This Privacy Notice explains how Mathew Vernon Malowney ("we", "us", "our") collects, uses, and protects personal information when you use the AI Website Optimizer service (the "Service"). We act as the data controller for information collected through the Service.
1. Information we collect
- Account information: email address, password (hashed), and any profile information you provide.
- Audit input: the website URL, industry, and city you submit to run an audit.
- Usage and telemetry: log data, IP address, browser type, pages visited, and timestamps.
- Support communications: messages you send to us.
Payment information (card details, billing address) is collected and processed by our payment provider, Paddle, not by us. We only receive a confirmation that the payment succeeded along with non-sensitive metadata such as the last 4 digits of your card.
2. How we use information
- To provide and operate the Service (running audits, generating reports)
- To create and manage your account
- To process payments via Paddle and deliver purchased products
- To improve the Service, debug issues, and develop new features
- To respond to your support requests
- To detect and prevent fraud, abuse, or security threats
- To comply with legal obligations
3. Legal basis for processing (UK/EEA users)
- Contract: to provide the Service you signed up for
- Legitimate interests: improving the Service, security, fraud prevention
- Consent: where you have given consent (e.g., optional analytics cookies)
- Legal obligation: where required by law
4. How we share information
We share personal data with the following categories of recipients:
- Service providers / sub-processors: hosting (Lovable Cloud / Supabase), AI model providers (Perplexity), and analytics providers, all under appropriate data processing agreements.
- Paddle (Merchant of Record) for the sale of our products, subscription management, payment processing, tax compliance, and invoicing.
- Professional advisers: legal, accounting, and similar advisers when needed.
- Authorities: where required by law or to protect our rights, users, or the public.
We do not sell your personal data.
5. International transfers
Your data may be processed in countries other than your own, including the United States. Where data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
6. Data retention
We retain personal data for as long as needed to provide the Service and to comply with legal obligations. Audit reports are retained while your account is active. When data is no longer needed, it is deleted or anonymised.
7. Your rights
Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. UK/EEA users have these rights under GDPR. To exercise your rights, contact us via the website. We aim to respond within one month. You also have the right to lodge a complaint with your local data protection authority.
8. Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and secure authentication.
9. Cookies
The Service uses essential cookies to keep you signed in and to remember your preferences. We may use analytics cookies to understand how the Service is used; you can manage these via your browser settings.
10. Children
The Service is not directed to children under 16, and we do not knowingly collect data from them.
11. Changes to this Notice
We may update this Privacy Notice from time to time. We will notify you of material changes via the Service or by email.
12. Contact
Questions or requests regarding your personal data? Contact us via the website.