Privacy notice

The free growth scan

You enter a website address. You may add an email address, but the growth scan does not need it. The growth scan does not use that email and does not store it. Your browser only copies it into the follow-up form on the same page. The email does travel with the request to the server, but the server function never reads it, never stores it and never writes it to a log line.

The server fetches the exact address you enter, usually your homepage, and reads the HTML. If you enter a deeper page, with a path or a query in the address, that page is fetched. It does not run JavaScript on that site. It follows redirects. It also makes a few small requests for images and for http and https, so it can judge the lock and the weight of the images. If the first try is slow or cut short, it sometimes fetches that page a second time. Your IP address is not sent to the site you enter. That request comes from the server.

The same result is reused for ten minutes, so that address is not fetched again straight away. It lives only in the working memory of the server function and is never written to a database or to disk. Expiry is checked the next time that result is touched, so an entry can linger until the function cleans up or stops. Vercel stops an idle function after a short time. The result can include what was already public on that page, such as a phone number or email address the site shows itself. The address you entered can also appear in the summary sent with the follow-up form.

To limit abuse the function counts requests per IP address over ten minutes and over a day. That count lives only in working memory, never in a database or on disk. Expiry is checked the next time the count is touched, so it can linger until the function cleans up or stops.

Log lines in the hosting logs contain the hostname of the fetched site, the duration and the status code. A redirect can add the destination hostname, and an error can add an error code. Your name and your email are not in those lines.

The AI analysis and live measurement

When AI analysis is available, it also reads the domain's homepage and up to four key public pages. It reads robots.txt, llms.txt and sitemap.xml as well. Publicly visible text from the pages can go to Anthropic (United States) and DeepSeek (China) at the same time to write the position analysis. Recognisable email addresses and phone numbers are removed first. Public text can still contain other details, such as an author's name. Only scan a public business site you want read for this purpose.

For the live measurement, three proposed buyer questions, a general buyer description and the brand name go to DataForSEO. DataForSEO asks Perplexity and Google AI Mode for answers. The brand name is used to check the answers; I do not put it in the buyer question to elicit a mention. Your submitted email, name, phone number and IP address are not sent to these providers. I do not send your personal data for the analysis or measurement.

The AI analysis and measurement are reused for up to twenty-four hours. The cache lives only in server function memory, never in a database or on disk. After the scan your browser receives a signed scan receipt containing the domain, brand and questions. It expires after twenty-four hours and lets the measurement function verify that the questions came from a completed scan. It is not saved as a cookie or in local storage.

The AI analysis and live measurement each have their own IP limits: three requests in ten minutes and ten per day, per server instance. The AI analysis also has a daily limit per instance. AI log lines contain only the hostname, duration, provider, model name and token usage. No page text, email or API key.

Email, phone and LinkedIn

If you email me directly, your message lands in the same Gmail mailbox. I read what you send and use it to reply.

If you call, I hear what you say. This site does not record calls.

If you message me on LinkedIn, LinkedIn processes that message under its own terms. I read what you send there.

Purpose and legal basis

I process this data to answer your request and to take the steps you ask for before any contract exists. The legal basis is Article 6(1)(b) of the GDPR.

The IP rate limit and the other limits on the growth scan exist to prevent abuse. I do that on the basis of legitimate interest, Article 6(1)(f) of the GDPR.

Cookies and fonts

Without your consent this site sets no cookies and loads no scripts from other sites. Only your choice in the cookie banner is kept in your browser (localStorage). The fonts are hosted on this server. Nothing is loaded from Google Fonts.

Google Analytics 4

I use Google Analytics 4 by Google Ireland Limited for site statistics: how many people visit, which pages they read and how they arrive. That shows me what works and what to improve.

• Google Analytics only loads after you click Accept. If you click Decline or make no choice, it does not load and no analytics cookies are set.
• The legal basis is your consent, article 6(1)(a) GDPR.
• Google Analytics 4 does not store IP addresses.
• Advertising features are off and data sharing with Google for its own purposes is off.
• Data is kept for two months.
• Google may process data outside the EU. Google is certified under the EU-US Data Privacy Framework.

You can change your choice or withdraw consent at any time via Cookie settings, also at the bottom of every page.