Privacy Policy

Operator

JudgeMySite is operated by Erik Hammarström, sole trader, Sweden. Contact for privacy and data-protection inquiries: privacy@judgemysite.org.

What We Collect and Why

• URLs you submit — used to generate your verdict. Stored alongside the review so the shareable link works. Legal basis: Art. 6(1)(b) GDPR (performance of the service you requested).
• Screenshots and site data — page structure, headers, meta tags, visible text, and a screenshot are captured during analysis. Sent to our AI provider for evaluation. Screenshots are not permanently stored. Legal basis: Art. 6(1)(b) GDPR.
• IP address — used solely for rate limiting (free-tier daily quota). We do not enrich, profile, or store it beyond the 24-hour rate-limit window. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).
• Cookie consent preference — stored in your browser's local storage. Not sent to our servers. Legal basis: not personal data.
• Email address (optional, waitlist only) — if you choose to be notified when paid features launch, we store the email you provide. We do not use it for marketing, do not share it, and do not contact you for any purpose other than the launch notification you signed up for. Legal basis: Art. 6(1)(a) GDPR (your explicit consent).

What We Do Not Collect

• No user accounts, no passwords
• No tracking cookies, no third-party analytics
• No advertising data
• No data sold to third parties
• No browser fingerprinting beyond the IP-based rate limit signal

Recipients of Personal Data (Sub-Processors)

We use the following third-party services to operate JudgeMySite. Each is bound by a Data Processing Agreement (DPA):

• Anthropic PBC (United States) — AI verdict generation. DPA.
• Vercel Inc. (United States, with EU edge) — hosting and edge delivery. DPA.
• Supabase Inc. — review storage and waitlist database. DPA.
• Upstash Inc. (Frankfurt, EU) — Redis for rate limiting and review storage. DPA.

International Data Transfers

Some of our sub-processors are based in the United States. Where the recipient is certified under the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), transfers rely on the Commission's adequacy decision. Otherwise, transfers rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). You may request a copy of the safeguards by emailing privacy@judgemysite.org.

Retention Periods

• Generated reviews: up to 90 days, then automatically deleted.
• IP address (rate limit): 24 hours.
• Waitlist email (optional): retained until paid features launch, plus up to 30 days afterwards for the launch notification, then deleted. You can request earlier deletion at any time.
• Screenshots: not permanently stored (held only during the analysis call).

Cookies

We use only strictly necessary cookies and local storage required to deliver the service: a cookie-consent preference and (when paid features launch) a signed cookie carrying a payment-session identifier. We do not use tracking, advertising, or analytics cookies.

Automated Decision-Making

Our AI generates verdicts based on the website you submit. These verdicts evaluate the website, not you personally, and produce no legal effect on you. Article 22 GDPR (automated individual decision-making with legal effects) does not apply.

Your Rights (GDPR Art. 15–22)

You have the right to:

• Access any personal data we hold about you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erasure of your data (Art. 17)
• Restrict processing in certain cases (Art. 18)
• Data portability for data you have provided (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, where consent is the legal basis (Art. 7(3))

To exercise any of these rights, email privacy@judgemysite.org. We respond within one month (Art. 12(3) GDPR).

For users who have not provided an email address, we hold no personally identifying information beyond the 24-hour rate-limit window — there is effectively nothing to access, rectify, or erase after that period.

Right to Complain

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection — Integritetsskyddsmyndigheten (IMY): imy.se. You may also complain to the supervisory authority in your country of residence.

Changes to This Policy

We will update this policy when our processing changes (for example, when paid features launch and we begin processing payment information). The "last updated" date at the top reflects the most recent revision.