Privacy Policy

We collect little, we do not sell any of it, and this page says exactly what happens to what we do collect.

Cookies and tracking

This site sets no cookies of its own and runs no advertising trackers. We count visits with Cloudflare Web Analytics, which sets no cookie, stores nothing in your browser and does not identify you by your IP address or your browser. It records the page you view, the site that sent you, your browser, operating system and device type, your country, and how fast the page loaded, and shows us totals, not individual visitors. If that changes, this page will change first.

When you run a scan

We receive the website address you enter and your IP address. The address is used to run the scan, and the result is kept for 6 hours, so a repeat scan comes back at once unless you have reached our rate limit. For a scan, your IP address is used only to count scans for our rate limit, and those counters expire within 24 hours. Nothing more is kept unless you choose to save the result, have it emailed or have the site watched.

When you use the free tools

The quiz passes your answers to the scan page in its web address, and we keep nothing of them beyond what a scan keeps. The ROI calculator works in your browser and sends nothing. The audit checklist keeps your ticks in your browser's local storage, as a list of the items you ticked, until you clear them, and they never leave your browser. The checklist and the calculator can also read the scan result your browser keeps for the tab you scanned in, and they send nothing from it. Your browser keeps that copy in its session storage until you close the tab, and the tools use it only for the first 6 hours after the scan.

When you save a result

Saving a scan result creates a private page at a link only you get. The page is not listed anywhere, and search engines are asked not to index it. We keep the result for 30 days, then delete it. Anyone who has the link can see the page and can delete the result at once with the button on it. We save a result the same way when we write to a business about its own website, and the link goes in that email. For a save, your IP address is used only to count saves for our rate limit.

When you have the report emailed

We receive the email address you type. We keep it with the site you scanned, the link to the result and whether the email went out, for 45 days, so we can stop abuse and honor a request to stop. We send one email with the link. It may also offer a weekly watch, which starts only if you open the link in it and confirm. Your IP address counts toward our rate limit, and each request is stored with the IP address it came from, so we can spot abuse.

When you watch a site

We receive your email address and the site. Nothing is watched until you open the link we email you and confirm; a request nobody confirms stops after 7 days. A confirmed watch scans the site once a week, keeps each week's result for 30 days, and emails you only when a high or medium finding appears or is fixed. Every email has a link that stops the watch with no login, and a stopped watch is deleted 45 days later. The watch is stored with the IP address it came from, so we can spot abuse.

Stopping our emails

Every email our scanner sends has a link that stops it, with no login. If you ask us never to email you again, we keep your address on a do-not-email list for as long as we send scan emails, only so we can keep that promise.

When you send a request

We receive what you type into the form: your name, email, phone if given, business, website, the plan you picked and your message. If you ran a scan in the same visit, we also receive a short summary of it (the finding codes, the recommended plan and the estimate). We also receive a record of how you found us during that visit: the page you arrived on, the site that referred you, any campaign tags and ad click identifiers in the link, your device type, how many pages you viewed and how long you spent. That record is kept in your browser's session storage and leaves your browser only if you send the form. Each request is stored with the IP address it came from, so we can spot abuse. NightshiftDirect Scan and Research reads your request, and the scan summary if there is one, and writes and sends our reply automatically; the team reads every reply after it goes out.

When you buy

Checkout runs on Stripe, which collects your card details directly; we never see your full card number. From each order we receive your name, email address and billing address, the business name and website you enter at checkout, what you bought, and the payment record. We use them to deliver and bill for your plan, and keep them as billing records. At checkout, your IP address is used only to count checkout attempts for our rate limit.

The spam check

Our forms use Cloudflare Turnstile to tell people from bots. Turnstile processes signals from your browser and your IP address under Cloudflare's privacy policy.

Emails

We email you about your request or your order, the scan report you ask for and a watch you start, and send nothing else unless you tick the box for marketing emails. The one exception is when we write to a business about its own website, with a saved result as described above: reply to it, or write to [email protected], and we will not write again. Every scan email and every marketing email has a way to stop.

Who processes data for us

• Cloudflare: hosting, storage, the spam check, email sending and the visit counts.
• Google: page-speed data for the address you scan, when that check is turned on.
• Google Workspace: our email.
• Stripe: checkout, payments, billing and the billing portal.
• AI model providers, behind NightshiftDirect Scan and Research: to write and send our replies to requests and to produce client work. We set them not to use your data to train models.

How long we keep things

Requests: 24 months, unless you become a client. Scan results you do not save: 6 hours. Saved results: 30 days, or until you delete them. Report emails asked for: 45 days. Watches: until you stop them, then 45 days; one nobody confirms stops after 7 days. The do-not-email list: kept, so we can honor it. Rate-limit counters: up to 24 hours. Billing records: 7 years, because tax law requires it.

Client data

When clients share their customers' information with us, we handle it under a data processing agreement. We take no patient health information. We sign no business associate agreement for any service, and we hold no patient contact lists.

Your choices

Email [email protected] to get a copy of what we hold about you, correct it, or delete it (apart from records the law makes us keep). We answer within 30 days.

Changes and contact

If this policy changes in a way that matters, we update the date at the top. Questions: [email protected], or NightshiftDirect, 50a Northwestern Dr, Unit 3 #541, Salem, NH 03079.