Privacy policy

Who is responsible for your information

GreatInternet is the data controller for this service. We are a UK-based independent website-review business operating through greatinternet.app. For privacy questions, identity or address verification, or requests about your information, email reports@greatinternet.app.

What we collect

We collect the website address and email you submit, your selected customer perspective, messages you send us, public-page text and screenshots used for a review, report versions and access records, account and service emails, purchase and refund records, and limited security records such as request timing and IP-derived rate-limit data. If the link you arrived by carried campaign tags (such as utm_source, utm_campaign or ref), we keep those short tags with a review you request, so we can count which links bring requests. Stripe handles full payment-card details; we do not receive them.

Why we use it and our legal bases

• To provide the service and purchases you request: necessary to perform our contract with you or take steps at your request.
• To answer enquiries and deliver reports: necessary for our contract and our legitimate interest in customer support.
• To prevent abuse, secure the service and diagnose faults: our legitimate interest in operating a reliable service.
• To keep tax, payment and dispute records: compliance with legal obligations and our legitimate interest in resolving claims.
• To measure site use with Google Analytics and Microsoft Clarity: your consent. Analytics stays off until you accept.

We use report-delivery email addresses for service messages, not marketing.

Cookies, Google Analytics and Microsoft Clarity

The site uses local browser storage to remember whether you accepted or rejected analytics. If you accept, Google Analytics sets or reads identifiers and receives information such as pages visited, approximate location, device and browser details, and interaction timing. We enable IP anonymisation. Microsoft Clarity, our session-recording and heatmap provider, sets or reads its own identifiers and records how visitors move through public pages so we can see where the site is confusing or slow. Clarity is configured to mask input and text content by default, independently of its own project settings, so recordings do not capture what visitors type or the specific text on the page. We do not load Google Analytics and Microsoft Clarity when you choose “Essential only”. You can withdraw or change your choice at any time using Cookie settings in the footer; withdrawal does not make earlier consent-based use unlawful.

Service providers

We use Vercel for hosting and private file storage, Neon for the application database, Resend for service email, Stripe for payments, Inngest for background processing, Sentry for error monitoring, and Google Analytics and Microsoft Clarity only with consent. For optional internal drafting, an authorised reviewer may send captured public website evidence to Vercel AI Gateway and the selected model provider (currently OpenAI). Customer submissions are not sent to that drafting service automatically. Generated material remains an internal draft until a named GreatInternet adviser checks the evidence, saves a human-reviewed version and accepts responsibility for publication. These providers process information under their own security and privacy terms only as needed to supply their service.

International transfers

Some providers may store or access information outside the UK. Where UK data-protection law requires it, we rely on an adequacy regulation or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum. You may ask us for more information about the safeguard used.

How long we keep information

• Unfinished review submissions and captured evidence: up to 90 days.
• Published reports, account details and delivery records: while the account or report remains active, then up to 12 months.
• Enquiries: up to 24 months after the last contact.
• Payment, refund and tax records: up to 7 years where required.
• Security and error logs: normally no more than 90 days.
• Analytics data: up to 14 months from Google Analytics, subject to its configuration, and up to 12 months from Microsoft Clarity, subject to its configuration.

We may keep specific records longer if reasonably needed for a legal claim, fraud investigation or legal obligation.

How assessment data improves the service

We use anonymised data from your assessment (findings patterns, category frequencies and outcome trends) to refine our assessment methodology, analyse industry trends, and publish anonymised insights, trend summaries and good-practice or common-mistake write-ups and articles. Anonymisation removes names, domains and identifying details before any analysis or publication; we never publish or share subject-identifiable material, and a published report remains under its subject's entitlement rules.

Your rights

Depending on the circumstances, you can ask for a copy of your information, correction, deletion, restriction, transfer, or object to use based on legitimate interests. You can withdraw consent at any time. Email reports@greatinternet.app to make a request. We may need to confirm your identity and normally respond within one month. There is no charge unless a request is clearly unfounded or excessive.

Deletion and complaints

To delete a report and associated personal information, email reports@greatinternet.app from the address linked to it and include the report link. Some payment records may need to be retained by law. If you are unhappy with our response, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or call 0303 123 1113.

Changes to this policy

We will update the date above when this policy changes materially. Our terms and refund policy explain the service and purchases.