How we look after your information

The website audit service at audit.exaltis.uk is run by Exaltis Solutions Ltd, a UK web design and SEO agency. We are the "data controller" for the personal information described here.

• Company number: 10977266 (registered in England and Wales)
• Registered office: Northern Design Centre, Abbott's Hill, Gateshead, England, NE8 3DF
• ICO registration number: ZA840684

If you have any questions, or want to use any of your rights, email us at elaine@exaltis.uk.

• Your account: your email address and password. Your password is stored scrambled ("hashed"), so nobody, including us, can read it.
• Your business details: business name, website address, town or city and type of business.
• Website check results: what we find when we scan the public pages of your website and run Google's PageSpeed test. These are about your website, not about people.
• Messages you send us: help requests (including any phone number you choose to give).
• Settings: for example, whether you'd like monthly reminder emails.
• Google Search Console data: only if you choose to connect it. See below.

Connecting Search Console is optional. If you connect it, you sign in with Google and give us read-only permission (the "webmasters.readonly" permission). We can't change anything in your Google account or Search Console.

We use this permission only to:

• list the websites (properties) in your Search Console, so you can choose yours;
• ask Google whether the pages from your latest audit are in its search results (the URL Inspection tool);
• show how many clicks and impressions each page has had from Google search over the last 28 days.

We store a secure, encrypted access key from Google so the connection keeps working, plus the latest results so we can show them on your dashboard. We never show the key to your browser or to anyone else.

Limited Use: The Exaltis Solutions audit service's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we only use Google data to show you these features in your own dashboard;
• we don't sell it, use it for advertising, or use it to train AI models;
• we don't share it with anyone, except where the law requires us to;
• our staff don't read it unless you ask us for help, it's needed for security, or the law requires it.

You can disconnect at any time with the "Disconnect" link on your dashboard. This deletes the key and the Google data we've stored. You can also remove our access in your Google account permissions.

• To run your account and the website checks you ask for (necessary to provide the service you signed up for).
• To send emails you've asked for: password resets, reports you email to yourself, and monthly reminders if you've switched them on. You can switch reminders off at any time.
• To reply to your help requests.
• To keep the service secure and prevent misuse, for example limiting how often checks can be run (our legitimate interests).

We don't sell your information and we don't send marketing emails without your permission.

We use a small number of trusted providers who process information on our behalf:

• Emergent: hosting for the app and its database.
• Resend (via Emergent): to deliver our emails.
• Google: PageSpeed Insights (we send Google your public website address to test its speed) and, if you connect it, Search Console.

Some of these providers may store data outside the UK. When they do, we rely on the legal safeguards that UK data protection law requires.

We only use essential cookies: one keeps you logged in, and a short-lived one (deleted after a day or when you sign up) remembers a free audit you started before creating an account. We also remember on your device that you've seen our cookie notice. We don't use advertising, analytics or tracking cookies, so we don't need to ask for consent.

We keep your account, business details and check history for as long as you have an account. Password reset links expire after 1 hour, emailed report links after 7 days, and Search Console data is deleted when you disconnect. You can delete your account yourself at any time from the "My business" page. This immediately and permanently removes your login, business details, check history, emailed report links and Search Console data. If you'd rather, email us and we'll do it for you within 30 days.

Under UK data protection law (UK GDPR) you can ask to see the information we hold about you, correct it, delete it, limit how we use it, object to how we use it, or get a copy to take elsewhere. Just email elaine@exaltis.uk.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first.

All connections use encryption (HTTPS). Passwords are hashed, Google keys are encrypted, and each customer can only see their own information.

If we make important changes, we'll update the date at the top and let you know by email or on your dashboard.