What we collect, and what we do with it
Nomada Digital Ltd, company number 12869202
What we collect
When you run a scan we store the domain you entered. If you ask for a walkthrough or a demo, or ask us to email the result to you while the scan is still running, we store the email address you gave, and nothing else about you. We do not ask for a name, a company, a phone number or a card. The contact form collects what you type into it. We also store a salted one-way hash of your IP address, to stop one visitor running the scan hundreds of times - the address itself is never written down, and the hash cannot be turned back into it.
Why we collect it
The email address exists so we can send you the link back to your report, and so a scan can be reclaimed if nobody opens it. An address given to have the result emailed is used for that one message and creates no account. An address given for a walkthrough or a demo is passed to Danny at nomada digital, who uses it to send you the video or arrange the call. Our lawful basis is legitimate interest in responding to a request you made. We do not add you to a mailing list, because there is not one.
How long we keep it
Scan results are kept indefinitely, so you can come back to the link, and so is what each engine said. We used to delete the text after seven days on a scan nobody claimed; we do not any more. It is the evidence behind every figure in your report, and a number you cannot read back to the words that produced it is not evidence. On a tracked account, every daily answer is kept for the life of the account, and you can download it from the dashboard. The dashboard also records which of its features are used - which page was opened, which control was pressed - to improve it; it stores ids and counts, never what you type.
Who else sees it
The scan runs through DataForSEO, which queries the engines on our behalf - your domain and the generated questions pass through it, your email address does not. Anthropic reads the text of the site being scanned and writes the questions. Cloudflare runs the robot check in front of a scan, and we pass it your IP address so it can do that. Email is sent through Resend. Hosting is Vercel, and the database is Supabase, in London. To say how hard each placement on a report would be to land, we look up the cited sites' domains on a link marketplace - only those domains, nothing about you.
Cookies and tracking
This site sets no cookies of its own, with one exception: when a client signs in to their alwaystracked dashboard, we set one login cookie so they stay signed in. It holds a random key and nothing else, lasts 30 days, is cleared when they log out, and is never set on any other visit. The site runs no third-party analytics - there is no Google Analytics, no tag manager, and no advertising pixel. The dashboard's feature counts, described above, are our own and go to no third party. The one third-party script the page loads is Cloudflare Turnstile, which checks you are not a robot before a scan runs - usually without showing anything - and it sets storage of its own to do that.
Your rights
You can ask what we hold, have it corrected, have it deleted, or object to us holding it at all. We will do it within a month and usually the same week. Deleting your email address deletes the link to your report with it.
To ask what we hold about you, to have it corrected, or to have it deleted, email hello@alwayscited.com. If you are not satisfied with how we handle it you can complain to the Information Commissioner's Office at ico.org.uk.