Data Retention

Raw fetch data — 24 hours. Page content as served, response headers and the intermediate evidence assembled during an analysis. This is the largest and most sensitive category, so it has the shortest life. It exists only so a report can be generated and is discarded shortly afterwards.

Public snapshot — 30 days. The scores, findings and summary shown on a result page. Retained so the address remains reachable for long enough to be shared with a colleague, then removed automatically along with the result page itself.

Rate-limit hashes — 1 hour. A salted, truncated hash of a source network address with recent request timestamps. Discarded as the window rolls forward. It cannot be reversed and is not linked to any analysis or enquiry.

Enquiry and lead data — business policy. Name, contact details and the content of an enquiry, retained for as long as needed to deal with it and any relationship arising from it. Deleted on request where no ongoing obligation requires otherwise.

Verification evidence — operational need only. The record of which method confirmed control of a domain, and when. Verifications expire and require renewal.

Sensitive technical evidence — restricted. Where an assessment produces detail that should not be widely held, access is restricted and retention is limited to the engagement it relates to.

Expiry is checked on every read rather than by a periodic cleanup job. A record whose window has closed is removed at the moment it is next looked at, and a record that is never looked at is removed during the next sweep of the store.

This matters because scheduled cleanup fails quietly. A cron job that stops running leaves data in place indefinitely and nothing reports it. Enforcing at read time means the retention window cannot be exceeded by a record that is actually in use, and a record that is not in use cannot be served after expiry.

Raw evidence has a separate, shorter window from the snapshot it produced. When that window closes, the evidence is stripped from the record while the snapshot remains, so a result page can outlive the material it was derived from.

Both analysis retention periods are set by environment variable:

• RETENTION_RAW_FETCH_HOURS — default 24
• RETENTION_SNAPSHOT_DAYS — default 30

Where a deployment sets different values, those values apply and this page should be updated to match. We will not state a retention period the implementation does not enforce, and a policy that describes an aspiration rather than a behaviour is worse than none.

• Source network addresses in their original form. Only a salted, truncated hash exists, and only within the rate-limit window.
• Passwords, credential material, raw breach records or stealer-log content. These are never processed at any stage.
• Complete organisational email addresses in a public snapshot. Counts and masked samples only.
• Anything typed into the meta preview tool. It runs entirely in your browser and transmits nothing.
• Tool check results. The free tools return a response and write nothing.
• Analysis findings or website content in analytics, under any circumstances.

Third-party services involved in an analysis apply their own retention. Google PageSpeed Insights receives only a public page address. The interpretation provider receives structured evidence for the purpose of producing a report, and that evidence is not used to train models. Where a CRM endpoint is configured, enquiry details are retained there under the operator’s own policy. We cannot delete from a third-party system on your behalf, but we will tell you which ones were involved so you can approach them.

You can ask for a result to be removed before its window closes. Contact us through the contact page with the address of the result page. Because analysis records are not linked to an identified person, that address is usually the only way to locate the right one.

Requests concerning enquiry data are handled as described in the privacy policy, where the wider set of rights is set out.