Privacy at SiteFit.

Controller and contact

Shahin Shahmir, trading as SiteFit, Dower House, Manorgate Rd, Kingston upon Thames, KT2 7UA; info@sitefit.co.uk. You can contact us about your information and complain to the Information Commissioner's Office.

Information and purposes

We use account/sign-in details, selected property and concept, saved inputs, permitted evidence, report versions and provenance to prepare, deliver, reopen and protect analyses. We retain limited payment references, amount/currency, access status, policy versions, consent choices, delivery evidence and purchase-assistance requests. Stripe handles card entry; SiteFit does not store full card details.

Lawful bases

We use contract performance and requested pre-contract steps for requested analyses and delivery, applicable legal obligations for required financial, consumer and data-rights records, and legitimate interests for proportionate security and fraud prevention. Privacy acknowledgement is not blanket consent to all processing. Optional campaign attribution requires a separate choice; no marketing consent is bundled with purchase.

Recipients and transfers

Providers used for the relevant functions include Supabase (accounts, database and private files), Vercel (hosting), Stripe (payments), OpenAI (bounded interpretation), Zoho (correspondence), and authorised address/evidence providers where used. Only necessary information is shared. AI packets exclude account tokens, card details and direct identifiers through existing boundaries. Processing may involve other countries; no UK-only processing claim is made. The actual processor locations and applicable transfer safeguards require final review before commercial activation.

Cookies and optional measurement

Necessary cookies support sign-in and security. Optional measurement is separately controlled; see the current measurement and cookie disclosure below. No optional consent is bundled with purchase.

Retention and your rights

Online report access lasts 30 days from Ready. The retention criteria below govern underlying records. Contact info@sitefit.co.uk for applicable access, correction, erasure, restriction, objection or portability requests. Identity checks are proportionate and do not require passwords or tokens. We explain any lawful retention or exceptions; report immutability does not remove legal rights. No instant self-service erasure or independent-backup guarantee is made.

Optional measurement and cookie choices

When enabled and with your permission, SiteFit uses one shared Google tag for Google Analytics 4 and Google Ads to understand the journey from a visit to a paid report. Optional measurement is off by default. You can accept, reject, choose preferences or withdraw through Cookie preferences in the footer; buying a report does not require optional consent.

For our initial conservative setup, the shared Google tag loads only when both Analytics and Advertising measurement are allowed. Advertising personalization is a separate optional choice. We do not deliberately send names, email addresses, property addresses, report text, payment credentials or full account URLs to Google. Ad blockers, refusal of consent and leaving before measurement completes can mean a purchase is absent from Analytics.

The essential sitefit_consent_v1 cookie remembers your choices for up to 180 days. If permitted, sitefit_acquisition_v1 stores admitted campaign codes and advertising click identifiers for up to 90 days. Google may set _ga, _ga_* and _gcl_* cookies after consent; Google tag cookies are configured with a 180-day expiry. Consented first-party event deduplication uses this browser tab’s session storage. A necessary local preference can keep measurement blocked if saving a withdrawal fails.

Consented campaign associations are private and subject to 90-day retention. Minimal payment-conversion dispatch records, with consent evidence, protect against duplicate reporting and follow the applicable financial/audit retention and rights review. Withdrawal stops future collection; it cannot recall information already sent. A previously loaded Google library is unloaded by refreshing the page after withdrawal. Google processing may involve international transfers; processor settings and transfer safeguards require review before activation. See Google’s Privacy Policy. Contact info@sitefit.co.uk about access, correction or erasure, including consented measurement records.

Microsoft Clarity: public-page heatmaps and session replays

With your separate permission for session replays, and only when Analytics and Advertising measurement are also allowed, Microsoft Clarity helps us understand clicks, scrolling and usability on selected public pages. Previous Google cookie choices do not grant this new permission. Recording is excluded from location checks, private Snapshots and reports, account, sign-in, payment, legal and development pages. Public pages with query strings or fragments are also excluded. We mask page content and do not send custom account, report or property identifiers to Clarity.

Clarity reconstructs interactions from page structure and actions; this is not a video of your screen. It may process browser and device information, IP address, interaction data and public page URLs, and use first-party and third-party cookies. The essential sitefit_clarity_consent_v1 cookie remembers your separate choice for up to 180 days. Clarity may set _clck (up to one year) and _clsk (up to one day); Microsoft cookies may also be used when Advertising measurement is allowed. You can reject or withdraw through Cookie preferences without affecting your use or purchase of SiteFit.

Withdrawal stops future recording and clears accessible first-party Clarity cookies; a refresh unloads the library. Data already transmitted cannot be recalled through the cookie control. Microsoft documents ordinary recording retention of 30 days, with favourites and a limited sample retained for up to 9 months. Processing may involve international transfers. For processing, cookies and your rights, see the Microsoft Privacy Statement and Clarity cookie information. Contact info@sitefit.co.uk about SiteFit privacy requests.

Access and retention

30-day online access from immutable Ready is distinct from retention. We do not promise unlimited personal-data storage or automatic deletion of all records after 30 days.

Accounts

Keep identity and profile information for required account services and remaining access commitments; after closure retain only information justified by remaining legal, remedy or security obligations.

Reports, evidence and PDFs

Keep records to deliver contracted access and thereafter only for identified remedy, dispute, legal or permitted source-evidence needs. Respect source-specific licences and expiry. Reopening does not retrieve fresh evidence.

Contracts, consent, payments and delivery

Keep the necessary minimum for applicable financial and legal record requirements and justified dispute or data-rights needs. Do not retain full card details. Preserve original policy versions and delivery evidence while those purposes apply.

Requests and interrupted work

Keep purchase and data-rights requests to resolve them and retain a justified minimal audit record. Preserve failed-work evidence while needed to resolve delivery, ambiguous dispatch or billing uncertainty; do not discard unknown cost records to shorten retention.

Security and campaign information

Keep only what is needed for proportionate security or separately consented campaign attribution, subject to the relevant purpose and processor settings. Technical cron history is not a universal customer retention rule.

Recovery and disposal

Private primary records and files are held in Supabase. This is not a promise of independent backup or a recovery SLA. When a purpose ends, assess lawful holds and source rights, then securely erase or de-identify unnecessary information through controlled handling. Do not erase other customers or use immutability to refuse applicable legal rights.