Legal

Privacy policy

Last updated: 21 September 2026

Who controls your data

The data controller for visibilityroot.com is Corenex Solutions Ltd (trading as Visibility Root), registered in England and Wales, company number 13075111. You can reach us for any privacy question at .

What we collect, and why

If you run a free scan, we store the domain you asked us to scan and the IP address the request came from. The IP address exists only to enforce the limit of 5 free scans per 24 hours per address, which is a legitimate interest under UK GDPR Article 6(1)(f): stopping the free scan being used to run unlimited automated crawls at our expense. The domain itself is processed because performing the scan you asked for requires it.

If you submit an email address to unlock a scan's generated fixes, that address is stored against that one scan and used only to send you the fixes you asked for. It is not added to a mailing list and we do not send marketing email from it. This processing relies on your consent under Article 6(1)(a), given by submitting the form.

We do not run analytics, advertising or tracking scripts of any kind on this site. The only cookie we set is csrftoken, a strictly necessary technical cookie that Django's own form protection requires to exist, exempt from consent under PECR regulation 6(4) because the site cannot function safely without it. We do not use a session cookie for anonymous visitors: no sessionid cookie is set unless you log in to an account, which the free scan never requires.

How long we keep it

A free scan's result is cached for 30 days so that a repeated request for the same domain does not trigger a new crawl. Beyond that cache window, a daily automated job deletes data on this schedule:

• The raw content of pages we fetched, the page text and any structured data on it, is deleted 30 days after the scan that fetched it finished.
• The consolidated facts we extracted, the findings themselves, and the scan record are deleted 730 days (2 years) after the scan finished.
• An email address you give us to unlock a scan's fixes is deleted 730 days (2 years) after your last scan or email interaction. It can also be deleted immediately: email and ask us to remove it, or to send you the direct link to remove it yourself. Either request is actioned within one month, as UK GDPR requires.

Who else sees it

Two processors handle data on our behalf, and neither receives more than the specific task requires:

• Hetzner, our hosting provider, runs the server that stores scan records and serves this site.
• Anthropic receives the text of the pages we crawl, sent to their API so a model can extract structured facts from it. Anthropic does not receive your IP address or email address. Under Anthropic's published data retention policy, API inputs and outputs are automatically deleted within 30 days of being sent, unless content is flagged by their automated systems as violating their usage policy, in which case it may be retained for up to 2 years.

Your rights

Under UK GDPR, you can ask us to:

• confirm what data we hold about you and give you a copy of it
• correct data that is inaccurate or incomplete
• erase data we no longer have a lawful reason to keep
• restrict how we use your data while a query is resolved
• give you your data in a portable, machine-readable format
• object to processing based on our legitimate interest
• tell you about any decision made about you without human review, which we do not currently make
• withdraw consent at any time, for anything processed on that basis

To exercise any of these, email . If you are unhappy with how we have handled a request, you can complain to the Information Commissioner's Office at ico.org.uk.