What we collect, and what we do with it.

1. Who we are

Pressfort is a service from Launch Creative Ltd, a company registered in England and Wales (company number 09758806).

For the personal data described in this policy, Launch Creative Ltd is the data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). If you have a question about your data, email hello@getpressfort.com.

2. What we collect and why

If you ask for a free security check

• What: your name, email address and website address, plus how many sites you have and your message if you give them. We also record your country, worked out from your connection, and any boxes you tick on the form.
• Why: to check your site, email you the report and reply to any questions. We also send a few short follow-up emails about your report over the next two weeks, at a sensible time where you are, and check your site again before the last one so we can tell you what's changed. The check only looks at what your site shows publicly. It doesn't log in or change anything.
• Lawful basis: our legitimate interest in answering your request, which you've asked us to do, and in helping you act on the report. You can unsubscribe from the follow-ups at any time with the link in each one.
• If you tick the box for our newsletter, we sign you up as described below. We won't send it otherwise.
• We also keep a scrambled (hashed) version of your IP address to stop the form being misused. We don't store the IP address itself.

If you sign up for our newsletter

• What: your email address, where on our site you signed up, your IP address and rough location worked out from it, and when you confirmed your subscription.
• Why: to send you the newsletter, and to keep spam signups off the list.
• Lawful basis: your consent. We email you a link to confirm, and only send the newsletter once you've clicked it. You can unsubscribe at any time with the link in every email.

If you buy Pressfort

• What: your name, email address, billing address, any VAT or tax number you give us, the website you're protecting and your subscription details, such as the renewal date and currency.
• Why: to set up and run the service, take payments, work out and account for tax, send you sign-in links, alerts, reports and renewal reminders, and fix your site if it's hacked.
• Lawful basis: to perform our contract with you, and to meet our legal obligations for tax records.
• We don't see or store your card details. Stripe, our payment provider, handles them. See section 4.

When you sign in

We use your email address to send you a one-time sign-in link, and a cookie to keep you signed in. There are no passwords to store.

When you browse this website

• What: if you accept analytics cookies, Google Analytics records how you use the site: the pages you visit, how you found us, your rough location (country or city), and your device and browser type. It gives your browser a random ID so it can tell visits apart.
• Why: to see which pages help people and improve the site. We only look at totals and trends, not individual visitors.
• Lawful basis: your consent. If you don't accept, Google Analytics doesn't load. You can change your mind at any time with Cookie settings at the bottom of every page.

• What: if you accept cookies, the Meta Pixel sends Meta (the company behind Facebook and Instagram) the pages you visit, your IP address, your browser type and a random ID for your browser.
• Why: to see whether our ads on Facebook and Instagram bring people to the site, and to show our ads to people who've visited.
• Lawful basis: your consent. If you don't accept, the Meta Pixel doesn't load.

• What: if you accept cookies, Google Ads records the pages you visit, whether you arrived from one of our Google ads, whether you went on to buy, your IP address, your browser type and a random ID for your browser.
• Why: to see whether our ads on Google lead people to buy Pressfort, and to show our ads to people who've visited.
• Lawful basis: your consent. If you don't accept, Google Ads doesn't load.

Emails we send

We send emails about your security check or your subscription, such as reports, alerts and renewal reminders.

After a free security check, we also send up to four short follow-ups over two weeks about what the check found and how Pressfort could help. Each one has an unsubscribe link. They stop as soon as you unsubscribe or buy Pressfort, and if an email bounces or is reported as spam we stop emailing that address for good.

If you sign up for our newsletter, we send it until you unsubscribe.

We don't track whether you open our emails or click their links. Links in the follow-ups say which email they came from, so if you've accepted analytics cookies we can see which emails help people.

We don't sell your data or make automated decisions about you that have legal or similarly significant effects. The only advertising uses are the Meta Pixel and Google Ads described above, and only if you accept them.

3. Data on your website

To protect your site, Pressfort takes backups, scans files, keeps an activity log and may log in to fix problems. Your site may hold personal data about your own customers or visitors, such as orders, form entries or user accounts.

For that data, you are the controller and we act as your processor, under the data processing terms in section 6 of our terms. We only use it to provide Pressfort, following your instructions. We don't look through it unless we need to fix something, and we never use it for anything else. We keep it confidential and use the providers listed below, who are bound to protect it.

4. Who we share it with

We use a small number of trusted providers to run Pressfort. They only get the data they need to do their job.

• Stripe processes payments, works out tax and sends receipts and invoices for us. It collects your card and billing details directly, and also uses payment data to prevent fraud under its own privacy policy.
• Our website security provider powers the protection: updates, backups, scanning, the firewall, monitoring and reports. It holds your name and email address, your site's backups and data about your site. Ask us if you'd like its name.
• Cloudflare hosts this website, stores files and protects our forms from spam with Turnstile, which checks your browser for signs of a bot.
• Supabase hosts our database and handles sign-in.
• Postmark sends our emails.
• Buttondown manages our newsletter list and sends the newsletter.
• Google provides Google Analytics, which tells us how people use this website, with its advertising features turned off. It also provides Google Ads, which receives browsing and purchase data and uses it under its own privacy policy. Both only run if you accept cookies.
• Meta receives browsing data from the Meta Pixel if you accept cookies, and uses it under its own privacy policy.

We may also share data if the law requires it, or with a buyer if the business is ever sold, in which case this policy would still apply.

5. Data outside the UK

Some of our providers store or process data outside the UK, including in the United States and India. When that happens, we make sure it's protected: either the UK government has recognised the country as having adequate protection (including the UK-US data bridge), or we rely on the UK's approved contract terms for international transfers.

6. How long we keep it

• Free security checks: 12 months, then deleted automatically, along with the record of any follow-ups.
• Unsubscribes, bounces and spam complaints: we keep the email address and the reason for as long as we send follow-ups, so we never email that address again by mistake.
• Newsletter: while you're subscribed. If you unsubscribe, we keep your email address and when you left, so we don't sign you up again by mistake.
• Your account and subscription details: while you're a customer and for 2 years after your last subscription ends, in case you come back or there's a question about the service. Then we delete them automatically, including your details at our website security provider. You can ask us to delete them sooner.
• Backups of your site: up to 90 days on a rolling basis. When your subscription ends, we remove your site from our website security provider, which deletes its backups.
• Payment and tax records: invoices and payment records, held by Stripe, are kept for as long as tax law requires: currently six years in the UK, and ten years for EU sales we account for under the EU's One Stop Shop scheme.
• Website analytics: Google Analytics keeps data linked to your browser's ID for 14 months, then deletes it. The analytics cookies themselves last up to 2 years unless you delete them or turn them off.

7. Cookies

We use a few cookies the site needs to work, such as keeping you signed in and remembering your currency. We also use Google Analytics, Google Ads and Meta Pixel cookies, but only if you accept them.

When you first visit, we ask whether you're happy to accept analytics and advertising cookies. Rejecting them is as easy as accepting them, and you can change your mind at any time with Cookie settings at the bottom of every page. Our cookie policy lists every cookie, what it's for and how long it lasts.

8. Your rights

You have the right to:

• ask for a copy of the data we hold about you
• have it corrected if it's wrong
• have it deleted
• object to us using it, or ask us to limit how we use it
• receive it in a format you can take elsewhere

Email hello@getpressfort.com and we'll reply within one month. Some rights have limits. For example, we can't delete data while we still need it to run your subscription.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

9. Changes and contact

If we make important changes to this policy, we'll email customers before they apply. The date at the top shows when it was last updated.

Questions? Email hello@getpressfort.com.