Privacy Policy

This policy explains what personal data Check Your Website collects, why we collect it, where it is stored, how long it is kept, and the rights you have. It is written with an EU and GDPR-first posture.

1. Overview

Check Your Website is a website audit product. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our public pages, create an account, submit a website for audit, or use the service.

This policy is written with an EU and GDPR-first posture. Depending on where you live, you may have additional rights under local law.

2. Controller

SOMA44 d.o.o. is the controller for personal data processed through the service, unless another written agreement says otherwise. The company is registered in Slovenia at Tehnološki park 19, 1000 Ljubljana, registration number 7592647000, tax number 18963544.

You can reach us about privacy at info@check-your-website.com.

3. Personal data we collect

We may collect:

• account data, such as name, email address, authentication provider details, and account identifiers;
• website audit data, such as submitted URLs, page metadata, crawl results, audit findings, screenshots or page-derived evidence if enabled, and run history;
• Autopilot data, such as the GitHub repository or Lovable project you connect, the facts you confirm, the fix plan, the code changes Autopilot made, and your feedback on them;
• usage data, such as pages viewed, actions taken, device information, browser information, approximate location from IP address, referrer, and timestamps;
• support and feedback data, such as messages, ratings, issue reports, and survey responses;
• billing data if paid features are offered, such as plan, payment status, invoices, billing contact details, and payment processor references;
• technical and security data, such as IP address, logs, error reports, authentication events, rate-limit events, and abuse-prevention signals;
• cookie and similar storage data as described in the Cookie Policy at /cookies.

4. How we use personal data

We use personal data to:

• create and manage accounts;
• authenticate users and protect sessions;
• run website audits and show audit results;
• use AI-assisted systems to classify public page content, generate diagnostic explanations, and draft recommendations;
• save submitted sites, dashboards, history, and preferences;
• provide support and respond to messages;
• improve product quality, reliability, and usability;
• monitor security, prevent abuse, and investigate incidents;
• measure product usage and public-page performance;
• send service messages, such as verification, security, billing, or product notices;
• comply with legal, tax, accounting, and regulatory duties.

5. Legal bases under the GDPR

We process personal data under these legal bases where they apply:

• contract, when processing is needed to create your account, provide the service, run audits, and manage paid features;
• legitimate interests, when processing is needed to secure, maintain, debug, improve, and understand the service, provided those interests are not overridden by your rights;
• consent, when required for optional analytics, marketing, or non-essential cookies;
• legal obligation, when processing is needed for tax, accounting, law enforcement, regulatory, or compliance duties;
• vital interests or public interest only if a rare situation requires it and the law allows it.

6. Website audit data

You should only submit websites that you own, manage, or are authorized to audit.

Website audit data may include page content, metadata, technical signals, links, robots and sitemap evidence, performance data, and generated recommendations. If the submitted website contains personal data, that data may be processed as part of the audit.

You are responsible for making sure that you have the right to submit the website for analysis.

7. Cookies and similar storage

We use cookies and similar browser storage for essential service functions, preferences, authentication support, analytics, and product reliability. See the Cookie Policy at /cookies for more detail.

8. Sharing personal data

We may share personal data with:

• hosting and infrastructure providers;
• authentication providers;
• analytics and product measurement providers;
• error monitoring and observability providers;
• AI inference and website analysis providers;
• crawler, scraping, and page performance providers;
• email and communication providers;
• payment processors if paid features are offered;
• professional advisers, such as lawyers, accountants, and auditors;
• public authorities or other parties when required by law or needed to protect rights, safety, security, or legal claims.

We do not sell personal data.

9. Current service providers

Based on the current production architecture, the service uses these provider categories to operate Check Your Website:

• Vercel for frontend hosting and edge runtime.
• Railway for backend hosting and background worker runtime.
• PlanetScale Postgres for the production application database.
• Upstash Redis for queues, rate limiting, cache coordination, and worker coordination.
• Clerk for authentication, account sessions, email verification, Google sign-in, and session-abuse protections used by the auth flow.
• Sentry for error monitoring, reliability telemetry, and tracing. Sentry does not record session replays.
• PostHog for optional product analytics after analytics consent.
• Vercel AI Gateway and selected AI model providers for AI inference used to generate explanations and answers.
• TypeSafe AI, through Vercel AI Gateway, for structured AI decisions over submitted public page content (page type, answer coverage, link clarity, structured-data consistency).
• Firecrawl for crawler/scraping fallback where public website access requires it.
• Google PageSpeed Insights for page performance measurements. We send it only the public page URL.
• Resend for operational email notifications, if enabled.
• Anthropic for AI models and for the isolated sandbox where Autopilot works on your code (Claude Managed Agents).
• GitHub for Autopilot access to the one repository you connect through our GitHub App.
• Lovable for Autopilot changes in a Lovable project you connect.
• Cal.com for demo bookings, if you book one.
• Product-owned campaign result handoff records in PlanetScale Postgres, if email campaign result links are used.

• Full list of subprocessors, with region and transfer basis

Provider availability can change as the service evolves. When a provider materially changes how personal data is processed, we update this policy or the relevant data processing documentation.

10. AI-assisted processing

The service uses AI to analyze submitted public website content and technical audit evidence, then generate diagnostic explanations, issue summaries, and suggested fixes. AI outputs are assistive and may be incomplete or incorrect. AI does not make binding decisions about you.

AI models are called through Vercel AI Gateway with zero data retention and no training on your data, except where the Security page at /security lists an exception.

Submitted URLs, bounded page text, technical signals, and audit evidence may be sent to AI and website analysis providers when needed to deliver the audit. Do not submit websites that you are not authorized to audit, and do not intentionally submit pages containing special-category personal data.

11. Autopilot

Autopilot is an AI agent that fixes technical signals and confirmed facts on your website. It changes your website only through a pull request you merge or a Lovable change you publish, after you approve its plan.

• For GitHub, you install our GitHub App on the repositories you choose. Autopilot reads one repository per website with a read-only token that expires after 1 hour; our backend writes the checked changes to a new branch. We store the repository name and installation ID, never a token.
• For Lovable, Autopilot works in the one project you connect. Your Lovable credential is kept in an encrypted vault at Anthropic, not in our database.
• Autopilot works in an isolated sandbox at Anthropic. Claude Managed Agents does not offer zero data retention, so we delete each session at Anthropic when the fix job ends.
• We keep the plan, a summary, and your feedback for your history. We delete the code changes 90 days after the fix job ends.
• Beta credits: we record your credit balance and what each Autopilot fix job used, so we can show your balance.

12. Agent API keys and referrals

• If you connect your own coding agent, we create an API key for your account. We show the key once and store only a SHA-256 hash of it, its first characters, the agent type you chose, and when it was last used. You can revoke a key in your settings at any time, and it stops working at once.
• If you sign up through an invite link from a friend, we store the network part of your IP address (deleted with your account) and a SHA-256 hash of your normalized email address, not the address itself, so each person and network counts once.
• When you invite friends, your first name appears on the page your invite link opens.
• To give the beta credits and count a referral only once per mailbox, we keep the SHA-256 hash of your normalized email address, and the dates you claimed credits or joined through an invite, also after you delete your account. The hash is not linked to any account and does not contain your address. We keep it on the basis of our legitimate interest in preventing abuse of free credits.

13. International transfers

Some providers process data outside the European Economic Area. Where a provider we contract with directly is certified under the EU-US Data Privacy Framework, we rely on that adequacy decision; otherwise we use the Standard Contractual Clauses approved by the European Commission. AI models from OpenAI, Google (Gemini), and Anthropic (Claude) are reached through Vercel AI Gateway: they are Vercel’s subprocessors, and our Data Processing Agreement with Vercel covers them. The subprocessor list at /subprocessors names the basis for each provider.

14. Retention

We keep personal data only as long as needed for the purposes described in this policy, unless a longer period is required by law. A daily job deletes data when its period ends.

Billing and tax records, if paid features are offered, are kept as long as the law requires. Analytics data is kept according to PostHog settings. Some providers keep operational logs under their own data processing terms.

15. Security

We use technical and organizational measures designed to protect personal data: data is encrypted in transit (TLS) and at rest (database and backups), access is limited per account, and public endpoints have rate limits. The Security page at /security describes the measures in detail.

No system is perfectly secure. You are responsible for using a secure email account, protecting your login method, and telling us about suspected unauthorized access.

16. Your rights

Depending on your location and the legal basis for processing, you may have the right to:

• access your personal data;
• correct inaccurate personal data;
• delete personal data;
• restrict processing;
• object to processing;
• receive a portable copy of your data;
• withdraw consent where processing is based on consent;
• complain to a data protection authority.

You can exercise rights by contacting us at info@check-your-website.com. We may need to verify your identity before responding.

To get a copy of your data, use Download my data in your account settings. It downloads your profile, websites, checks, facts, and Autopilot history as a JSON file. It does not include code diffs.

When you delete your account, we stop any running Autopilot work and delete its sessions at Anthropic, remove our GitHub App installation if no other account uses it, delete your Lovable credential, delete your data from our database except the email hash described in section 12, delete your analytics profile at PostHog when our PostHog deletion key is configured, and delete your sign-in account at Clerk.

17. Children

Check Your Website is not intended for children. Do not use the service if you are under the age required to create an online service account in your country.

18. Changes to this policy

We may update this Privacy Policy when the service, the law, or our data practices change. The updated date shows when the latest version took effect.

19. Contact

For privacy questions or to exercise your rights, contact us at info@check-your-website.com. We may need to verify your identity before responding.