Privacy

What we collect

• Your email address and website — to run the research and send you the result.
• Billing details (name, address, VAT number where given) — collected and stored by Stripe to issue a valid invoice. We never see or store your card number.
• Usage and advertising identifiers — if you accept analytics or advertising cookies. Details below.

We do not ask for, and do not want, access to your systems, logins or customer data. The research uses public sources only.

Why we are allowed to use it

• Performing our contract — producing and delivering what you asked for, and taking payment.
• Legal obligation — Dutch law requires us to keep invoices and tax records for 7 years.
• Your consent — analytics and advertising cookies, and marketing emails. Marketing email starts only after you tick the box and then confirm through the link in your findings email. Every marketing email has a one-click unsubscribe link, and you can withdraw consent at any time.
• Legitimate interests — keeping the service secure and preventing abuse.

Cookies and advertising

Nothing that is not strictly necessary runs until you choose. If you accept:

• PostHog (EU-hosted, Germany) shows us which pages people use.
• Meta receives a record of your visit and of a purchase, so we can tell which adverts work. Identifiers such as your email address are hashed in your browser before they are sent. Meta is a joint controller for this measurement; you can object at any time by rejecting advertising cookies.

Reject either and the service still works exactly the same. We do not use consent walls.

Who else processes your data

• Cloudflare — hosting and the database (EU).
• Stripe — payments, invoicing and VAT determination.
• Resend — sending your report (EU region).
• Anthropic — the AI models that perform the research.
• PostHog and Meta — only with consent.

Some of these are US companies. Transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses.

How long we keep it

• Invoices and tax records: 7 years (legally required).
• Reports and the research behind them: 24 months, then deleted.
• Leads that never became customers: 12 months, unless you confirmed marketing email.
• Proof of your marketing-email consent: 5 years after the last email we sent you, as the Dutch regulator (ACM) expects. It records the wording you agreed to, when you confirmed, a salted hash of your IP address and your browser, and when you unsubscribed.
• Businesses we emailed first: 6 months after the last email.
• The suppression list of people who asked us to stop: indefinitely, as a hash.
• Analytics: 14 months.

If you join the partner programme

• What we keep — your agency name, website, country, your name, your work email, the rough number of client sites you look after if you tell us, the programme terms version you accepted, and your referral code.
• Why, and on what basis — to run the programme you joined: send your referral link, record which checks came through it, and pay commission. That is performing our agreement with you. Partner programme news goes only to partners who ticked the box and confirmed it by email, and one click withdraws it.
• Referred businesses — when a business runs a check through a partner’s link, we store that partner’s code on the check. We use it to work out commission and nothing else. We do not share the check’s findings with the partner.
• How long — while you are a partner, then 7 years for anything tied to a commission payment (tax records), and 12 months for the rest.

If we emailed your business first

We sometimes send a short series of emails to a business in the United States or the United Kingdom whose website seems to have no way to book online. We never send these emails to businesses in the European Economic Area, or to UK sole traders or partnerships.

• Where your details came from — public sources only: OpenStreetMap, your business’s own website, and, for UK companies, Companies House. We keep the business name, website, the email address your site publishes, the company number and type, where we found them and when.
• Why — to tell you what we found on your site and offer to fix it, and to follow up on that one message.
• Lawful basis — our legitimate interests in offering a relevant service to a business, weighed against yours. We only use an address the business publishes itself, and we write about its own website.
• Your right to object — reply “stop”, use the unsubscribe link in the email, or write to support@anagent.app. We stop at once, and never later than 10 business days.
• Who else sees it — our email sequencing provider, which sends the messages and records replies, bounces and unsubscribes, and an email verification service that checks the address can receive mail.
• How long — if you do not become a customer, we delete your details 6 months after our last email. If you object, unsubscribe or an email bounces, we keep only a one-way hash of the address, the date and the reason, on a suppression list, indefinitely. That list is what stops us ever emailing you again, so it outlives everything else.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere, or withdraw consent. Email support@anagent.app and we respond within one month, free of charge.

You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

Automated processing

The research is produced by AI systems and checked by an automated verification pass. It does not make any decision that produces legal effects about you — it is a report you read and act on yourself.