Privacy policy

This policy is issued by Natcroft Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, registered in England and Wales under company number 17165895 ("we", "us"). It covers this website, pagelookout.com, and the Page Lookout platform at platform.pagelookout.com.

For questions about this policy or about your data, write to office@natcroft.com. To report a security issue, write to office@natcroft.com.

We have not appointed a data protection officer. For anything about your personal data, write to office@natcroft.com.

For the people who visit this website, write to us or hold an account on the platform, we decide why and how their data is processed, and we are its controller.

Our customers use the platform to scan their own websites. The results can incidentally contain personal data that appears on those websites, for example a name in a page address, a cookie name chosen by the website, or a person visible in a screenshot. We process that data on the customer's behalf and on its instructions, as its processor, under the data processing terms referred to in our Terms of service. Questions about such data are best sent to the owner of the scanned website.

This website is a set of static pages served by Firebase Hosting, a Google service. It sets no cookies, uses no analytics, and loads no scripts, fonts or styles from other services, except the anti-bot check on the contact form described below.

To deliver a page, the host processes the technical details that every web request carries, such as your IP address, the address requested and your browser user agent. We do not use them to identify or profile you.

When you send the contact form, your name, e-mail address, company, reason for contact, message and the page language go to our own server on Google Cloud (europe-west1, Belgium), which forwards them to us as an e-mail through Resend. The server does not store your enquiry; its request logs contain no form content. To keep automated spam out, the form uses Cloudflare Turnstile: when you start filling in the form, your browser loads a check from Cloudflare, which processes technical details such as your IP address and browser characteristics to tell people from bots.

When you write to us, we receive your name, e-mail address, company and message, and use them to answer you. Our mailboxes are provided by Google (Google Workspace).

If you use the platform, we process:

• Account data: your name, e-mail address and an internal identifier, the organizations you belong to, your role in each (administrator or member) and, where your organization uses access groups, which sites you can see.
• Sign-in data: sign-in is handled by Clerk, which holds your e-mail address, name, sign-in method and sessions and tells the platform who you are. We never receive your password.
• Invitations: the invited e-mail address, the role and access offered, who sent the invitation and its status. The invitation link carries a secret token, and we store only a one-way hash of it.
• API keys: the name of each key, who created or revoked it, and usage counters. We store only a one-way hash of the key itself.
• An activity record: significant actions taken in the platform, such as changes to sites, settings, members and API keys, with the time, the action, the organization and the internal identifier of the person who took it. It is designed to leave out e-mail addresses, web addresses and secrets.
• Usage details: which person started a scan and when, and which product tours you have finished or dismissed.
• Request logs: our servers log each request to the platform, including the IP address and browser user agent of the caller, the time and the result. Our application logs are designed to leave out e-mail addresses, tokens and the content of scan results.
• E-mail: invitation e-mails and the alert e-mails your organization sets up are sent through Resend, which processes the recipient address and the message.

A scan visits pages of a customer's website much as a browser does and stores what it observed: the addresses of the pages it found and scanned, findings with their evidence (for example a response header, a page title or an element that failed a check), the raw output of the scanning tools, PDF reports and, where the visual module is used, screenshots of the pages the customer chose.

The consent module records the third-party domains a page contacted, the names and domains of the cookies it set and the names of the storage keys it used. It records names only, never the values of cookies or stored items.

Scan results belong to the customer's organization. Its members see them according to their role and access, and the customer decides which websites are scanned. If the organization configures webhooks, we send event data to the addresses its administrators choose.

• Providing the platform (accounts, sign-in, invitations, scans, reports, alerts and webhooks): performance of our contract with the customer and, for the customer's members, our legitimate interest in providing the service their organization uses (Article 6(1)(b) and (f) GDPR).
• Keeping the platform secure, preventing misuse and keeping a record of actions taken on customer data: our legitimate interests in security and accountability (Article 6(1)(f) GDPR).
• Answering messages you send us: our legitimate interest in replying, or steps you ask us to take before a contract (Article 6(1)(f) and (b) GDPR).
• Meeting our legal obligations, for example in accounting: Article 6(1)(c) GDPR.

We do not sell personal data, we do not use it for advertising, and we do not make decisions about people based solely on automated processing.

The platform runs on Google Cloud in the europe-west1 region, in Belgium: the application, the database, the file storage for scan artifacts and screenshots, the backups, and the logs and metrics. We use these service providers:

• Google Cloud: hosting of the platform, its database, file storage, backups, logs and metrics, in the europe-west1 region (Belgium), and Firebase Hosting for this website, including the server that forwards contact form messages.
• Clerk: sign-in and session management for the platform. It holds the e-mail address, name and sessions of each account.
• Resend: delivery of invitation and alert e-mails, and of the messages you send through the contact form. It processes the recipient and reply-to addresses and the content of each message.
• Cloudflare: the Turnstile anti-bot check on the contact form. It processes your IP address and technical details of your browser while the check runs.
• Google (Google Workspace): our own mailboxes, for the messages you send us.

Each of them processes data on our behalf under a data processing agreement. Clerk, Resend and Cloudflare are based in the United States, so data they process may be transferred outside the European Economic Area. Such transfers rely on the safeguards each provider offers: the UK International Data Transfer Agreement or Addendum and the European Commission's standard contractual clauses.

The periods below are the platform's defaults. Where a period can be set per organization, the customer's plan may set a different one, between 1 and 365 days, and a change applies to scans started after it.

• Raw scanning tool output and PDF reports: 60 days after the scan.
• Screenshots and other visual comparison images: 90 days after the scan. A screenshot that is a page's accepted reference image is kept while it remains the reference, and for at least 7 days after it is replaced.
• Per-page consent observations: 30 days after the scan ends. The combined inventory of a scan is kept with the scan.
• Scan history, findings, comparisons and alerts: for as long as the site and the organization exist in the platform.
• Records of sent alert e-mails and webhook deliveries: 90 days.
• Invitations: valid for 7 days, and deleted 30 days after they were accepted, revoked or expired.
• Accounts: while you are a member of at least one organization. An account with no organization is deleted 30 days later.
• API key usage counters: 31 days.
• Request logs: 30 days.
• The activity record: kept without a fixed end date, because it is the record of what happened to customer data. When an account is erased, its entries stay without the link to the person. We will review this period if the record grows large.
• Backups: daily backups are kept for 14 days, plus 7 days of data for point-in-time recovery. Deleted data can remain in a backup until it expires. If we ever restore a backup, we apply again every deletion made since it was taken.
• Messages you send us: 24 months after our last exchange.

Clerk, Resend and Cloudflare keep data under their own retention settings. When a person is erased, we delete their data there as well.

When a customer asks us to delete its organization or one of its sites, we first stop all scans and integrations for it, then delete its stored files and its records, and check that nothing is left. The activity record stays, as described above.

When a member is removed from their last organization, their account is deleted 30 days later unless they join an organization again. When a person asks to be erased, we delete their account from the platform and from Clerk and, where the request requires it, the copies of e-mails sent to them that Resend keeps.

This website sets no cookies and stores nothing in your browser. The Cloudflare Turnstile check on the contact form runs in a frame served by Cloudflare; Cloudflare states that it does not use cookies to track visitors.

The platform uses only what it needs to work:

• Cookies set by Clerk that keep you signed in.
• A cookie named sidebar_state that remembers whether the side menu is open, for 7 days.
• In your browser storage: the last organization you opened and, for the current tab only, unsaved form drafts and a pending invitation.

None of these is used for analytics or advertising, and the platform loads no analytics.

Under the GDPR you can ask us for access to your personal data, for its correction or erasure, for restriction of its processing and for a copy in a portable format, and you can object to processing based on our legitimate interests.

To do so, write to office@natcroft.com. We answer within one month and may ask you to confirm your identity. If your request concerns data in a customer's scan results, we will refer you to that customer, who decides about it.

You can also lodge a complaint with a data protection supervisory authority, in particular the Information Commissioner's Office (ico.org.uk) in the United Kingdom, or the authority of the country where you live or work.

Traffic to the platform is encrypted with HTTPS. Each organization's data is kept separate and is visible only to its members, according to their role. Our staff can access customer data only to run and support the service, and their actions are recorded in the activity record. The Security and privacy page describes how the scanner behaves and how organizations are kept apart.

We update this policy when what we do changes, and change the date at the top. If a change is significant, we tell organization administrators by e-mail before it takes effect.