Privacy notice

Last updated: 6 November 2026

Who we are

ProudSite SEO is a service of ProudSite. ProudSite is a trading name of EARTHBOOKINGS LTD., a company registered in England and Wales, company number 17305953, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commission (the ICO), registration number ZC275858. We are not VAT registered.

• Email: hello@proudsite.co.uk
• Phone: 07301 711732
• Post: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

We are the data controller for the personal data described below, except where this notice says we act for you as your processor. We have not appointed a data protection officer; Oliver, our director, is responsible for data protection.

This website sets no cookies

We do not set cookies, we do not use analytics that track you, and we do not store anything on your device. There is no consent banner because there is nothing to consent to. Every font, image and script is served from our own domain. Loading a page sends your request only to Cloudflare, which hosts the site for us.

If you buy an audit, you leave this site for Stripe’s payment page. That page is Stripe’s own and uses Stripe’s cookies under Stripe’s cookie policy.

We do not send marketing emails.

The free check

When you run the free check you give us the website address, business name, main service and town or area. We fetch the public pages of the site you enter and send its address to Google’s PageSpeed Insights and Chrome UX Report. We keep your check (what you entered and the result) for 30 days. The public pages we fetched are kept for 24 hours, so that repeated checks of the same site do not fetch it again.

To stop misuse we count checks per connection. We store a scrambled code made from your IP address, not the address itself. The code is still personal data, so we delete it within 7 days.

The site you check may not be yours. We collect nothing about the site’s owner beyond what their public pages show, we read those pages once per check, and we build no profile.

Why we use it, and our lawful basis

The score is calculated automatically but has no legal or similarly significant effect on you. We never sell your data.

Who receives it

• Cloudflare hosts the website and the check, and stores results and counters, as our processor. It keeps short technical logs of requests to the check service for up to 7 days.
• Google (PageSpeed Insights and the Chrome UX Report) receives the address of the site being checked, nothing else.
• Stripe takes payment if you buy an audit (see “If you buy an audit”).
• Google Workspace runs our email, file storage and intake form, as our processor.
• Resend sends the emails our system writes when you buy an audit (your order confirmation, and a notice to us), as our processor.

How long we keep it

If you buy an audit

We sell three audits: the Quick Fix Plan, the Local Audit and the Full Audit. What we collect depends on which you buy:

• Your order (all audits). On Stripe’s payment page you give your name, email address, billing address and payment details. Stripe collects these directly, and we never see or store your full card number. In our Stripe account we can see your name, email address, billing address, the amount and the payment status. In our own database we keep only the order record: Stripe’s reference numbers, the audit bought, the amount and the status. If you buy after running a free check, we link the order to that check. We do not ask for your phone number. To send your order confirmation, our system reads your email address from Stripe at the moment it sends the email, and does not save it in our database. The confirmation, and a notice to us of the order (which does not include your email address), are sent through Resend. Resend then tells our system whether each email was delivered. Those messages name your email address, but our system reads only whether delivery worked and does not keep the address. Stripe’s role: Stripe Payments Europe, Limited processes your payment for us as our processor. For its own purposes (preventing fraud and loss, meeting anti-money-laundering and other legal duties, and improving its services) Stripe is an independent controller, under its own privacy policy at stripe.com/gb/privacy.

• Your intake form (all audits). Your business name, your website, the service and area the audit covers, and whether you asked us to start within the cancellation period. For the Local and Full Audits it also has the competitors you name and the phrases your customers use. The intake questions are in your order confirmation, and you answer them by replying to it. Your reply reaches our email, which runs on Google Workspace, as our processor.

• Screenshots you send (Local and Full Audits). For your Google Business Profile, you send us screenshots. These may show the names and words of people who left you reviews. We keep these, like the AI answers, as our evidence for the findings in your report, so for them we are the controller.

• Your search data (Full Audit). If you add us as a read-only user on Google Search Console or Bing Webmaster Tools, we read the searches your site appears for, clicks and indexing problems. Search terms can occasionally include a person’s name. When we read this data we act for you, as your processor, under the data processing terms in our audit terms of sale (Annex 1).

• The AI answers we record (Local and Full Audits). We record by hand what AI assistants say in answer to the questions for your audit. Answers can name other businesses, and sometimes people. We keep them only as evidence for your report.

Who sees it: Oliver, and our processors: Google Workspace (email, file storage and the intake form), Stripe (payment) and Resend (sending your order confirmation). We never sell it, and never publish your audit without your written consent.

How long we keep it:

• The order and payment record (our financial records): kept for 7 years after your order is completed (this covers HMRC’s 6 years from the end of the accounting period).
• The report itself: 6 years from delivery, so that we can answer any claim about the audit. A claim under a contract can generally be brought for 6 years (Limitation Act 1980 s.5).
  • From 12 months after delivery, our kept copy is redacted: for individuals other than the client (reviewers, and people or sole traders named in AI answers), every identifying detail (name, website address, address, quoted review text) is replaced by a description such as “a reviewer” or “a sole trader in the same trade”.
  • Redaction is not a guarantee of anonymity: what remains can sometimes still point to a person in context. So the redacted copy is still treated as personal data for its 6 years. It is kept for claims only, and not used for anything else.
• Observation records, AI-answer screenshots and your Business Profile screenshots: 12 months after we deliver the report, then deleted. They are the evidence behind the findings, kept for questions after delivery.
• Anything exported from your search tools: deleted 30 days after the follow-up window closes.
• Resend’s copy of the emails it sends for us (your order confirmation, with your email address, and our notice of the order): on the Resend plans we use (Free, Pro or Scale), Resend keeps email and log data for 30 days, then deletes it. Resend’s backups can hold it for up to 7 days more. If we close our Resend account, Resend deletes any remaining data within 90 days. If we ever move to a Resend Enterprise plan, whose retention can be set differently, we will update this notice first.

Your access: when we deliver the report we remind you how to remove our access to your search tools. We stop using it then.

Giving us the intake details is needed to do the audit. If you do not send them after two reminders, we do the audit from public information only. Granting search-tool access is optional; without it, the report says what was not checked. We do not use automated decision-making on audit data.

If you are named in a screenshot or an AI answer we recorded (you did not give us your details):

• What we hold. Your name and, for reviews, what you wrote. It came from the client’s Business Profile screenshots or from a public AI answer.
• What we use it for. Only as evidence in that client’s report.
• When we delete it. We delete our source records (screenshots and answer records) 12 months after the report is delivered.
• Our kept copy of the report. At the same point we redact the copy we keep for claims: every detail that identifies you (name, website address, address, quoted review text) is replaced by a description such as “a reviewer” or “a sole trader in the same trade”. We keep the redacted copy for up to 6 years from delivery, only to deal with a claim about that audit. The client’s own copy is theirs.

You have the same rights as anyone else under this notice.

Transfers outside the UK

Our providers may process personal data outside the UK. Each relies on a recognised safeguard in its published terms:

• Cloudflare (hosting): the UK extension to the EU-US Data Privacy Framework, and otherwise the EU Standard Contractual Clauses as amended by the UK Addendum (Cloudflare Customer Data Processing Addendum, section 6).
• Google Workspace (email, files and forms): transfers to countries the UK recognises as adequate, Google’s adopted alternative transfer solution, or Standard Contractual Clauses (Google Cloud Data Processing Addendum, Appendix 3).
• Stripe (payments): transfers to Stripe, LLC in the United States under Stripe’s Data Transfers Addendum, which uses the EU Standard Contractual Clauses with the UK Addendum (Stripe Data Processing Agreement).
• Resend (order emails; Plus Five Five, Inc., trading as Resend, United States): stores data in the United States. Transfers rely on the EU Standard Contractual Clauses as amended by the UK Addendum (Resend Data Processing Addendum, section 6.4), with the UK Extension to the EU-US Data Privacy Framework as an additional mechanism.
• Google (PageSpeed Insights and Chrome UX Report APIs): we send only the address of the website being checked, not personal data about you. If a website address itself names a person, Google handles it under its own terms and privacy policy.

You can ask us for more detail about any of these safeguards.

Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, and to restrict what we do with it. Where the law gives it, you can also receive it in a portable form.

Your right to object. Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling legitimate grounds to continue.

To use any of these rights, email hello@proudsite.co.uk. We will respond within one month, and there is no charge.

Complaints to us. You can complain to us about how we handle your personal data: email hello@proudsite.co.uk with “Data protection complaint” in the subject, or write to us at the address above. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you updated and tell you the outcome without undue delay. We would rather put it right.

Complaints to the regulator. You can also complain to the Information Commission, the UK data protection regulator, which still uses the name ICO: ico.org.uk, or phone 0303 123 1113.

Changes

If this notice changes, we will update the date at the top, and tell you directly if the change is significant.