Privacy

Controller

Graidlab

Contact

weare@graidlab.com

We do not run analytics, advertising, session recording or fingerprinting on this site. There is no tracking script to disclose because there is no tracking script.

• The web address you submit, and everything publicly served from that site when we read it: page text, headings, markup, images, response headers and timings.
• A one-way hash of your IP address, used only to enforce the limit on how many scans one visitor can start per hour. The address itself is never written to the database — it is hashed with a server-side secret before storage, and the hash cannot be turned back into an address.
• Your email address, if and when you give it to us to receive a report link or a receipt.
• Technical logs from our hosting providers, which may briefly contain IP addresses as part of ordinary server operation.

• Running the analysis you asked for and delivering the report: performance of a contract with you.
• Rate limiting and abuse prevention: our legitimate interest in keeping the service available and our costs bounded.
• Accounting records for a purchase: a legal obligation.

We store what a finding needs in order to show its evidence — the exact paragraph, the missing tag, the number measured on the page — along with the address and basic metrics of each page we read. We do not keep a copy of your site. That content belongs to whoever published it. We do not sell it, do not publish it, and do not use it to train models.

Content read from your site is sent to Anthropic and to answer-engine providers as part of producing the report, as set out below. Only the extracted text needed for a given assessment is sent, never credentials or anything behind a login, because we never have any.

Supabase

Database and storage. EU region (Ireland).

Vercel

Website hosting.

Railway

The worker that runs analyses.

Anthropic

Assessment and fix generation. United States.

OpenAI

Answer-engine measurement. United States.

Perplexity

Answer-engine measurement. United States.

DataForSEO

Answer-engine measurement.

Transfers outside the EU rely on the European Commission's standard contractual clauses or an equivalent mechanism offered by the provider.

Expiry is enforced by a job that runs hourly, not by hand.

• Free reports and the evidence behind them: 14 days from completion.
• Paid reports and the evidence behind them: 24 months from payment.
• Rate-limit hashes: deleted with the records of the analysis they belong to.
• Accounting records for a purchase: for as long as Czech law requires.

One cookie, named NEXT_LOCALE, remembering which language you chose. It is strictly necessary for the site to serve you the right language and carries no identifier. That is the entire cookie list, which is why this site has no cookie banner.

You can ask for a copy of what we hold about you, ask for it to be corrected or deleted, object to processing based on legitimate interest, or ask for a portable copy. Write to us and we will answer within one month.

You can also delete a report yourself by letting it expire — we do not need to be asked. At expiry we delete everything the report was made of: the pages we read, the findings, the answer-engine results and the competitor list. What stays is the record that an analysis was run — the address, the date and the score — so the link can say the report has expired rather than that it never existed, and so a purchase still has an accounting trail.

If you think we have handled your data badly, tell us first. You also have the right to complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz), or to the supervisory authority where you live.