Privacy policy
What we collect, why, where it is stored, for how long, and what we have deliberately chosen not to collect.
1. Controller
The controller is the publisher of the site, identified in the legal notice, reachable at the contact address given there.
No data protection officer has been appointed: the activity does not fall within the cases making such an appointment mandatory. Requests relating to data are handled directly by the publisher.
2. Data we collect
We collect only what is necessary for the service to work.
- Account: email address, name, password in encrypted form. Where signing in with Google: Google identifier and, where applicable, profile picture.
- Billing: company name, registration number, address, for professional clients and for the issuing of invoices.
- Usage: addresses of the pages analysed, reports produced, analysis history, quotas consumed.
- Technical: automatically generated server logs, containing an IP address, kept for security and diagnostics.
- Audience measurement: only if you consent to it, see the section devoted to cookies.
3. Purposes and legal bases
Each processing operation rests on an identified legal basis.
| Purpose | Legal basis |
|---|---|
| Create and manage your account, run the analyses | Performance of the contract |
| Invoice, collect payment, keep the accounts | Legal obligation |
| Send the emails related to the service | Performance of the contract |
| Secure the service, prevent fraud and abuse | Legitimate interest |
| Produce aggregated statistics with no personal data | Legitimate interest |
| Measure the audience of the site | Consent |
4. Analysis data and aggregated data set
Each analysis records the address of the site examined and the report produced, attached to your account, so that you can find them again and follow how they change.
Separately, the analyses feed a statistical data set designed from the outset to contain NO personal data: domain extension, country, language, content management system, commerce platform, score and detail of the checks. Neither email address nor IP address in clear form appears in it, and the link to the account is detachable.
This data set may be used to publish public studies on the state of readiness of websites. Its design guarantees that no user and no client can be identified in it.
5. What we do not keep
Some data passes through the service without ever being stored.
- The server logs you paste into the AI crawler analyser are processed in memory then discarded. They are never written to disk nor passed on to a third party.
- No bank card details are recorded. Card information is entered in a form operated by Stripe and does not pass through our servers.
- We carry out no advertising profiling, no resale and no renting of data to third parties.
6. Recipients and processors
We use the following providers, each accessing only the data necessary for its task.
| Provider | Role | Location of the processing |
|---|---|---|
| Hostinger International Ltd | Hosting of the site and of the database | Company established in Cyprus, servers located in the United States |
| Stripe | Payment processing and invoicing | European Union and United States |
| Titan | Sending of the emails related to the service | Depending on the provider's region |
| Sign in with a Google account, and audience measurement subject to consent | European Union and United States |
7. Transfers outside the European Union
The servers hosting this site are physically located in the United States. Your account data and your reports are therefore stored there, outside the European Union.
These transfers are governed by the mechanisms provided for in chapter V of the General Data Protection Regulation, in particular the standard contractual clauses of the European Commission and, where applicable, the adequacy decision applicable to certified United States entities.
We prefer to write it plainly rather than leave it to be guessed: if hosting your data outside Europe does not suit you, do not open an account, and write to us, that information is useful to us.
8. Retention periods
Data is not kept indefinitely.
| Data | Period |
|---|---|
| Account and associated reports | Lifetime of the account, then deletion within thirty days after closure |
| Invoices and accounting records | Ten years, in application of accounting obligations |
| Technical server logs | Twelve months at most |
| Aggregated statistics with no personal data | No limit, this data not being personal |
| Proof of consent to cookies | Six months |
9. Cookies and trackers
The site places two categories of files.
- Strictly necessary cookies: session, security token against request forgery, theme and language preference. They are essential to the operation of the site and do not require consent.
- Audience measurement cookies: placed only after your explicit agreement, through Google Tag Manager and Google Analytics. Refusal is the default setting: until you have accepted, no measurement tag fires.
Your choice is kept in your browser's local storage, under the key r2g-consent, and not in a cookie sent to the server. You can change that choice at any time from the button further down this page.
Refusing causes no degradation: the site and all the tools work identically.
10. Security
Exchanges are encrypted in transit by TLS. Passwords are stored as non reversible hashes. The access keys to third party services are encrypted in the database.
Access to the administration area is restricted and protected by authentication. No measure guarantees absolute security: in the event of a data breach likely to result in a high risk to your rights, you would be informed in accordance with article 34 of the Regulation.
11. Your rights
You have the following rights over the data concerning you.
- Access: obtain a copy of the data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of your data, subject to our legal retention obligations.
- Restriction: request that a processing operation be frozen while a challenge is examined.
- Objection: object to a processing operation based on our legitimate interest.
- Portability: receive your data in a structured, machine readable format.
- Withdrawal of consent: at any time, for the processing operations that depend on it, without affecting the lawfulness of earlier processing.
- Post mortem directives: decide what happens to your data after your death.
These rights are exercised by email to the contact address of the site. We reply within one month, extendable by two months for complex requests, in which case you are informed of it.
12. Complaint
If a reply does not satisfy you, you may lodge a complaint with the competent supervisory authority. In France, this is the Commission nationale de l'informatique et des libertés. Residents of another Member State may refer the matter to the authority of their own country.
13. Minors
The service is aimed at professionals and is not intended for persons under sixteen. We do not knowingly collect data relating to minors. Should such collection be brought to our attention, the data would be deleted without delay.
14. Changes
This policy may be updated to reflect a change in the service or in the regulations. The date of the last update appears at the bottom of this page. A substantial change in the purposes would give rise to specific information and, if necessary, to a fresh collection of consent.
Change your choice
You can change your decision at any time. The bubble will reappear the next time a page loads.
Last updated: 24 August 2026