Privacy Policy

Who We Are

Website Auditor, meaning website-auditor.io, its API, member portal, MCP server and browser extension, is operated by Armstrong HoldCo LLC, a company in the United States. Armstrong HoldCo LLC is the controller of the personal data this policy describes. You can reach us about anything in it at support@website-auditor.io.

Data Collection

We collect minimal data. Auditing a website through our website does not require account creation or login. Programmatic access through our API and MCP server does require an account and API key — see AI Tools & MCP Access below.

Your account: when you sign in with Google, we receive your name, email address, profile picture and Google account ID. When you sign in with an email link or a password, we receive your email address. We also keep your payment customer reference from Stripe, whether you have used a free trial, and what you add to your dashboard, such as your business name, competitors and the questions you track. An email address is required to create an account; without one we cannot provide account features.

Analytics

We use GoatCounter for analytics, which is privacy-friendly and does not use cookies. GoatCounter collects only aggregate usage data without tracking individual users.

AI Referral Counter (on Our Customers’ Websites)

Some of our customers add our AI referral counter to their websites, to see which of their pages AI assistants send people to. When you arrive at one of those websites from ChatGPT, Perplexity, Gemini, Copilot or Claude, a script on the page checks where you came from, any utm_source or utm_medium tag in the address, and whether the page was freshly opened, and sends website-auditor.io the name of the assistant and the page you landed on: only “/” unless the website has told us its pages aren’t about health or another sensitive subject, never the query string, and with parts of the address that look like IDs or codes removed. For any other visit it sends no count. It sends no count from sign-in, account, basket or checkout pages, and no paid ad clicks are counted.

The counter sets no cookies and creates no identifier. If you turn it off with the website’s opt-out link, it keeps a small note in your browser, on that website, for 13 months so it stays off; that note is never sent to us.

Every page that carries the counter loads its script from website-auditor.io, so your browser makes that request on each such page, whether or not you came from an assistant; when it sends a count, it makes one more. Like every web request, each one sends your IP address and browser type. Our code doesn’t read, log or keep them. Our network and hosting providers (Cloudflare and Google Cloud, both in the United States) process them only to deliver the request and keep their networks secure, under their own terms. We keep only daily totals per website, assistant and page, which contain no information about you, for 13 months.

We do this only on behalf of the website’s owner, who is the controller and decides whether to use the counter, under our Data Processing Agreement with them. We never use these counts for our own purposes, combine them with other data, sell them or share them. You can object on any website that uses the counter, free of charge, through its opt-out link or the statistics setting in its cookie preferences, and we honour Global Privacy Control signals. Because we hold no identifier, we cannot find “your” data; for other requests, contact the website’s owner, or us at support@website-auditor.io.

Bot Protection

To keep free audits available to everyone, we count audits run by visitors without an active subscription by a one-way, keyed fingerprint of your IP address, or of your network's IPv6 prefix, never the address itself, and keep that count for about a week. If a network runs many audits in a day, or on a machine's regular schedule, we may ask you to confirm you're a person with Cloudflare Turnstile. Only then does your browser load Turnstile from Cloudflare, which processes data about your browser and connection to tell people from automated scripts. See Cloudflare's Turnstile privacy addendum.

Audit Reports

When you audit a website, we store the report so we can show you the results. Reports expire after 90 days, and we keep at most the three newest reports for each website. Anyone with a report’s link can open it. To produce a report, we send the audited site’s address, and the business’s name and location, to the AI and data providers listed under Who Receives Your Data.

Businesses We Audit

An audit is about a business’s public presence, so it collects information about the business being audited, not only about you. The sources are the audited website itself, business listings from Google Places and Google’s Knowledge Graph (such as name, address and category), and what AI assistants answer when asked about the business. Where a business is run by an individual, some of this can be personal data.

We use it only to produce, store and compare audits, on the basis of our legitimate interest in providing an AI-visibility service, and keep it for the periods under How Long We Keep Data. To object, or to ask us to remove a business’s data, write to support@website-auditor.io.

AI Tools & MCP Access

Website Auditor is available as a Model Context Protocol (MCP) server and API, so you and the AI assistants you authorize can run audits programmatically. This works differently from our website, and this section explains how.

Account and API key: Unlike the website, API and MCP access requires a free Website Auditor account and a personal API key. We identify each request by that key so we can apply your plan, enforce quotas, and secure your account.

What we receive: When an AI client calls our MCP tools, we receive only the tool inputs — the website domain you want to audit, and for some tools items such as competitor domains. We do not receive your conversation history, prompts, or any other context from the AI application.

Local vs. hosted MCP server: The MCP server comes in two forms. The local server (installed via npm or as a desktop extension) runs on your own computer: your API key stays in your MCP client's configuration, and only the tool inputs described above ever reach our servers. The hosted endpoint (mcp.website-auditor.io) runs on our infrastructure: your MCP client sends each request, authenticated by your API key, directly to our servers, where it is handled under the same rules as an API request. In both forms we receive the same tool inputs and nothing more, and each request additionally records which of the two entry points it arrived through.

What we store: To operate the service we keep records tied to your API key, including the domains you audit, the resulting scores and reports, request timestamps, and basic usage telemetry (which MCP client and tool were used, whether the call succeeded, and how long it took). We use this to run and secure the service, enforce rate limits, apply your subscription, and improve the product. Our own records of API and MCP requests do not include your IP address. Our hosting and network providers keep short-lived logs that do, described under Who Receives Your Data.

Terms acceptance: When you start a subscription or free trial, we record that you accepted our Terms — the Terms version, when you accepted, and where (for example, the checkout page). We keep this record for as long as your account exists, as evidence of the agreement; it is deleted with your account.

Retention: We keep this data for as long as your account is active. You can revoke an API key at any time from your account to stop further use of it, and you can request deletion of your data by contacting us at support@website-auditor.io. We never sell this data, and we share it only with the service providers listed under Who Receives Your Data.

Third-party AI clients: The AI assistant or host application that connects to our MCP server is operated by a third party (for example, the AI platform you use). Anything you share within that assistant is governed by that provider's privacy policy, not ours.

Chrome Extension

The AI Visibility Score extension puts a site’s score on your browser toolbar. It is a different surface from this website, with different data flows, so this section covers it on its own.

What we receive: the domain of the tab you are on — example.com, never the full address, its path, or its query string — which is what a score is looked up by. Nothing on the page is read: the extension injects no code into the sites you visit, and it is permitted to contact exactly one server, api.website-auditor.io. Lookups are cached for 60 seconds per domain, so moving between tabs does not repeat them.

This applies signed out as well. Already-scored domains are served anonymously, so if the toolbar badge is on, a domain lookup reaches us whether or not you have an account.

How to stop it: turn off Show badge on toolbar in the extension’s Settings. With the badge off the extension makes no passive lookups at all — it stops before the network call, not after it.

Scans: a scan only ever starts when you open the extension’s panel yourself. The passive lookups behind the toolbar icon cannot trigger one, and they never spend from your allowance. If you have entered a market for that site — a city or country — it is sent with the scan request, so the questions are asked about the right place; nothing is sent when you have not entered one.

Pro tools in the panel: when you run a competitor comparison or a custom question from the panel, what is in its fields is sent to us: for a comparison, the site you are on, the competitor and the search term; for a custom question, the question and any business name and city. We may fill those fields in from the site’s audit, and you can change or clear them before you run it.

Signing in: from version 1.3.0 you connect the extension by signing in to your Website Auditor account, on our own sign-in page at api.website-auditor.io, which the extension opens in a Chrome window. It is the same sign-in and consent screen our AI-assistant connectors use, and a new account may be offered a free trial there; checkout for a trial is handled by Stripe, as it is on our website. The extension never sees your password, and it never signs in to or reads your Google account. What it receives is an access token, which lasts an hour, and a refresh token, which it uses to get a new access token and which stops working after 30 days without use.

What stays in your browser: those two tokens are held in Chrome’s local storage on this computer only; they are not synced to your other Chrome installations. Once you are connected, the extension also reads your account name, a partly hidden email address and your plan from us, to show who is connected. Those, your preferences, the market you enter for a site, and an API key if you connect with one instead of signing in, are held in Chrome’s synced storage, which means they travel to your other signed-in Chrome installations if you use Chrome Sync. The 60-second lookup cache lives in session storage and is discarded when you close the browser. None of these is readable by the websites you visit.

Your tokens or API key: sent only to api.website-auditor.io — the access token or key as a request header, the refresh token only to our sign-in service to renew or revoke it. The extension refuses redirects outright, so none of them can be forwarded to another server even if one were to ask.

Signing out: the extension deletes its tokens and asks us to revoke them, so they stop working at our end too; if we cannot be reached at that moment, they lapse on their own — the access token within the hour, the refresh token after 30 days unused. Signing out also removes your account name, email and plan from the extension. An API key you pasted is removed from the extension’s synced storage, so from your other synced Chrome installations too; the key itself keeps working elsewhere until you revoke it in the member portal.

Earlier versions: before 1.3.0 the extension could also collect a new API key for you after you pressed the connect button in the member portal, so the key was never shown on screen or put on your clipboard. That one request carried your sign-in session cookie for api.website-auditor.io instead of an API key, went to that same single server with redirects refused, and happened only when you had asked for it. Version 1.3.0 no longer makes that request.

Once a request reaches us it is handled exactly as described under AI Tools & MCP Access above — the same records, the same retention, and the same commitment never to sell it.

Emails We Send

When you create an account, including by connecting Website Auditor from ChatGPT, Claude or another AI assistant, we use your email address to write to you. There are two kinds of email.

Account and service emails: sign-in links, trial and renewal reminders, and security notices. These are part of the service while you have an account. Payment receipts and invoices may come from our payment processor, Stripe, under Stripe’s privacy policy.

Product emails: occasional messages about Website Auditor features you can use, such as a preview of your site’s AI-visibility results. Every product email has an unsubscribe link. One click stops them, and it does not affect your account.

Who handles your address: we use an email delivery provider only to send our messages, and it may not use your address for anything else. We never sell your email address or share it for anyone else’s marketing. To stop all email, delete your account or write to support@website-auditor.io.

Cookies and Browser Storage

We use no tracking or advertising cookies. What we do store on your device:

• Sign-in cookie on api.website-auditor.io: keeps you signed in to the member portal, and expires after 24 hours. It is strictly necessary for signing in.
• Session storage in the member portal: remembers which kind of link brought you (for example, from ChatGPT or our WordPress plugin), so the portal can show the right next step and we can count arrivals by source, and remembers a checkout in progress. It is cleared when you close the tab.
• Local storage on report pages: keeps your own review or chat on a report in your browser, so it is still there when you come back. It never leaves your device.
• Browser extension storage, described under Chrome Extension.

Why We Use Your Data

The laws of the EU, the UK and some other places require us to say on what basis we use personal data:

• To provide the service you asked for (performance of a contract): your account and sign-in, API and MCP access, the browser extension, subscriptions and free trials, and account and service emails.
• Our legitimate interests in running a secure, reliable service, understanding how it is used, producing audits of businesses’ public AI presence, and telling account holders about features they can use: bot protection, security reports, request records and usage telemetry, aggregate analytics, audits of businesses, and product emails where the law allows them without consent. You can object to any of these at any time.
• Legal obligations: keeping billing and tax records.
• Your consent, where the law requires it, for example for product emails in some countries. You can withdraw it at any time with the unsubscribe link.

Who Receives Your Data

We do not sell your data. We share it only with service providers that process it on our instructions to run Website Auditor:

• Google Cloud (hosting) and Supabase (database), both in the United States
• Cloudflare (network delivery and security, and Turnstile, described under Bot Protection)
• Google (sign-in, and the Places, Maps, Knowledge Graph and PageSpeed data used in audits)
• OpenAI, Anthropic, Google (Gemini) and Perplexity: the AI assistants an audit asks about a business. They receive the business and the questions asked, not your account details.
• Stripe (payments). Stripe also acts on its own account for payment data, under Stripe’s privacy policy.
• Mailgun (email delivery)
• GoatCounter (cookieless, aggregate analytics)

Our hosting and network providers keep request logs that include IP addresses, for security and troubleshooting, for up to 30 days, except for the AI referral counter’s requests, which we exclude from our hosting provider’s logs (see AI Referral Counter). We may also disclose data where the law requires us to.

International Transfers

We are based in the United States, and our servers are there, so personal data from the EU, the UK and Switzerland is transferred to the United States. Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension and the Swiss-US framework), we rely on that certification. Otherwise we rely on the European Commission’s Standard Contractual Clauses and the UK’s International Data Transfer Addendum. For the AI referral counter, our Data Processing Agreement with each website owner includes those clauses. You can ask us for a copy of these safeguards.

How Long We Keep Data

• Your account, its API keys, dashboard and Terms acceptance record: while your account exists, then deleted within 30 days of its deletion.
• Audit reports: 90 days, and at most the three newest for each website.
• AI referral counter totals: 13 months, and deleted within 30 days of a website being removed from its owner’s account or the account being deleted.
• Bot-protection counts: about a week. Security-report fingerprints: about three days.
• Our request records and usage telemetry: up to 12 months.
• Providers’ request logs with IP addresses: up to 30 days.
• Billing and tax records: up to 7 years, as tax law requires, including after an account is deleted.
• Email unsubscribe records: kept so we go on honouring them.

Your Rights

If you are in the EU, the UK or Switzerland, and in many other places, you have the right to:

• get a copy of your personal data, and have it corrected or deleted;
• restrict how we use it, and receive it in a portable format;
• object to our using it on the basis of legitimate interests, and object at any time to direct marketing, which we will then stop;
• withdraw consent you have given, without affecting what we did before.

To use any of these rights, write to support@website-auditor.io. We reply within one month. You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office; in the EU, the authority of the country you live or work in.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Children

Website Auditor is a business tool and is not directed at children under 16. We do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes to This Policy

When we change this policy, we update the date at the top. If a change materially affects how we use your personal data, we will tell account holders by email before it takes effect.

Security

All communications with Website Auditor use HTTPS encryption. We take reasonable measures to protect the integrity of our service.

If your browser blocks something on our pages under our security policy, it sends us a report of what was blocked. To tell a problem in our site from one visitor's browser extension, we note which reports came from different visitors using a one-way, keyed fingerprint of your network that changes every day, never the address itself, so a day's fingerprint can't be linked to another day's. We delete each fingerprint within about three days and keep only the number of visitors.