Privacy policy
Effective .
Last updated 28 October 2026.
This policy covers two different groups of people, and it is worth being explicit about both: the customers who hold a SiteAssay account, and the businesses whose public information our customers research using it.
Who is responsible for your data
SiteAssay is the controller of the personal data we collect to run our own business: customer accounts, billing records, support conversations and this website. For the data a customer keeps in their workspace, including the businesses they research and contact, the customer is the controller and SiteAssay processes it on their behalf under our data processing agreement. Company details are at the end of this page.
Data we hold about customers
When you create an account we store your name, email address, hashed password, and the workspace you belong to. If you subscribe, our payment processor (acting as merchant of record, and named on the sub-processors list) handles your payment details; we never see or store a card number. We keep a record of what your workspace has spent usage against, because that is your billing record. If you write to us, we keep the conversation so we can help you.
We use privacy-preserving, cookieless analytics on this marketing site and product analytics inside the application to understand which features are used. Neither is sold or shared with advertisers.
Data we hold about audited businesses
SiteAssay collects information about businesses from public sources: business listings from the Google Places API, and the businesses' own websites and public DNS, TLS and domain registry records. That typically includes a trading name, address, phone number, website, the public social profiles the site links to, and the technical measurements of the website itself.
Contact details, and what they are for. SiteAssay also collects the contact details a business publishes about itself on its own website: a business email address and, where the site names them, the owner's name. They are used for one thing, which is an email a customer may review and send from their own mailbox about what the audit found. SiteAssay does not sell, rent or supply contact details to anyone, and its data export carries no contact column.
If you receive an email sent through SiteAssay, the unsubscribe link in it stops that sender from contacting you again, straight away and permanently. You can also write to us and we will suppress your address for the customer who contacted you.
We do not buy contact lists from data brokers, and we do not collect from any source that requires an account to access. We do not knowingly collect special-category personal data, and the product is not designed to profile individuals. It profiles websites.
Why we use it
Purpose | Data | Legal basis |
|---|---|---|
Providing your account and the service | Account and workspace data | Performing our contract with you |
Billing, tax and accounting records | Billing and usage records | Legal obligation |
Security, fraud and abuse prevention | Account data, IP address, request logs | Legitimate interest in keeping the service safe |
Improving the product | Usage analytics | Legitimate interest |
Assessing public business websites and contacting a business about what was found | Public business data and published business contact details | Legitimate interest, ours and our customers' |
Service and account emails | Email address | Performing our contract with you |
Where we rely on legitimate interest, you can object at any time, and an objection to processing of public business data is honoured immediately.
Cookies and similar technologies
The marketing pages set no cookies of their own and load no advertising or cross-site tracking, which is why there is no consent banner. They keep one small note in your browser's session storage, described below, which is never sent to us unless you create an account. The cookies below are set only when you use a feature that needs them.
Cookie | Purpose | Lasts |
|---|---|---|
| Keeps you signed in and your forms working in the app, the free tools and the contact form | 2 hours of inactivity |
| Protects forms against cross-site request forgery | Same as |
| Keeps you signed in if you tick "Remember me" | Up to 400 days |
| Records which SiteAssay report or link brought you here, so a signup can be credited | 400 days |
| Records the agency referral link you followed, so the referrer can be credited | 60 days |
| Remembers your light or dark mode and sidebar preference in the app | Up to 1 year |
The session storage note is called sa.ft. It holds the first page you opened on this site, the name of the site that linked you to it (the domain only, never the full address), and any campaign tags on that link. It stays in your browser and is deleted when you close the tab. If you create an account, it is sent with your signup so we can tell which pages bring customers to us, and it is stored with your account's signup record.
Forms protected by Cloudflare Turnstile load it from Cloudflare, and Cloudflare, which serves this site, may set strictly necessary security cookies to tell people from bots. You can block or delete cookies in your browser; signing in needs sid and XSRF-TOKEN.
Retention
Business records, audits, scores and reports are kept for as long as the customer's workspace holds them, and are deleted when the customer deletes them or closes the account. Suppression records, meaning the addresses that have unsubscribed, complained or hard-bounced, are kept in minimised form for as long as the opt-out has to be honoured. Billing records are kept for as long as tax law requires. The full list of retention periods is on our trust page.
International transfers
Our primary hosting and storage are in the EU. Some providers process data in other countries, including India and the United States. Where data leaves the UK or EU, we rely on the standard contractual clauses and the UK addendum, or an equivalent safeguard. The sub-processors list shows where each provider processes data.
Security
Workspaces are isolated from one another, data is encrypted in transit, passwords are hashed, and access to production systems is restricted. Our security page explains what we do, and what we do not claim.
Your rights
Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or erased, to object to or restrict how we use it, to take a copy of it with you, and to withdraw any consent you have given. Write to hello@siteassay.com and we will respond within 30 days.
If you are a business whose website has been audited through SiteAssay, you can ask us for a copy of what is held about you, ask for it to be corrected, or ask for it to be erased. We will act on it, and pass the request to the customer whose workspace holds the record.
In India, under the Digital Personal Data Protection Act 2023, you can also nominate someone to exercise your rights if you die or become unable to, and you can raise a grievance with us at the address above. If we do not resolve it, you may complain to the Data Protection Board of India.
In the UK and EU, you can complain to your local data protection authority.
In the United States, we do not sell or share personal information for cross-context behavioural advertising.
Children
SiteAssay is a business service for people aged 18 and over. We do not knowingly collect data from children.
Sub-processors
We use third parties for hosting, object storage, email delivery, error monitoring, analytics, payment processing, business discovery, the mailbox provider a customer connects to send outreach, and, when a customer enables it, an AI provider used to summarise audit findings and draft outreach. Audit measurements and business records are not used to train anyone's models.
Connected mailboxes and Google sign-in
When a customer connects a mailbox to their workspace for outreach, it is either a Microsoft account (Outlook or Microsoft 365) or any mailbox reached over SMTP, Gmail and Google Workspace included:
Scope of access: For a Microsoft account we request the
Mail.Sendpermission alongsideopenid,emailandoffline_access. For an SMTP mailbox the customer gives us the server, the port and an app password. We use either exclusively to transmit emails that a customer has explicitly drafted, reviewed, and approved within the application.No reading of correspondence: We do not read, index, process, or store private incoming emails, inbox contents, or email correspondence history. An app password could be used to read mail; we never use it for that.
Security and credential storage: OAuth refresh tokens and app passwords are encrypted at rest using AES-256 in our database.
No third-party sharing or advertising: We do not sell, rent, or share mailbox credentials or anything received through them with third parties, data brokers, or advertising networks, and none of it is used to train generalized AI or machine learning models.
Revocation and deletion: A customer can disconnect their connected mailbox at any time in their workspace settings, which permanently deletes the stored tokens or app password from our servers. You may also revoke access in your Microsoft account's app permissions, or delete the app password at your mail provider.
If you sign in with Google, we receive your name, email address and Google account ID, and use them only to sign you in. SiteAssay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Changes to this policy
When we make a material change we will email account holders before it takes effect, and the date at the top of this page always shows the version in force.
Contact
Questions and requests about your data: hello@siteassay.com
Company details
- Business address
- IN
- Contact
- hello@siteassay.com