Privacy policy

Refreshly LLC (“Refreshly”, “we”) builds websites and runs automated website audits. This policy describes what we collect, why we collect it, who we share it with, and how to have it removed. It covers refreshly.tech and the audit product.

What we collect

When you create an account: your email address, your name if you give one, and either a hashed password or, if you sign in with Google, the account identifier, email, name, and profile image Google returns. We never receive your Google password.

When you request an audit: the website address you ask us to check, and a business name if you provide one, and, on a Pro audit, any competitor websites and target keywords you enter.

When you pay: Stripe collects and processes your card details. We never see or store card numbers. We keep the Stripe customer and subscription identifiers, and what you bought.

When you contact us: whatever you put in the demo or contact form, which is your name, email, and message.

Automatically: standard server logs, plus analytics described below.

What the audit collects about your website

An audit fetches pages from the website address you give us, the same way a search engine would, and records what it finds: page content, response headers, image sizes, links, and public DNS, registration and certificate records for the domain. It also requests a short list of well-known addresses, such as /.env, to check they are not publicly readable; if one is, we record that it exists and what kind of file it is, never its contents. Pro audits additionally load pages in a real browser to check accessibility and see which third-party scripts run, and, where you name competitor websites, fetch public pages from those as well.

We audit only the address you submit, and we obey robots.txt. Pro audits additionally use the site: opening menus, following buttons, and typing clearly-marked test text into forms to check they work. Nothing is ever submitted, purchased, or changed, and we never attempt to log in.

Why we collect it

To run the audits you ask for and deliver the reports; to take payment; to email you when a report is ready or when there is a problem with your account; and to keep the service working and secure. We do not sell your personal information, and we do not use your audit results to train anything.

Who we share it with

We use these providers, and only for the purposes listed:

• Amazon Web Services: hosting, databases, and file storage (United States).
• MongoDB Atlas: account and audit records.
• Stripe: payment processing.
• Resend: sending report and account emails.
• Google: sign-in if you use it, plus the public PageSpeed Insights and Chrome UX Report APIs, which receive the website address being audited.
• OpenAI: for Pro audits, page text and page screenshots are sent to generate the written walkthrough, copy suggestions, page selection and the competitor narrative, and buyer-style questions about the business are put to ChatGPT with web search to record which sources it cites. This is your public website content and your target keywords, not your account details.
• Anthropic and Perplexity: for Pro audits, the same buyer-style questions are put to Claude and Perplexity with web search, to record which sources each cites.
• DataForSEO: for Pro audits, the same questions are run as Google searches set to the business's town or state, to record which sources Google's AI Overview cites. It also receives your domain name, any competitor domains you name, your target keywords, and searches built from your services and town, to return Google Maps positions, Google Business Profile and review details, search volumes, ranked keywords and backlink counts.
• Open PageRank (Keywords Everywhere): receives your domain name, and any competitor domains you name, to return an estimate of how much of the web links to each.
• Airtable: demo and contact enquiries.
• PostHog: product analytics and visit replays, described below (United States).

Analytics and cookies

A strictly necessary cookie keeps you signed in. We also use Google Analytics and PostHog to see which pages help people and where they get stuck. PostHog records which pages and sections you view and what you click, and replays of visits to the marketing pages, sign-up and the new-audit and payment steps, with everything typed into a form hidden. It never records inside your dashboard or reports, and card details are entered in Stripe’s own fields, which it cannot see. Once you sign in, this activity is linked to your account.

Outside Europe, the UK and Switzerland, analytics runs until you decline it on the cookie banner or under “Cookie choices” in the footer. In those regions nothing is stored until you accept. Advertising cookies (Google Ads) and the Meta pixel wait for you to accept everywhere; until then Google is told to store nothing for advertising and to leave out the identifier that would tie a visit to an advert you clicked. You can block all of it with any content blocker or your browser’s privacy settings, and the site will work normally.

How long we keep it

Account and audit records are kept while your account is open. The report link in your email does not expire; a share link you create expires after 30 days, and you can revoke every share link for a report at any time. Records of what your coding agent did over MCP are kept for 90 days. If you close your account we delete your personal data within 30 days, except records we must keep for tax and accounting.

Your choices

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it, by emailing audit@refreshly.tech. Depending on where you live you may have additional rights under the GDPR, the UK GDPR, or US state privacy laws, including the right to complain to your data protection regulator. We will not charge you or degrade your service for exercising any of them.

Children

Refreshly is a business service and is not directed to anyone under 16.

Changes

If we change this policy we will update the date at the top, and for material changes we will email account holders.

Contact

Refreshly LLC: audit@refreshly.tech. We answer privacy requests within 30 days.