How your data is used
Short version: the check needs your website address and an email to send the report to. Nothing here is sold, added to a mailing list, or used to train anything.
Who is responsible
Daniyal Sherafat, trading as ClickZero AI (KVK 97166863), Rotterdam, Netherlands. Contact: daniyal@clickzero.co. This site and the check are operated personally by Daniyal.
What is collected and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Website address you submit | Run the check | Steps at your request before a possible contract, 6(1)(b) |
| Your email address | Send the report link and PDF; answer questions about it | 6(1)(b) |
| A delivery record for each email (a hashed form of the address, the email provider's message id, delivered or bounced) | Know whether the report reached you, and resend it if it did not | 6(1)(b) |
| A hashed form of your IP address, browser type, timestamps | Prevent abuse and cost-draining automated submissions | Legitimate interest, 6(1)(f): keeping a free tool available |
| The report: excerpts of your public pages, the AI answers, findings | Deliver and, if you ask, discuss the check | 6(1)(b) |
| Follow-up about ClickZero's services | Only if you reply or ask | Legitimate interest, 6(1)(f); you can object at any time |
The check reads pages that are already public on your website. Those pages may contain names of staff or other people; excerpts are kept only inside your report for the retention period below. If you want a report deleted earlier, email me.
Who processes it
- Hosting: Railway (application server and database, EU region). The database holds requests, reports and the abuse counters.
- OpenAI and Anthropic: they receive the fixed questions (studio name, city, category) and, to read your studio's name and category, short excerpts from your public pages. They do not receive your email address or IP address. Both are US companies; transfers rely on their EU data-transfer terms (standard contractual clauses and, where certified, the EU-US Data Privacy Framework). API inputs are not used to train their models under their API terms.
- Google PageSpeed Insights: receives your homepage address to measure how fast it loads. It does not receive your email or IP address.
- Google Places (Google Maps): receives your studio's name, city and street address as a search, to find your public Google listing and the studios near you. It does not receive your email or IP address. The listing data it returns (name, address, rating, review count, website, opening hours) is shown with Google Maps attribution and removed from the stored report after 30 days; only Google's place ids are kept.
- Cloudflare Turnstile (only when instant checks are enabled): an anti-bot check that runs in your browser. Cloudflare sees your IP address and browser signals, and the server passes your IP address to Cloudflare when it verifies the check.
- Resend (email delivery): receives your email address and the report email, including the PDF, and keeps a log of sent emails under its own retention policy. Resend is a US company; the emails are sent from its Ireland region.
- My business mailbox: I get a notification of each check with the website, your email address and the report link; replies to report emails land there too.
- Cal.com (only if you click "book a call"): the booking page opens on cal.com with your email address and website filled in; what you enter there is handled under Cal.com's privacy policy.
There are no analytics scripts, advertising pixels or third-party cookies on this site. The site sets no cookies at all.
How long it is kept
| Data | Retention |
|---|---|
| Reports (findings, excerpts, AI transcripts) and their PDF | 60 days after creation, then deleted; the link stops working |
| Email delivery records and the email queue | 90 days |
| Requests that were never run | 30 days |
| Your email and request record, if no further contact | 90 days |
| Abuse counters (hashed IP) | 7 days |
| Server logs | 14 days |
| Database backups | 30 days rolling; deletions are reapplied after any restore |
These are my own retention choices, not statutory periods. The providers above keep their own logs under their own policies.
Your rights
You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest, by emailing daniyal@clickzero.co. I may ask you to confirm the email address the request came from. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
No decisions with legal or similarly significant effects are made automatically about you. The report is information about a website.
Last updated 16 September 2026.