Website Check privacy notice

What the check reads

When you check a website, we read only public information about that website, the way a browser or an email server would:

• the home page, up to two linked contact or booking pages, and the site's robots.txt (we follow it);
• on WordPress sites, the news feed, the REST API index and the theme style files that those pages link to;
• the site's security certificate, its domain registration record and its public DNS records (name servers, mail servers, SPF and DMARC).

Our checker identifies itself as PupPilotSEOBot. It does not log in, run attack tests or change anything on the site.

What we keep

Check results. For each check we store the website address, the clinic name shown on the site, the website platform and software found, the results, and any email addresses the website itself publishes on those pages. We use the published addresses only to decide where the full details may be sent. We delete check results after 90 days. If anyone checks the same website within 1 hour, they see the same stored summary.

Details requests. When you ask for the full details, we store the email address you enter, the website it is for, when we sent the email and when the link was first opened. The link in the email works for 30 days. We do not store the link itself, only a one-way scrambled copy (a hash) that lets us recognise it. We keep details requests as sales leads until you ask us to delete them.

What we do not keep. We do not ask for your name. We use your IP address, and the anonymous user ID that ChatGPT sends, only in our server's memory to limit how many checks one person or network can run per hour. We do not save them with check results or details requests.

Cookies. The Website Check pages set no cookies and use no analytics or tracking. They load fonts from Google Fonts, so your browser connects to Google to download them.

How we use it

• To run the check and show you the summary.
• To email the full details, only to an address at the checked website's domain or one the website publishes. We send the full details for a website at most once every 7 days.
• The first time someone opens a details link, we post a note in our internal Slack workspace for our team: the clinic name, the website, its platform, the number of issues found, the top issue and the email address. Our team may contact you about the results and send you information about PupPilot's services.

We do not sell your data and we do not use it for advertising.

Who handles it for us

• Microsoft Azure hosts the service and its database in the United States and sends the details email (Azure Communication Services, data stored in the United States).
• Slack carries our internal team note described above.
• ChatGPT and Claude. If you use the check inside ChatGPT (OpenAI) or Claude (Anthropic), your chat is handled under their own privacy policies. We receive only the website address you ask about, plus, from ChatGPT, an anonymous user ID used for the hourly limit.
• Public data sources. We download vulnerability and release data in bulk from Wordfence, CISA, endoflife.date and WordPress.org. For WordPress sites we look up the public names of the plugins we found at WordPress.org. We never send these sources your email address or the address of the site you checked.
• Domain records. To read a domain's registration record we send the domain name to rdap.org, which asks the domain's registry.

Your choices

• To delete a details request or a check result, or to ask what we hold about you, email support-website-check@puppilot.co.
• If you received a details email you did not ask for, you can ignore it. We send nothing more unless the link is opened.

Changes

When Website Check changes how it handles data, we update this page and the date at the top.