Privacy Policy

CheckMyWebsite.co.uk is operated by UKC LABS LTD, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Company number 15229367. VAT number GB476819146. We are the data controller for the personal data described here. For any privacy question, email hello@checkmywebsite.co.uk.

The service runs non-invasive checks against publicly available information for a website you submit. It reads public HTTP responses, page metadata and public files such as robots.txt and sitemap.xml. It does not log in to the target site, does not attempt to change anything on it, and is not penetration testing or a security test.

• The URL or domain you submit, and the canonical host it resolves to.
• Scan and report data: findings, scores, and the report token used to open your report.
• Technical data returned publicly by the website checked, such as status codes, response headers and page metadata.
• Operational and security logs, including a peppered one-way hash derived from your IP address for rate limiting and abuse prevention, plus error diagnostics.
• Contact and payment data needed to complete a purchase and support you: your email address if you contact us, and the purchase record (amount, VAT, currency, status, and the payment reference from our payment provider).

We do not build behavioural profiles, and we do not sell data. Optional Google measurement is described below and only runs if you accept it.

We use Google Analytics and Google Ads measurement (Google tag ID G-R285XTW1QD) to understand how many people use the site, which pages they visit, and whether a check or a Domain Unlock purchase completed. This helps us improve the service and measure our advertising. It is not essential to the service.

The Google tag is not requested or executed until you choose Accept analytics in the privacy choice shown on your first visit. If you choose Reject non-essential, no Google request is made and the site works normally. Under UK GDPR we rely on your consent for this measurement, in line with PECR's rules on non-essential storage and access on your device.

Your choice is stored locally in your browser (a single value in local storage) so we do not have to ask again. You can review or change it at any time using Cookie settings in the footer; choosing to reject stops any further measurement from that point.

Where measurement is enabled, Google acts as a recipient of the data and may set its own cookies and identifiers, and may process data outside the UK under safeguards recognised by UK data protection law. We send only page paths and two coarse events: cmw_scan_completed with a value of "cached" or "fresh", and cmw_unlock_purchased with the purchase value and currency. We do not send the domain you checked, report or pass tokens, email addresses, payment references or Stripe session identifiers. Google retains analytics data according to its own retention settings, typically up to 14 months for event data. The access, deletion and objection rights described below apply to this measurement too.

• Contract: to run the check you asked for, produce your report, and deliver and manage a 30-Day Domain Unlock you have bought.
• Legitimate interests: to keep the service available and secure, apply reasonable rate limits, prevent abuse, and diagnose faults.
• Legal obligation: to keep tax and accounting records for sales, including VAT records.

Card payments are processed by Stripe. Your card details are entered directly with Stripe and we never see or store card numbers. We store only the purchase record and Stripe's payment reference so we can grant, support, and where required revoke your Domain Unlock. Stripe acts as an independent payment provider and processes your payment data under its own terms and privacy notice.

We use a small number of providers to run the service: our hosting and database platform, and Stripe for payments. Providers may process data on our behalf only to deliver the service, and we do not sell or share your data for marketing. Where a provider processes data outside the UK, it does so under safeguards recognised by UK data protection law.

• Scan reports and their access tokens are retained for 30 days and are then purged by our scheduled cleanup.
• Domain Unlock records last for the 30-day unlock period, plus the period needed to handle refunds, disputes and support.
• Purchase and VAT records are kept for the period required by UK tax law.
• Operational and security log data, including rate-limit hashes, is kept only as long as needed for abuse prevention and troubleshooting.

Reports are reachable only via a long, unguessable token, sensitive detail is withheld from free reports on the server rather than merely hidden in the browser, and paid access is decided server-side. Traffic is served over HTTPS and payment card data never reaches our systems. No online service can be guaranteed completely secure, and we do not claim any security certification.

You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to our processing of it, or port it. Email hello@checkmywebsite.co.uk and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

If we change this policy we will update the date at the top of this page. Material changes affecting purchases will be reflected before your next purchase.