Privacy policy

1. Who we are

ConformWatch is operated by Letrix Labs, a trading name of Dime Corporation Ltd (Company No. 13175488), registered at 124 City Road, London, EC1V 2NX, United Kingdom (“ConformWatch”, “we”, “us”). We are registered with the UK Information Commissioner’s Office as a data controller, registration ZC094825. For anything in this policy, email[email protected] or write to the address above.

This policy describes what ConformWatch does today: this website, our email, and accessibility scans we run for agencies. When the monitored service with customer accounts launches, this policy will be updated before it takes any data.

2. The two roles we play

Data protection law splits responsibility by who decides what happens to data. For information about you — your email when you write to us, our correspondence — we make those decisions, so we are the controller and sections 3 to 6 are our promises to you directly. For personal data that appears inside pages we scan — a staff name on a team page, a customer review — we act only on the instructions of the agency or business that asked for the scan, so we are theirprocessor, and sections 7 to 10 describe how we handle that data on their behalf. Agencies can put that relationship on contractual footing with ourdata processing agreement.

3. Visiting this website

This site sets no cookies at all — no analytics cookies, no advertising cookies, not even so-called essential ones. It runs no third-party tracking scripts, uses no browser storage, and self-hosts its fonts. That is why there is no cookie banner: there is nothing to consent to.

The site is served by Vercel Inc. (US), whose infrastructure briefly processes standard request data — your IP address and browser details — to deliver pages and defend against abuse; on our plan those logs are kept for roughly an hour. Uptime is watched by Hyperping SAS (France, data in Frankfurt), whose probes check the site from their own servers and never see visitors’ data at all. We currently run no analytics; if we ever add any, it will be a cookieless instance of Plausible running on our own servers, and this policy will say so first.

4. The contact form

The form on this site posts your email address, your question and an optional portfolio size to Formspree Inc. (US), our form provider, which passes it to our inbox. Formspree retains submissions for 30 days on its systems, and we clear them once they have reached the inbox. We use what you send to answer you — as the form says, you get a personal reply, nothing else, and there is no mailing list to end up on.

5. Email

Our mailboxes run on Spacemail, operated by Spaceship, Inc. (US), under a data processing agreement. Correspondence is kept for as long as the conversation or the working relationship needs it, normally no more than two years, then deleted. Records we have to keep for tax and accounting purposes are kept for six years, as UK law requires.

6. If we email you first

We sometimes introduce ConformWatch to web agencies by email, using contact details the agency has published on its own website. We do this under legitimate interests, as UK law permits for corporate recipients; we do not buy lists, we do not email individuals or sole traders without consent, and one “no” — or no reply and a follow-up ignored — puts an address on a suppression list we keep precisely so we never email it again. Every such email says who we are and how to opt out.

7. What a scan collects, and what we keep

A scan fetches publicly reachable pages of a website and runs automated accessibility checks against them. The scanner takes no screenshots, handlesno logins and no credentials, and scans public pages only. From each scan we keep three things:

Raw results, briefly. The scanner’s output includes fragments of the page’s HTML that identify failing elements. Before storage these fragments are stripped of their text content — we keep the tag, its attributes and its selector, not the words inside it — which removes almost all personal data at the source. These raw results are kept for up to 90 days, for debugging and quality checks, then deleted.

The report. The generated report — findings, counts, criteria, fixes — is the deliverable, and we keep it for as long as the engagement with the instructing agency lasts.

Anonymised artifacts. We retain text-stripped, anonymised scan artifacts — which are no longer personal data — to improve the product: tuning rules and testing the scanner. Any statistics we ever publish from scans are aggregated and anonymised so that no site, client or agency can be identified or the data reversed.

8. Where scan data lives

Scan data and every other category of personal data we store is held on servers in the United Kingdom and the European Economic Area, with hosting providers Hetzner, LeaseWeb, UpCloud and Vultr. Scans normally run from UK and EEA locations; where an agency asks for it, a scan can be run from a US-based node — that node fetches pages and returns results, and stored data remains in the UK and EEA.

9. How the scanner behaves

Scans run only on the instruction of an agency or business that has confirmed it manages the site or acts with the site owner’s authority. The scanner is deliberately rate-limited — sequential requests, never parallel — and identifies itself with the user-agent ConformWatchBot/1.0 (+https://conformwatch.com/scanner), which links to a page explaining what it is and how to stop it. It never interacts with cookie banners or accepts cookies on anyone’s behalf. Because scans are authorised by the site’s own manager, robots.txt rules are not applied by default; the instructing agency can turn robots.txt compliance on, and can exclude specific URLs from every scan. Staging or preview sites are scanned only on the agency’s explicit instruction, and what a staging site contains is the agency’s responsibility.

If we are scanning a site you own or manage and you want us to stop, email[email protected] — from the site’s domain, or via your agency — and we will stop, without argument, and tell the instructing agency we have done so.

10. If your details appeared on a scanned site

If your name or other details were published on a website we scanned, the text-stripping in section 7 means we are very unlikely to hold them — but you have rights either way. You can contact us directly and we will check what, if anything, we hold and act on it; where the data belongs to an agency’s engagement we will also route your request to them, since the law makes them responsible for it, and we assist them with such requests without undue delay.

11. Providers we rely on

Everything above involves a short list of service providers, each doing one job: Vercel (serves this website), Formspree (contact form), Spaceship (email), Hyperping (uptime checks, no visitor data), and Hetzner, LeaseWeb, UpCloud and Vultr (servers that run scans and store scan data in the UK/EEA). For agencies with a signedDPA, these are our sub-processors; we update this list before adding one that touches scan data, and the DPA gives you notice and the right to object. We may also disclose data where the law requires it, or as part of a sale or restructuring of the business, in which case this policy continues to apply.

We do not sell personal data, and we do not share it for advertising. There is no advertising.

12. International transfers

Personal data is stored in the UK and EEA, and UK–EEA flows are covered by mutual adequacy decisions. Three of our providers — Formspree, Vercel and Spaceship — are US companies that process limited data (form submissions, request logs, email) in the United States; those transfers rest on recognised safeguards: the EU–US Data Privacy Framework and its UK extension where the provider is certified, and standard contractual clauses with the UK addendum otherwise.

13. How long we keep things

Raw scan results: up to 90 days. Reports: the life of the engagement. Anonymised, text-stripped artifacts: retained (no longer personal data). Contact-form submissions: cleared from Formspree after handling, and in any case deleted by Formspree after 30 days. Correspondence: up to two years. Tax and accounting records: six years. Hosting request logs: roughly an hour.

14. Security

Everything runs over TLS. Access to scan data and the inbox is restricted to the founder; the accounts of every provider we use are protected with two-factor authentication; and the text-stripping in section 7 means the most sensitive thing we could hold is mostly never stored at all. Data minimisation is the design principle, not an afterthought. No system is perfectly secure, and we will not pretend otherwise — if a breach ever puts personal data at risk, we will notify those affected and the ICO as the law requires.

15. Your rights

UK data protection law gives you the right to access the personal data we hold about you, to correct it, to have it erased, to restrict or object to processing, to receive a portable copy, and to withdraw any consent you have given. Email[email protected] and we will respond within one month; we may need to verify who you are first. You can also complain to the Information Commissioner’s Office at ico.org.uk — we are registration ZC094825 — or to your local supervisory authority. If the law where you live grants you additional rights, we will honour reasonable requests to exercise them.

16. Changes

When this policy changes, the date at the top changes with it. That date is the record — if it is later than your last read, something moved.

17. Contact

[email protected], or by post: ConformWatch, Dime Corporation Ltd, 124 City Road, London, EC1V 2NX, United Kingdom.