Privacy policy
- We collect only what you type into a form (name, email, website, what you need, a note) and the results of any site check you run.
- We use it to send you what you asked for and to talk to you about it. Nothing else.
- We do not sell it, rent it, trade it or add you to a marketing list.
- Google Analytics measures visits in aggregate. Meta, TikTok and LinkedIn pixels let us measure our own ads and show ads to people who visited. You can opt out of all of it in one click (section 6), and a browser privacy signal switches it all off automatically.
- We use AI tools in our work. A person reviews anything we send you, and your personal information is never used to train a model (section 8).
- Ask and we will show you, correct or delete everything we hold about you, usually within ten business days.
- 1. Who we are
- 2. What this covers
- 3. What we collect
- 4. How we use it, and on what basis
- 5. Who we share it with
- 6. Cookies, local storage and analytics
- 7. The websites you check
- 8. AI in our communications and services
- 9. How long we keep it
- 10. How we protect it
- 11. Where it is processed
- 12. Your rights and choices
- 13. Children
- 14. Changes to this policy
- 15. Governing law
- 16. Contact and complaints
1. Who we are
Insite Found ("we", "us", "our") is an AI-first growth agency operating from Toronto, Ontario, Canada. We are the organization responsible for the personal information described in this policy. You can reach us at hello@insitefound.example.
2. What this covers
This policy covers insite-found-preview.pages.dev, the free first look tool at /audit/, the contact form, and any email exchange that starts from them. It does not cover the websites you ask us to check (we only read their public pages, see section 7), or the separate written agreement that governs paid work, which has its own confidentiality terms.
3. What we collect
Information you give us
| Where | What | Why |
|---|---|---|
| Contact form | Your name, email address, your website address, which service you are interested in, and any note you add | To reply, and to prepare the free first look you asked for |
| Free first look gate | Your name and email address, plus the website address you checked and the results of that check | To email you the full check-by-check report and to talk to you about it if you reply |
| Whatever you choose to write to us, and your email address | To answer you and keep the thread |
All of this is optional. You can run the free first look and see the scorecard without giving us anything. You only give us your name and email if you want the full report sent to you.
Information collected automatically
| What | How | Why |
|---|---|---|
| Request logs | Our host, Cloudflare, records the network address, browser user-agent string, page requested and time of each request, the way any web host does | Security, abuse prevention and keeping the site up |
| Form metadata | When you submit a form we store the time, your browser's user-agent string and the network address the request came from alongside the submission | To stop spam and abuse of the tool, and to investigate a request you make about your data |
| Site usage | Google Analytics 4, loaded through Google Tag Manager, records page views, clicks and events on this site, your browser and device details, screen size, language, the page that referred you, and an approximate location derived from a truncated network address | To understand which pages people read, how they arrive and what needs improving |
| Advertising pixels | The Meta Pixel, the TikTok Pixel and the LinkedIn Insight Tag record that a browser visited this site and which pages, set a cookie or identifier, and, if you are logged in to that platform, let the platform match the visit to your account there | To measure whether our own ads on those platforms led to visits, and to show our ads to people who have visited this site (retargeting) |
| Font requests | Our pages load type from Google Fonts, so your browser sends Google a request that includes your network address | To display the site's typefaces. Google's privacy policy applies to that request |
Analytics data is aggregate and we do not connect it to your name or email. The advertising pixels are different: each platform can connect the visit to your account on that platform, under its own privacy policy. We never send them your name, email or anything you typed into a form. Section 6 explains how to opt out of all of it.
We do not buy lists, scrape contact details or collect information about you from data brokers.
4. How we use it, and on what basis
- To deliver what you asked for. Sending your first look report, replying to your message, preparing for a call you book. Basis: your request, which is your consent.
- To follow up on that request. One or two emails about the report you received, so you can ask questions. We stop when you say stop, and we do not add you to a newsletter or drip sequence. Basis: your request and our legitimate interest in answering it.
- To keep the site and the tool working. Spotting abuse, fixing errors, understanding in aggregate which checks fail most often so the tool improves. Basis: our legitimate interest in running the service safely.
- To meet a legal obligation if one applies, such as responding to a lawful request from an authority.
We do not use your information for automated decisions that have a legal or similarly significant effect on you. The first look score is an automated reading of a public website; it is not a decision about you.
We do not sell personal information and have not done so. The advertising pixels described in sections 3, 5 and 6 send browsing signals to Meta, TikTok and LinkedIn, which some laws (including California's) treat as "sharing" for cross-context behavioural advertising. You can opt out (section 6) and we honour the Global Privacy Control signal automatically. We do not use your information for any purpose you have not asked for or would not reasonably expect.
5. Who we share it with
Only the service providers we need to run the site and send you what you asked for. Each processes data on our instructions under its own privacy terms.
| Provider | Purpose | What it handles |
|---|---|---|
| Cloudflare | Hosting the site, running the first look tool, and storing form submissions in its key-value storage | Request logs, form submissions, first look results |
| Resend | Sending the first look report and form notifications by email (when enabled) | Your name, email address and the report contents |
| Google Analytics 4 | Measuring site usage in aggregate | Cookies, truncated network address, browser and device details, pages and events |
| Google Tag Manager | Loading the analytics and advertising tags on every page | Passes page and event data to the tags listed here; loads nothing else |
| Meta (Facebook and Instagram) | Measuring our Meta ads and retargeting site visitors on Meta platforms | Pixel cookie and identifier, pages visited, browser details, matched to your Meta account if you are logged in |
| TikTok | Measuring our TikTok ads and retargeting site visitors on TikTok | Pixel cookie and identifier, pages visited, browser details, matched to your TikTok account if you are logged in |
| Measuring our LinkedIn ads and retargeting site visitors on LinkedIn | Insight Tag cookies, pages visited, browser details, matched to your LinkedIn account if you are logged in | |
| Google Fonts | Serving the site's typefaces | Your network address and browser details, in the font request |
We may also disclose information if the law requires it, to protect our rights or safety, or as part of a sale or reorganization of the business, in which case the new owner would be bound by this policy. We have no other categories of recipients.
6. Cookies, local storage and analytics
Cookies: Google Analytics sets cookies to tell one visitor from another. The Meta, TikTok and LinkedIn tags set advertising cookies and identifiers. Cloudflare may set a small security cookie. None of them holds your name or email.
| Cookie | Set by | Lasts | Purpose |
|---|---|---|---|
| _ga | Google Analytics | Up to 24 months | Distinguishes unique visitors |
| _ga_<id> | Google Analytics | Up to 24 months | Keeps session state for this site's property |
| _gid | Google Analytics | 24 hours | Distinguishes visitors within a day |
| _fbp | Meta Pixel | 90 days | Identifies a browser for Meta ad measurement and retargeting |
| _ttp | TikTok Pixel | 13 months | Identifies a browser for TikTok ad measurement and retargeting |
| li_sugr, bcookie, lidc, UserMatchHistory | LinkedIn Insight Tag | Up to 12 months | Identifies a browser and matches it to a LinkedIn member for ad measurement and retargeting |
| __cf_bm | Cloudflare | 30 minutes | Bot protection |
The one-click opt-out: if your browser sends the Global Privacy Control signal, none of these tags loads, not analytics, not the pixels. Most browsers and privacy extensions can turn it on in one setting. We treat it as an opt-out under every law that recognizes it.
Other ways to opt out: turn on your browser's tracking protection or "block third-party cookies" setting; install Google's Analytics opt-out add-on; adjust your ad preferences on Meta, TikTok and LinkedIn; or clear this site's data in your browser. We do not currently show a cookie banner. If you are visiting from the EU, EEA or UK, or you simply want nothing measured, turn on Global Privacy Control before you browse.
Local storage: when you start the contact form, your browser keeps a copy of what you have typed so far in its own local storage, so you can come back and finish. It stays on your device, is never sent to us until you press send, and you can clear it with the "Start over" option or by clearing your browser's site data.
What we do not do: we do not build profiles of you, we do not buy audience data, and we never pass your name, email or form contents to any of these platforms. The pixels see a browser and the pages it visited; the platforms do the matching under their own policies.
7. The websites you check
The free first look reads public pages of the website you enter, the same way a browser or a search engine crawler would: the home page, robots.txt, llms.txt, sitemap.xml, and the home page again as three named AI crawlers, plus one request asking for a markdown version. Five to eight requests, then it stops. It does not log in, submit forms, run scripts or change anything. We keep the results so we can send you the report and so a later check can show what changed.
Only check a site you own or have permission to review. If you believe someone has used the tool on your site without permission and want the record removed, write to us and we will remove it.
8. AI in our communications and services
We are an AI-first agency, and we use AI tools in our own work. Here is exactly how that touches you.
- Drafting and analysis. We may use AI tools to draft emails, reports and proposals, to summarize a conversation, to analyze a website or to research a market. A person reads, checks and is accountable for anything we send you. If you would rather deal only with a person at every step, say so and we will.
- The free first look tool is automated. It reads public pages of the site you enter and scores them against fixed rules. No AI model reads your name or email, and the score is not a decision about you or your business.
- The full audit sends buyer-style questions about your market to third-party AI answer engines (for example ChatGPT, Perplexity, Google AI Overviews and Claude) and records what they answer. Those prompts name businesses and topics, which are public; they do not include your personal information or anything you told us in confidence. Each engine's provider processes those prompts under its own terms.
- Your information is never used to train a model. We do not feed your name, email, messages, submissions or client files into any AI system for training, and we choose tools whose terms say the same for the data we send them.
- Confidential material stays out. Where we use AI on client work, we work with business-level tools that do not retain inputs for training, and we remove personal information from anything we send them unless you have agreed otherwise in writing.
- Labelling. If an email, a report or a page was substantially generated by AI without meaningful human editing, we will say so on it.
Questions about any of this go to the same address as every other privacy question, and a person answers them.
9. How long we keep it
| What | How long |
|---|---|
| Form submissions and first look requests | Until you ask us to delete them, or 24 months after our last exchange with you, whichever comes first |
| First look results | Same as the request they belong to. Results run without giving us an email are not linked to anyone and are not kept beyond the session |
| Email threads | As long as we are working with you or the conversation is open, then archived and deleted on request |
| Analytics data | Google Analytics keeps user-level and event-level data for 14 months, then aggregates it |
| Advertising pixel data | Held by Meta, TikTok and LinkedIn under their own retention rules; retargeting audiences we build from site visits expire after 180 days at most |
| Request logs | Cloudflare keeps standard request logs for a short, rolling period set by Cloudflare |
| Email delivery logs | Resend keeps delivery logs for a short, rolling period set by Resend |
When we delete something we delete it from our storage and ask any provider that holds a copy to do the same. Backups roll off on the providers' schedules.
10. How we protect it
Everything travels over HTTPS. Submissions are stored in Cloudflare's key-value storage, encrypted at rest, and reachable only with our account credentials, which use two-factor authentication. The first look tool rejects private addresses and rate-limits abuse. We keep the amount of data we hold small on purpose; the best protection for information is not collecting it.
No system is perfect. If we learn of a breach that creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as the law requires, and we will say what happened and what we are doing about it.
11. Where it is processed
We are in Canada. Our providers run global networks, so your information may be stored or processed on servers outside Canada, including in the United States, where it may be subject to the laws of that country. We choose providers with strong security and contractual privacy commitments, and we transfer only what is needed to provide the service.
12. Your rights and choices
Wherever you are, you can ask us to:
- Tell you what personal information we hold about you and how we have used it
- Correct anything that is inaccurate or incomplete
- Delete it
- Stop using it for a particular purpose, or stop contacting you
- Give you a copy in a portable format
- Withdraw consent you gave earlier, without affecting anything done before you withdrew it
Email hello@insitefound.example with the subject "Privacy request". We will confirm within five business days and complete the request within ten, and in any case within the 30 days the law allows. We may ask you to confirm you are the person the information is about. We will not charge you and we will not treat you differently for asking.
We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec's Law 25. If you are in the European Economic Area or the United Kingdom, you also have rights under the GDPR and UK GDPR, including the right to object and to complain to your supervisory authority. If you are a California resident, you have rights under the CCPA as amended by the CPRA, including the right to know, delete, correct and opt out of sale or sharing. We do not sell personal information. The advertising pixels may count as sharing under those laws, and the Global Privacy Control signal and the opt-outs in section 6 are how you exercise that right with us. We honour requests under all of these.
13. Children
This site is for businesses and the people who run them. It is not directed at children under 16 and we do not knowingly collect information from them. If you believe a child has given us personal information, write to us and we will delete it.
14. Changes to this policy
When we change this policy we update the effective date at the top. If a change is material, such as a new category of data, a new analytics tool or a new purpose, we will say so on this page for 30 days after it takes effect, and we will not apply the change to information we already hold without telling you first.
15. Governing law
This policy is governed by the laws of the Province of Ontario and the federal laws of Canada that apply in Ontario. Disputes will be resolved in the courts of Ontario, without limiting your right to complain to a privacy regulator.
16. Contact and complaints
Privacy questions, requests and complaints: hello@insitefound.example. We read every message and reply within one business day.
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada. In Quebec, the Commission d'accès à l'information. In the EU or UK, your local data protection authority. In California, the California Privacy Protection Agency.