Privacy

This page covers this site, the waitlist for the free scan and purchases. The free scan will get its own notice before it opens. This site sets no cookies and uses no local storage.

Who is responsible

Joel Merrick, trading as Dummy Run, decides why and how your data is used. He is the controller under UK GDPR. You can reach us at [email protected].

What we collect

• Your email address.
• Your role and the site address you would scan, if you choose to give them.
• The version of the agreement text you saw and the time you agreed.
• The page you signed up on.
• The time you confirmed your address.

We also use your IP address to limit repeated sign-ups. We keep only a one-way hash of it, in a counter that counts for one hour and is deleted within a day. We do not store it with your entry.

Why we use it

We use it to send you a confirmation email and one email when the free scan opens. We do not use it for anything else. We do not sell it or share it for advertising.

Our lawful basis

For the waitlist, consent. Under Article 6(1)(a) of the UK GDPR you agree by ticking the box and selecting the link in the confirmation email. You can withdraw consent at any time.

How long we keep it

• An entry you have not confirmed is deleted 9 days after you sign up. The link lasts 48 hours and we keep the entry 7 days longer.
• A confirmed entry is deleted 24 months after you confirm, unless you reconfirm when we ask.
• When you unsubscribe we delete your entry. We keep a salted one-way hash of your address so that we do not email you again. It cannot be turned back into your address.

Who else handles it

• Cloudflare hosts this site and runs the sign-up service, its database and the Turnstile human check.
• Resend sends our emails. It is a US company, so your address leaves the UK when we send you an email. Its data processing terms use standard contractual clauses with the UK addendum. Resend also says it follows the EU-US Data Privacy Framework and its UK Extension. These are safeguards the UK GDPR allows.

Analytics

We count visits with Cloudflare Web Analytics. It sets no cookies and uses no local storage. Cloudflare processes your IP address to receive the request. It does not use it to track individuals. Our lawful basis is legitimate interests under Article 6(1)(f): we want to know which pages people read. We keep no personal data from it ourselves. Cloudflare shows us only totals.

Payments

Paid services are sold through Paddle.com, which is the merchant of record. Paddle takes your payment details and sends us your name, email address and country and what you bought. We never see your card number. Our lawful basis is contract under Article 6(1)(b) and legal obligation under Article 6(1)(c) for tax records. We keep order records for as long as the law requires them for tax. Paddle is also a controller of that data. Read Paddle’s privacy notice.

Your rights

You can ask to see your data, correct it, delete it or restrict its use. You can object to its use and you can withdraw consent. Write to [email protected]. You can also complain to the Information Commissioner’s Office at ico.org.uk.

How to unsubscribe

Every email from us has an unsubscribe link. Select it and we remove you at once.