we know which link worked.
Your name, if you give one: We keep it with your email or phone so we know who to ask for when we get back to you.
A hash of your IP address: Saved with the scan you start and with the form you send. We store the hash, not the address. It is there to limit how many scans and how many form sends one connection can make.
Your browser's user agent: The line your browser sends with every request, naming itself and your operating system. Saved with the scan and the form for the same reason.

Why we ask for a way to reach you.

One reason. So we can send you your report and get in touch about fixing what it found. A person at our end reads it and follows up.

We do not sell your details. We do not pass them to anyone outside the list further down this page, and the companies on that list only get them to do the job named beside them.

How long we keep it.

Screenshots and page captures: Deleted 24 hours after the scan started. They power the live scan and its replay; the report keeps its findings.
The individual check results: Deleted 180 days after the scan started.
The IP hash and user agent saved with a scan: Cleared at the same 180 days.
The IP hash and user agent saved when you leave your details: Kept with the contact details themselves. Nothing clears these on a schedule.
Our cached copy of the Google listing: Cleared 30 days after it was last refreshed.
The counters behind our rate limits: Deleted after they expire. The longest one lasts a day.
Our own record of what each scan cost us: Deleted after 720 days.
The scan record and the report text: Kept. We have not set an end date for these.
Your contact details: Kept. Nothing deletes them on a schedule, so they stay until you ask us to remove them.

Who else sees it.

These are the companies our software sends something to. Supabase and Resend are the only ones that ever receive your own contact details. The rest are given the business and its public website.

Supabase: Our database and file storage. Everything described on this page is stored there.
Google: Places for the business listing, PageSpeed Insights and the Chrome User Experience Report for speed. The suggestion list in our search box runs inside your browser, so Google sees that request as you type.
Cloudflare: The check that separates a person from a bot runs in your browser before a scan starts, so Cloudflare sees your IP address and your browser.
DataForSEO: Runs the search result lookups, and the questions we put to ChatGPT and Gemini about the business.
Anthropic: Claude models read the scan data and write the report in plain English. If you ask the report's fix assistant a question, whatever you type there is sent too.
Perplexity: Answers the question of what a search assistant says about the business.
Browserbase: Hosts the browser that opens the website pages, when a scan runs there instead of on our own machine.
Yelp: Asked whether the business has a listing, so we can compare its name, address and phone with Google's.
Resend: Sends any email we send you, and tells us when you ask for the plan or write to us.
PostHog: Records that a scan started, finished or failed. Those records carry the scan id and no contact details.

A report page is public to anyone holding the link.

Your report lives at a link with a twelve character random id. Anyone who has that link can open it. There is no login and we do not check who is reading. We do not publish or list report links anywhere, but a link that gets forwarded works for whoever receives it, so treat it the way you would treat any link you would rather not have passed around.

Asking us to delete your details.

Email hello@rootdigital.co and ask. We will delete the email address and phone number we hold for you, and the copy of them in our contact records.

Deleting your details does not delete the report. The report is about a business and its public website, not about you.