A small footprint, on purpose.
We hold as little as we can, and we're specific about what that is. Here's exactly what we collect, what we don't, and why.
We read only public content
Our products read what's already public: a site's help center, its public pages, its robots and security surface. Nothing behind a login. We don't go looking for personal data, though a public page can contain some.
What we collect, and why
When you run a scan we keep the URL you entered, your email, and the result. If you tell us more (company, sector, role, a message on the contact or feedback form, a reason on the opt-out form), we keep that too. We also keep a salted hash of your IP address for rate limits, a record of the emails we send, and our services’ operational logs.
ContextScore emails you a link to your report. Safety Grade and the AI Crawler Check show your result on screen; we don’t email it. We keep your email to follow up about your report. If you tick the box on the form, we’ll also tell you about our services from time to time. You can opt out of those emails any time, and we delete what we hold about you on request. Anything we delete can stay in our backups and logs for up to 30 days.
A report link is a shareable token that does not expire: anyone who has it can open the report, until you ask us to delete your data. Treat it like a password.
In your browser
We set no cookies. If you switch between light and dark mode, your browser remembers the choice on your device; it isn’t sent to us. Fonts load from our own site. We count page visits with Cloudflare Web Analytics, which sets no cookies and doesn’t load for visitors in the EU. Report and share links run no analytics.
We don’t train on your data
We don’t train models on your content. ContextScore uses Anthropic’s API to score a scan; how Anthropic handles that content is set by its commercial terms. Your content produces your result.
During a scan we hold your pages temporarily, and they’re deleted when the scan finishes. The report keeps only the passages it cites as evidence. For product benchmarks we keep category-level outcomes keyed to a one-way hash of your domain: pseudonymous and domain-linked, not fully anonymous.
On engagements, we sign first
Consulting work runs under your NDA and MSA. Client data and IP are yours, kept only as long as the engagement needs, and handled on least-access terms.
Secrets stay in the environment
API keys and credentials live in managed environment variables, separated per environment, never in source control.
Questions about data handling, retention, or a specific engagement? Ask us directly.