Privacy policy

1. Data controller

The company that will run Fathom Audit isn’t incorporated yet, so its legal name, registered address and tax number will appear here as soon as it is. For anything to do with privacy, including exercising your rights, write to support@fathomaudit.com.

2. Data we handle

Your account: name, email, encrypted password, company, country, language and, if you turn on two-step verification, your authenticator secret, which we store encrypted.

Your usage: the sites you add, the audits and reports you generate, the competitors you follow, the alerts you get and the access logs.

Your billing: plan, amounts, receipts and the status of your payments. You pay through PayPal: your card or PayPal account is handled by PayPal, and we never see it. We store your subscription identifier and the payer identifier PayPal gives us.

The sites you audit: the HTML and public resources we crawl and the metrics that come out of them. If those pages contain personal data, we handle it only to produce your report.

The free scan: the domain scanned, the result, a shortened version of your IP address so we can limit abuse and, only if you ask for it, the email address we send the result to. If you also tick the separate, optional box for the offer reminder, we keep a record that you asked and when.

3. What we use them for

• Providing the service: crawling, analyzing, producing reports and keeping your history.
• Writing to you: monitoring alerts, finished audits, account notices and receipts.
• Charging, sending you receipts, handling refunds and keeping our accounts.
• Protecting the service: limiting abuse of the free scan, applying the refund guarantee once per customer, preventing unauthorized access and spotting failures.
• Improving the product with usage measurements that don’t identify you, and only if you accept analytics.
• Meeting legal, tax and accounting obligations.

4. Legal basis

We handle your data to perform the contract when we provide the service and charge for it; on legitimate interest when we protect the service from abuse; with your consent for analytics, for emailing you your free scan result and, only if you tick that separate box, for reminding you before your offer expires; and under legal obligation for tax and accounting.

5. Who we share them with

With the providers that process data on our behalf so the service works: hosting, database, file storage, analytics, payments and email. They’re all listed, with their name and location, on the subprocessors page.

To measure speed, every scan sends Google’s PageSpeed Insights, which measures it with Lighthouse, the home page’s URL and, on a paid plan, also one page per template and the pages you mark as important. We send it only those URLs: not your IP address or your email.

We send emails with Resend, in the United States: it gets your address and the content of the message, nothing else. If an email bounces or you mark it as spam, we stop writing to that address.

We don’t sell personal data, we don’t pass it to advertisers and we don’t use it to train models.

6. International transfers

Some providers are outside the European Economic Area, mostly in the United States. Those transfers rely on standard contractual clauses and on the additional safeguards each provider documents. Analytics is the exception: it’s hosted in the European Union.

7. How long we keep them

Your account data, for as long as your account is open. When you close it we delete them within 30 days, which is the window to get it back if you change your mind.

Audits and reports, for as long as your plan’s history lasts: three months, twelve or unlimited.

Free scans, for 90 days after they finish: until then, whoever started the scan and anyone they share the link with can open it. After that we delete the result, the home page screenshots, the exact address scanned and the shortened version of your IP, and keep only the domain, the dates and the scores, for our statistics and to apply the launch offer once per domain.

Charges, receipts and refunds, for as long as tax law requires; with each guarantee refund, the email and PayPal payer identifier, for that same period and even if you close your account, so the guarantee applies only once. Access logs, 12 months. Backups, 30 days. Email addresses from people who asked for a free scan result and never became customers, 12 months.

8. Your rights

You can access your data, correct it, delete it, object to how we handle it, restrict it and ask for a copy in a format you can take elsewhere. Write to support@fathomaudit.com from your account address and we’ll answer within the time the law sets.

Two of them don’t need asking: from Settings you can export your data and close your account yourself, whenever you want.

If you think we’ve got it wrong, you can complain to the data protection authority in your country.

9. Data from other people’s sites

When we audit a site we store content that’s already public on it. If you run a site and don’t want us crawling it, block FathomBot in your robots.txt: we respect it. You can also write to support@fathomaudit.com and we’ll delete whatever we have stored.

10. Security

Everything travels encrypted over HTTPS, passwords are stored with a strong hashing algorithm and the two-step verification secret is stored encrypted. Internal access goes by role, signing in to the admin panel requires two-step verification and is logged, and we make daily backups that we test restoring once a month.

11. Minors

The service isn’t aimed at people under eighteen and we don’t knowingly collect their data. If you think a minor has given us theirs, write to support@fathomaudit.com and we’ll delete it.

12. Changes

We’ll publish any change on this page, with its date. If it affects what we do with your data, we’ll tell you by email at least 30 days beforehand.