Terms of service

These terms govern the use of Page Lookout, a service provided by Natcroft Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, registered in England and Wales under company number 17165895 ("we", "us"). They apply between us and the organization that uses the service (the "customer"), and to every person the customer invites.

By creating an organization or accepting an invitation, you accept these terms on behalf of the customer and confirm that you may do so. The service is intended for businesses and other organizations, not for consumers.

In these terms:

• An organization is the customer workspace in the platform. Its administrators manage sites, members, roles, API keys, alerts and webhooks; its members use the sites they are given access to.
• A site is a website the customer adds to its organization. A scan is one run of the scanner over a site's pages.
• A finding is one observation from a scan, with its evidence and a suggested next step.

Page Lookout scans the customer's websites on a schedule and on demand, and reports what it found. A scan is made of independent modules:

• Security baseline: transport and response header basics.
• Performance: how fast pages load and what slows them.
• SEO: the technical signals search engines read.
• Accessibility: the checks that can be automated, with the elements that fail them.
• Consent: what a page does before any choice on its cookie banner, after Reject all and after Accept all, and the inventory of third parties, cookies and storage it used.
• Visual changes: screenshots of chosen pages compared with an accepted reference image.
• AI search: how pages present themselves to AI assistants and answer engines.

Results are shown in the platform and are also available as PDF reports, e-mail alerts, webhooks and through the API. The modules available to an organization depend on its plan and on what we have switched on for it.

Since 18 October 2026 the service has been available by invitation only. During this soft launch features may change, be added or be withdrawn, and we may limit the number of organizations, sites and scans.

Sign-in is handled by our authentication provider, Clerk. An account belongs to one person and must not be shared. Administrators decide who joins the organization, with which role and access, and are responsible for removing people who should no longer have access.

The customer is responsible for everything done through its organization's accounts and API keys. Keep API keys secret, and revoke a key at once if you believe it has been exposed.

You may add to the service only websites that the customer owns, or that their owner has authorized the customer to have scanned. By adding a site you confirm that authorization, and that the scans you configure stay within it.

A scan behaves like a visitor with a browser: it requests pages, runs their scripts, may press the buttons of a cookie banner (such as Reject all and Accept all) and, with the visual module, takes screenshots. A website may record those presses like any visitor choice. Scan requests carry a User-Agent that contains PageLookout, and a scan stays within the limits of the plan and of the site scan policy.

The scanner signs in to nothing, does not try to get around access controls and does not exploit vulnerabilities. It is not a penetration test.

The customer is responsible for the consequences of having a website scanned without authorization. We may pause or remove a site if we have reason to believe its scans are not authorized.

When using the service, you must not:

• scan a website without the authorization described above;
• use the service to overload, disrupt or attack any website or system;
• try to access another organization's data, or get around the service's limits, rate limits or security;
• share accounts or API keys with people outside your organization;
• use the service for anything unlawful.

The service applies rate limits and request size limits, and refuses requests above them. We may suspend a site, an API key or an account that breaks these rules or endangers the service or anyone else, and we will tell the organization administrators why, unless the law prevents us.

The customer keeps all rights in its site configuration and its scan results. We use them only to provide, secure and support the service, and we do not sell them.

Where we process personal data on the customer's behalf, our data processing terms apply; we send them on request to office@natcroft.com. Our Privacy policy describes the data we process for our own purposes and how long it is kept.

The customer can download its findings and reports from the platform and through the API at any time.

Findings describe what a scan observed at one moment, with the evidence behind it and a suggested next step. They are technical information. They are not legal advice, not a legal opinion, not a certification and not a statement that a website satisfies any law or standard.

A scan can miss problems, and some findings need a person to confirm them. The Health number points to where to look first; it is not a grade of the website. Decisions taken on the basis of findings are the customer's own.

During the soft launch the service is provided as it is, without a service level agreement and without guaranteed availability. Scans can be delayed or fail, and we may interrupt the service for maintenance and changes. We make reasonable efforts to keep it running and, where we can, tell administrators in advance about maintenance that will interrupt it.

Fees are those agreed in the order for the organization. We invoice monthly, and invoices are payable within 14 days of their date.

Nothing in these terms limits liability that cannot be limited by law. Subject to that, our total liability to a customer for all claims in any 12 months is limited to the fees the customer paid for the service in those 12 months.

We may change these terms. We tell organization administrators by e-mail at least 30 days before a significant change takes effect. A customer that does not accept the change may stop using the service and ask us to delete its organization.

The customer may stop using the service at any time and ask us to delete its organization by writing to office@natcroft.com. We may end the service for an organization with 30 days' notice, or at once for a serious breach of these terms.

When an organization is deleted, we stop its scans, revoke its API keys and invitations, switch off its webhooks, and delete its sites, scan results, stored files and memberships, then check that nothing is left. Backup copies expire within 14 days, plus 7 days of point-in-time recovery data. Download anything you want to keep before asking for deletion.

These terms are governed by the law of England and Wales. Disputes are settled by the courts of England and Wales. Questions about these terms go to office@natcroft.com.