Privacy

AuditTag is a trading name of Sam Parkinson, a sole trader. Address for correspondence: 4th Floor, 14 Museum Place, Cardiff, CF10 3BH. That is the data controller for everything described here. Last updated 5 October 2026.

The short version

• You do not need an account, so we do not hold one.
• We read the public pages of the site you ask us to audit, and keep a copy for a short time.
• We keep the sites audited, what we found on them and any business contact address they publish, for 90 days. It is not linked to you.
• We also keep, with no time limit, a count of which problems sites have, with no address in it, so we can publish research. It is not linked to you or to any site.
• If you ask us to email you the report, we keep your address only if you tick the box saying we can follow up.
• To write the missing tags, the text of those pages is sent to Anthropic's API.
• If you subscribe to Guardrails, we also keep a small record of the tags we see on the site you ask us to watch. The Guardrails section has the detail.
• We never see your card details. Stripe handles payment.
• There is no advertising and no cross-site tracking. We measure aggregate traffic with privacy-preserving, cookieless analytics (Cloudflare Web Analytics) and show ourselves a live count of how many people are on the site, which forgets each visitor within about ninety seconds. None of it sets a cookie, follows you to other sites, or records who you are.

What we collect

When you run an audit

The web address you submit, and the public content of the pages we fetch from it. We also record your IP address, which we use only to apply rate limits and stop the service being abused.

We read those pages the same way a search engine does, over the public internet. We never ask for and never hold a login, an API key, or any other access to your website.

Your report has its own web address, and that link works for 24 hours. After that the report is deleted and the link stops working. Until then anyone who has the link can open the report, so share it only with people you would show it to.

The address of each site audited, with the date, the score, the tags we found and the full list of findings. We also keep any business contact address the site publishes on its own pages, such as info@ or hello@, and the limited company it names, if it names one. We read these from the pages the audit has already fetched and never look anywhere else. We keep all of this for 90 days so we can open the report again and, where the site belongs to a business, write to that business about what we found, once, with a clear way to say no. Our reason is a legitimate interest in telling a business about a problem on its public website. None of it is linked to you or your IP address. If you own the site and want its record deleted, email privacy@audittag.com.

Separately, for each site audited we keep one anonymous research row with no time limit. It holds the platform the site runs on, how many pages we read, the score, which tags we saw and which of our checks the site failed, and a one-way code in place of the address, so the same site is counted once however often it is audited. It holds no address, no contact detail and nothing about you, and the code cannot be turned back into the address. We use these rows only as totals, for example "most small stores have meta descriptions that get cut off in search", in articles and case studies. Our reason is a legitimate interest in publishing research about the state of online stores. If you own a site and want its row removed, email privacy@audittag.com and we will delete it.

When you ask us to email your report

Your email address, which we use to send the report. Under the form is a box saying we can follow up with you about that site, and it starts unticked. If you leave it unticked, we send the report and do not keep your address. If you tick it, we keep your address with the site's address and score for 90 days, so we can get in touch about what we found. Reply to any email from us, or write to privacy@audittag.com, and we will stop and delete it.

When you use a free tool

This covers the Shopify pixel checker, the Google Tag Manager checker, the consent checker, the AI crawler checker, the Shopify theme detector, the product schema checker and the Black Friday tracking check. We take the address you submit, and your IP address for the same rate limits. We fetch that site's public homepage, robots.txt or the product page you named once, keep what the tool found for 15 minutes so a repeat check does not fetch the site again, and do not keep the page itself. The GA4 purchase event checker runs in your browser, so nothing you paste into it reaches us.

When you buy a fix pack

Your email address, and the fact that a payment succeeded. Payment itself is processed by Stripe. Card numbers are entered on Stripe's own systems and never reach us. Stripe's privacy notice is at stripe.com/gb/privacy.

When you request a readout

The details you type into the readout form: your name, work email, company website, and optionally your role, your monthly ad spend band, how many domains you run, which tracking tools you use and what has prompted you to get in touch. We use it only to reply to you and prepare for the call. We do not add you to a mailing list, and we do not pass it to anyone outside the processors named below. You can ask us to delete it at any time.

When a site is watched by Guardrails

Guardrails is the monitoring subscription. It reads a few public pages of a site on a schedule, the same way the audit does, and never logs in to anything.

For each watched site we store the site's address, the pages you asked us to check, the alert address you give us, a Slack or webhook address if you give us one, the plan and how often it is checked. After each check we store a short record of what we saw. That is the tags found and which pages carried them, a fingerprint of each snippet with a short excerpt of its text, the title and size of each page, and the on-page issues found. We also keep a log of the last 60 checks. We do not keep a copy of the pages themselves.

The only email address we store for a watched site is the alert address you give us. Your billing email and card details stay with Stripe, and alert emails are sent through Resend.

We keep all of this for as long as the site is watched. When a subscription ends, or you ask us to stop watching a site, we remove the site and delete everything above. For now that deletion is done by hand, within 30 days of the subscription ending, as the terms say. An email that could not be sent is kept for at most two weeks so we can try again.

How long we keep it

• Audit results, including the copy of your pages: 24 hours, or 7 days if you buy a fix pack for that site, then deleted automatically.
• The record of each site audited, which is its findings and any contact address the site publishes on its own pages, is kept for 90 days, then deleted automatically.
• The anonymous research row, with no address in it, is kept with no time limit, because it is only ever used as totals.
• Your email address, when you ask for your report and tick the follow-up box, is kept for 90 days, then deleted automatically. Untick it and we do not keep it at all.
• Free tool results, from the pixel, Tag Manager, consent, AI crawler, theme, product schema and Black Friday checks, are kept for 15 minutes.
• Fix packs: 7 days from purchase, so you can download again if you need to.
• Guardrails records are kept while a site is watched and deleted when it stops, as described above.
• Demo requests: up to 90 days, so we can follow up on the conversation, then deleted automatically.
• Rate limiting records: 48 hours.
• Payment records: kept by Stripe, and by us for the six years UK tax law requires.

Deletion is automatic and enforced by the storage itself, not by someone remembering to run a job.

Who else sees your data

Four processors, each doing one job:

• Cloudflare does the hosting and storage.
• Anthropic writes the titles, descriptions, alt text and structured data in your fix pack. This means the text of the pages we crawled is sent to Anthropic's API. It is not used to train their models. If that is not acceptable for your site, do not buy a fix pack; the free audit does not involve them.
• Stripe takes payment.
• Resend sends email, such as your fix-pack download link, the report you asked us to email, or the acknowledgement of a readout request.

We do not sell your data, and we do not share it with anyone else.

Auditing a site you do not own

Nothing stops you pointing AuditTag at somebody else's website, because the pages are public. But we only fetch what a search engine could already fetch, we obey robots.txt, and the fix pack is a set of files. It cannot be applied to a site you do not control.

Your rights

Under UK GDPR you can ask for a copy of what we hold, ask us to correct or delete it, or object to how we use it. Audits expire in 24 hours and there are no accounts, so unless you asked us to follow up about your report, there is usually nothing about you left to act on by the time you ask. Email privacy@audittag.com and we will respond within 30 days.

If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

No cookies. The site sets none, which is why you were not asked to dismiss a banner. The traffic and live-visitor counts we keep are cookieless and hold no personal data: the live count uses a random per-tab id kept only in your browser’s session storage and a matching record on our side that expires within about ninety seconds, then is gone.

Changes

If this notice changes materially we will update the date at the top. Contact: privacy@audittag.com.