Privacy

You paste a public web address. The reader fetches that site's public pages and checks them. Nothing about your firm's private systems is read, and no personal data is asked for unless you choose to create an account to save a report.

What is read

The homepage of the address you give, up to nine internal pages of the same domain chosen by their links and headings, and the site's robots.txt and llms.txt. These are public pages. Nothing behind a login is read, and no credentials are ever requested.

Where it is kept and who can see it

Pages served by Cloudflare; saved reports and accounts in Supabase in Sydney (AWS ap-southeast-2), encrypted at rest and in transit; payments by Stripe; sign-in and receipt mail through SendGrid; those four are the only processors. Saved reports are kept until the user deletes them or closes the account. Support opens a saved record only on the user's request.

What is not done

No model is called at any point in the audit. The checks are deterministic and the same address gives the same score. Reports are not sold, shared or used to train anything. Email addresses found on a page are removed before a report is saved.

Contact

Write to support@theartofservice.com to ask what is held about you or to have it deleted.