What we collect, and what we do with it

What we collect

We collect only what we need to run audits and the services you ask for.

• The web address you ask us to audit, and what our audit observes on that website. This is information about the website, not about you.
• Your email address, when you give it to receive a report or a published result. We keep it with the audit it belongs to.
• Your internet (IP) address, which we use to limit how many audit requests can come from one place. Our hosting provider also keeps standard request logs that include it.
• Your name, email, billing address and what you bought, when you pay for a service. You enter your card on Stripe’s checkout page and it goes straight to Stripe. We never see or store your card number.
• The date and time a paid report is first opened, so we know it has been delivered.
• Whatever you choose to tell us when you email us.

What we never collect

Our website runs no advertising tools, no analytics, no tracking pixels and no session recording. Our pages load nothing from any other website while you read them, so no one else can watch your visit through us.

We do not sell personal information, and we do not share it with anyone for advertising.

How we use it

We use what we collect to:

• run the audit you asked for, and send you the report or the published result;
• email you about that audit, for example when it is done or when it is published;
• provide and bill the services you buy, and send receipts and invoices;
• reply when you write to us;
• keep the service working and stop anyone from overloading it, or the websites we audit.

Marketing email

We send marketing email only if you have said yes to it, and every one has a way to stop. Saying no never changes your audit or what you receive about it.

When a shopper asks for an audit

Anyone can ask us to audit a website. When a shopper asks, we never tell the website who asked, and the report we publish names no one who asked for it.

Who else handles it

A few companies process information for us, only to provide their part of the service and under their own security terms:

• Vercel hosts this website.
• Supabase hosts our database.
• Railway runs the computers that carry out audits.
• Stripe takes payments.
• Resend sends our email.
• Anthropic’s AI models help us write report wording. They receive the findings about a website, never your email address or payment details.

Other times we may share it

We may disclose information when a court order or other legal process compels it, or to protect people or our service from harm. If Tolbrook is ever sold or merged, the information would pass to the new owner under this policy.

How long we keep it

We keep your email address for as long as the audit it belongs to is open and its result can still be published, then delete it unless you have asked to hear more from us. Payment records are kept for as long as tax and accounting rules need them. Request logs and rate-limit counters are short-lived.

A published result is a dated record about a website, not about you. It stays public, and it names no one who asked for it.

Your choices

Wherever you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. You can also ask us to stop sending marketing email at any time. Someone you have authorised can ask on your behalf.

We may need to confirm it is really you before we act, usually by writing to the email address we hold. We will never treat you differently for asking.

Your browser’s Global Privacy Control signal is treated as a request to opt out of any sale or sharing of your information, even though we do neither.

Keeping it safe

Information is stored with the providers above, behind access controls. Our database refuses public access by default, and only our own servers can read it. No system is perfect, and if something ever went wrong with information about you, we would tell you.

Children

This website and our services are meant for businesses and adults. We do not knowingly collect information from anyone under 16.

Where it is processed

Tolbrook and its providers process information in the United States.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use information we already hold, we will say so here before it takes effect.

Contact us

Write to hello@tolbrook.com with any question about this page, and we will answer it.