Privacy Policy

Headnoted is operated by Digital Brainwave Technologies Limited (company number 15890629), 149 High Street, Glasgow, G1 1PH, United Kingdom. We are responsible for personal information we process to operate Headnoted. To ask a privacy question or exercise your rights, use our contact form, identifying your request as a privacy request.

Information we process

• Accounts: your name, email address, password hash and account settings. If you choose Google sign-in, we receive the identity information needed to connect your Google account.
• Checks and audits: the URL you submit, fetched page content, robots.txt and sitemap files and technical signals, scan times, scores, recommendations, search queries and search results from the visibility test, generated files and errors. Page content can include personal information published on the website you ask us to analyse. Avoid submitting URLs containing private tokens or confidential information.
• Reports: the report owner where applicable, sharing token and public/private setting, and the history needed to display reports and count subscription usage. Anonymous reports are associated with your browser session and may be claimed when you sign in.
• Payments: Stripe customer, checkout, payment and subscription identifiers, amounts, currency, payment status, billing periods and receipt links. Stripe collects payment details directly; we do not receive your full card number.
• Support and communication: messages and attachments you send us, replies, notification preferences and newsletter subscriptions where requested.
• Security and operation: requests, IP addresses, browser information and logs needed for authentication, abuse prevention, troubleshooting and service operation. Optional analytics is subject to the choices described in our cookie policy.

Why we use information

We use account, scan and payment information to provide the service you request and administer our contract with you. We use security, diagnostic and limited operational records for our legitimate interests in protecting and operating the service, investigating faults and preventing abuse. We retain records where needed to meet legal obligations, including accounting and responding to valid legal requests.

We ask for consent for optional analytics and advertising storage and for marketing subscriptions where required. You can change cookie preferences or unsubscribe from marketing. Essential service messages, such as payment or security notices, are separate from marketing. Where a lawful basis depends on the circumstances of a particular request, we can explain that basis when you contact us.

Public reports

Reports are public to anyone with their share link by default. That includes available PDF downloads and, after an extensive audit, the additional findings and fix pack. Search-engine exclusion is requested, but it is not access control and cannot prevent copying or sharing.

An account lets you manage sharing and delete eligible reports. Private reports require owner access. Changing sharing cannot remove copies someone already saved. Do not include confidential content in a public scan.

Service providers and AI processing

We use hosting, database, email and security providers to operate the service. Stripe processes payments. Google provides optional sign-in. Cloudflare Turnstile provides bot checks where configured. Consent-based services can include Google Analytics, PostHog, Tawk.to chat and advertising measurement, as described in our cookie policy.

When an extensive audit includes AI features, we send relevant website text, URLs, brand information, search queries and scan findings to Anthropic’s Claude API to choose search queries, generate analysis, draft page rewrites and write an action plan. The search visibility test and brand search run those queries through Claude’s live web search. The free SEO check does not require Claude. AI features are shown as available only when configured. Do not submit information you are not entitled to have processed in this way.

Providers process information under their applicable terms and data-protection arrangements. Provider locations may include countries outside the UK. Contact us for information about the providers, locations and transfer arrangements applicable to your data. We do not promise that data stays exclusively in the UK or that a provider never retains a request.

We may also disclose information where required by law or necessary to protect legal rights, prevent fraud or respond to a security incident.

Retention and deletion

We keep account information while your account exists. Reports remain available until deleted or removed under our retention and service processes; anonymous reports are not automatically erased when a browser session ends.

Deleting a report hides it and preserves a deleted record for subscription-usage integrity. Deleting your account removes its owned reports through the account deletion process. Payment and subscription records may remain for accounting, dispute handling and legal obligations, with their account relationship removed. Copies held by payment providers are subject to their own retention duties. Security logs and backups follow their operational retention cycles; deletion from the live service does not immediately remove every backup copy.

For historical data from the predecessor service, within 30 days of the deletion we permanently erase the abandoned organisation’s links and visits. Link codes are retained as non-reusable tombstones so someone else cannot take them over. Historic visit records may include country, region and city, and older records may still contain coordinates; we do not claim that those historic coordinates have been removed. These records are not a feature of the current SEO checker.

Where information must be kept to meet a legal obligation or resolve a dispute, we retain it for that purpose rather than promising immediate erasure. Contact us for the retention criteria applicable to a particular record or to request deletion of an anonymous report.

Your rights and choices

Depending on applicable law, you may request access, correction, erasure, restriction or portability of your personal information, and object to processing based on legitimate interests. You can withdraw consent without affecting processing already carried out lawfully. We may need to verify your identity before acting on a request.

Use our contact form to make a request. We respond within applicable legal time limits and explain any lawful exception. You can also complain to the UK Information Commissioner’s Office or the relevant supervisory authority where you live.

Security and changes

We use access controls and other safeguards to protect information, but no online service can guarantee absolute security. Keep your account credentials and private report information secure.

We publish updates to this policy with a new date and communicate material changes where appropriate. Historical versions and acceptance records are retained. Please contact us if you need an accessible copy or an explanation of any part of this policy.