Privacy Policy

Operator

JudgeMySite is operated by Erik Hammarström, a private individual based in Sweden. Contact for privacy and data-protection inquiries: privacy@judgemysite.org.

What We Collect and Why

• URLs you submit — used to generate your verdict. Stored alongside the review so the shareable link works. Legal basis: Art. 6(1)(b) GDPR (performance of the service you requested).
• Screenshots and site data — page structure, headers, meta tags, visible text, and a screenshot are captured during analysis. Sent to our AI provider for evaluation. Screenshots are not permanently stored. Legal basis: Art. 6(1)(b) GDPR.
• IP address — used for rate limiting (the free-tier daily quota) and, in a salted, irreversibly hashed form, to measure usage (for example, telling one visitor who shares a verdict fifty times apart from fifty different visitors). We never store your raw IP beyond the rate-limit check, never enrich or profile it, and the salted hash cannot be reversed to recover your IP. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and understanding how the service is used).
• Usage events — when a verdict is generated, shared, downloaded, or copied, we record the action (event type, which judge, and the grade) alongside the salted IP-hash above, in a first-party event log. It contains no submitted URLs, no raw IP, no name, and no account. Used only to understand how the product is used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest); you may object at any time (Art. 21).
• Cookie consent preference — stored in your browser's local storage. Not sent to our servers. Legal basis: not personal data.
• Email address (optional, waitlist only) — if you choose to be notified when paid features launch, we store the email you provide. We do not use it for marketing, do not share it, and do not contact you for any purpose other than the launch notification you signed up for. Legal basis: Art. 6(1)(a) GDPR (your explicit consent).

What We Do Not Collect

• No user accounts, no passwords
• No tracking cookies, and no third-party or advertising analytics (our only analytics is the first-party event log described above)
• No advertising data
• No data sold to third parties
• No device or browser fingerprinting (no canvas, font, or hardware probing) — the only signal we derive is the salted IP-hash described above

Recipients of Personal Data (Sub-Processors)

We use the following third-party services to operate JudgeMySite. Each is bound by a Data Processing Agreement (DPA):

• Anthropic PBC (United States) — AI verdict generation. DPA.
• Vercel Inc. (United States, with EU edge) — hosting and edge delivery. DPA.
• Supabase Inc. — review storage and waitlist database. DPA.
• Upstash Inc. (Frankfurt, EU) — Redis for rate limiting and review storage. DPA.
• Google LLC (United States) — PageSpeed Insights performance scoring; the URL you submit is sent to Google for analysis. Terms.
• Firecrawl (Mendable, Inc.) (United States) — fallback page extraction when our primary crawler cannot read a site. Privacy.
• Cloudflare, Inc. (United States, with EU edge) — authoritative DNS for our domain, and email routing for our contact addresses. Cloudflare does not proxy traffic to this site and therefore never sees your requests or the sites you submit; the site is served directly by Vercel. DPA.
• Stripe, Inc. (United States) — payment processing. Activated only when paid features launch; no payment data is processed while the service is free. DPA.

International Data Transfers

Some of our sub-processors are based in the United States. Where the recipient is certified under the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), transfers rely on the Commission's adequacy decision. Otherwise, transfers rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). You may request a copy of the safeguards by emailing privacy@judgemysite.org.

Retention Periods

• Generated reviews: up to 90 days, then automatically deleted.
• Raw IP address: held only for the rate-limit check (a rolling 24-hour quota window), never written to long-term storage.
• Salted IP-hash & usage events: retained for product analytics. The salt is rotated periodically, which permanently breaks the link between older events and any IP; the hash is irreversible and carries no name or contact detail.
• Waitlist email (optional): retained until the launch notification is sent, then deleted. You can request deletion at any time and we will action it.
• Screenshots: not permanently stored (held only during the analysis call).
• Public docket entries: when the docket is enabled, a short summary of a completed review — the reviewed address, the grade awarded, and the titles of the findings — is kept for up to 365 days so a site can be looked up again without re-running a review. It never contains the full review text, screenshots, or anything about the person who requested it. This outlives the 90-day period above by design; the full review is still deleted on the 90-day schedule regardless.

Cookies

We use only strictly necessary cookies and local storage required to deliver the service: a cookie-consent preference and (when paid features launch) a signed cookie carrying a payment-session identifier. We do not use tracking, advertising, or analytics cookies.

Automated Decision-Making

Our AI generates verdicts based on the website you submit. These verdicts evaluate the website, not you personally, and produce no legal effect on you. Article 22 GDPR (automated individual decision-making with legal effects) does not apply.

Your Rights (GDPR Art. 15–22)

You have the right to:

• Access any personal data we hold about you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erasure of your data (Art. 17)
• Restrict processing in certain cases (Art. 18)
• Data portability for data you have provided (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, where consent is the legal basis (Art. 7(3))

To exercise any of these rights, email privacy@judgemysite.org. We respond within one month (Art. 12(3) GDPR).

For users who have not provided an email address, we hold no directly identifying information — only a salted, irreversible IP-hash in our usage log, which carries no name, account, or contact detail and cannot be traced back to you.

Right to Complain

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection — Integritetsskyddsmyndigheten (IMY): imy.se. You may also complain to the supervisory authority in your country of residence.

Changes to This Policy

We will update this policy when our processing changes (for example, when paid features launch and we begin processing payment information). The "last updated" date at the top reflects the most recent revision.