Review status: This operational policy is provided for transparency and should be reviewed by qualified UK privacy counsel before publication or whenever our processing activities change. It is not legal advice.
Who we are
Page One Brand Ltd ("we", "us", or "our") is the data controller for personal data collected through pageonebrand.com and the Page Quality Analyzer tool.
- Legal name: Page One Brand Ltd
- Registered in: England and Wales
- Governing law: UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
- ICO registration: Our current registration details are available from the Information Commissioner's Office register and can be confirmed through the privacy contact below.
- Privacy contact: privacy@pageonebrand.com
- General contact: info@pageonebrand.com
Scope and definitions
This policy applies to personal data processed through pageonebrand.com, the Page Quality Analyzer, account and report features, contact and audit forms, and email communications we send in connection with those services. “Personal data” means information that identifies, or could reasonably be linked to, an individual. Page One Brand Ltd is the controller for the processing described here unless we clearly state that another organisation is the controller.
What information we collect
Information you provide directly
- Account registration — first name, email address, and a hashed password. We do not store plain-text passwords at any point.
- URLs you submit for analysis — the page URLs you submit to the Page Quality Analyzer are fetched, processed, and scored to generate your report. For authenticated users, the URL, report scores, and full report data are stored against your account. For unauthenticated guest scans, we store the email address supplied for report delivery, submitted URL, scan status, scores, and report data so we can generate and email the report, show it to you when you use that email address, and apply abuse-prevention limits.
- Contact form submissions — name, email address, and the content of your message. Optional fields include phone number and company name.
- Bulk scan job data — when you run a bulk scan, the list of submitted URLs, job status, and completion data are stored to enable progress tracking and email delivery of results.
Information collected automatically
- Server and access logs — IP address, browser type, operating system, referring URL, pages visited, and request timestamps. Retained for 90 days for security and service improvement purposes.
- Session data — a session cookie that keeps you authenticated while logged in. This cookie expires after 24 hours of inactivity and is deleted when you sign out.
- Analytics data — Google Analytics 4 (GA4) is loaded when you visit the site and may collect online identifiers, pages visited, session duration, device type, and user interactions. We do not intentionally send account profile fields to GA4. See the Cookies section below for the controls currently available.
Legal basis for processing (UK GDPR)
We rely on the following legal bases to process your personal data:
| Data type | Legal basis |
|---|
| Account registration and authentication | Performance of a contract — necessary to provide the service you signed up for |
| URL analysis and report generation | Performance of a contract and legitimate interests (providing the core tool functionality) |
| Transactional emails (verification, password reset, reports) | Performance of a contract |
| Contact form messages | Legitimate interests (responding to enquiries) |
| Server logs and security monitoring | Legitimate interests (security and abuse prevention) |
| Analytics (GA4) | Legitimate interests, subject to applicable cookie and data-protection requirements |
How we use your information
- To provide, operate, and improve the Page Quality Analyzer and related services.
- To generate and deliver page quality reports (including PDF generation and email delivery).
- To send transactional emails — account verification, password resets, individual reports, and bulk scan completion notifications.
- To respond to support and sales enquiries submitted via our contact form.
- To detect and prevent abuse, fraud, bot activity, or unauthorised access.
- To analyse how users interact with the service so we can prioritise improvements.
We do not sell your personal data. We do not share it with third parties for advertising or marketing purposes. We do not use your data for automated decision-making or profiling.
International transfers
Some service providers may process data outside the United Kingdom. Where a transfer is made to a country that does not benefit from UK adequacy regulations, we use an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another mechanism recognised by applicable data-protection law. Contact us if you want more information about the safeguards relevant to a specific processor.
Third-party services and data processors
We use a small number of trusted third-party services to operate the platform. Each is engaged under a data processing agreement or equivalent contractual protections.
| Service | Purpose | Data shared | Privacy policy |
|---|
| OpenAI | Content intelligence, E-E-A-T, readability, and AI visibility analysis sections of reports | Anonymised page text extracted from submitted URLs. No account data or PII is included. | openai.com/policies/privacy-policy |
| Google PageSpeed Insights API | Core Web Vitals and Lighthouse performance audits | The submitted URL is passed to Google's public API. No account data is shared. | policies.google.com/privacy |
| Google Analytics 4 (GA4) | Anonymised usage analytics — pages visited, session data, events | Online identifiers and usage data from the browser, such as pages viewed, device details, and interaction events. We do not intentionally send account profile fields. | policies.google.com/privacy |
| Resend | Transactional email delivery (verification, password reset, reports) | Recipient email address and email content. | resend.com/privacy |
| Replit | Hosting infrastructure, server compute, and database | All application data is stored on Replit's infrastructure. Subject to Replit's data processing terms. | replit.com/privacy |
Data retention
We retain personal data only for as long as necessary for the purpose it was collected or as required by law.
| Data type | Retention period | Notes |
|---|
| Account data (email, name, hashed password) | Duration of account, plus 30 days after deletion request | 30-day grace period allows recovery of accidental deletions |
| Analysis reports and report data | Duration of account | Deleted when account is deleted |
| Anonymous (guest) scan data | Until deletion is requested or an automated deletion schedule is introduced | Guest scan records are stored to generate, email, retrieve, and rate-limit reports. We do not currently use an automated deletion schedule for these records. |
| Contact form messages | 2 years | Retained for support continuity and follow-up purposes |
| Server access logs | 90 days | Used for security monitoring and abuse detection |
| Backup copies | 30 days after primary deletion | Automated backup rotation; deleted data is purged from backups within 30 days |
| GA4 analytics data | 14 months | Google's default retention period for GA4 user and event data |
You can request deletion of your account and all associated data at any time by emailing privacy@pageonebrand.com with the subject line "Account Deletion Request". We will confirm deletion within 30 days.
Cookies
We use the following cookies:
- Session cookie — keeps you authenticated while signed in. This is a strictly necessary cookie and does not require consent. It expires after 24 hours of inactivity and is deleted when you sign out.
- Google Analytics 4 cookies (
_ga, _ga_XXXXXXXXXX) — used to distinguish users and sessions for usage analytics. The current site loads GA4 when a page loads, so these cookies may be set before you interact with the site. They may persist for up to 2 years subject to Google's configuration and your browser settings. GA4 data is not intentionally joined to your Page One Brand account data.
We do not use advertising cookies or third-party marketing cookies. The site does not currently provide a built-in analytics preference centre. You can block or delete analytics cookies through your browser settings or privacy tools; doing so does not affect processing that is necessary to provide an account or requested report. We will update this policy before introducing a consent-management tool or changing how analytics loads.
Your rights under UK GDPR
As a data subject under UK GDPR, you have the following rights. To exercise any of them, email privacy@pageonebrand.com with the subject line "Data Rights Request" and describe your request. We will respond within 30 days, which may be extended by a further 60 days for complex requests (we will notify you if an extension is needed).
| Right | What it means |
|---|
| Right of access | Request a copy of the personal data we hold about you (Subject Access Request) |
| Right to rectification | Request correction of inaccurate or incomplete personal data |
| Right to erasure | Request deletion of your personal data where there is no legitimate reason to continue processing it |
| Right to restrict processing | Request that we limit how we use your data in certain circumstances |
| Right to data portability | Receive your personal data in a structured, machine-readable format (where processing is based on consent or contract) |
| Right to object | Object to processing based on legitimate interests, including analytics and service improvement |
| Right to lodge a complaint | Lodge a complaint with the Information Commissioner's Office at ico.org.uk if you believe your rights have been violated |
Security
We implement industry-standard technical and organisational security measures, including:
Automated analysis and your choices
The Page Quality Analyzer uses automated rules and AI-assisted analysis to produce explanatory scores and recommendations. These results are not used to make decisions about your legal rights, employment, credit, insurance, or access to essential services. You can choose not to submit a URL, and you may ask us to explain or review information associated with your account by contacting the privacy team.
- HTTPS encryption for all data in transit
- Bcrypt hashing for all stored passwords — plain-text passwords are never stored or transmitted
- Access controls limiting data access to authorised personnel only
- Session tokens with short expiry and server-side invalidation on sign-out
- Rate limiting on authentication endpoints to prevent brute-force attacks
No method of data transmission over the internet is 100% secure. We cannot guarantee absolute security, but we continually review and improve our security practices.
Children
Our services are not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@pageonebrand.com and we will delete it promptly.
Changes to this policy
We may update this policy from time to time. When we do, we will post the updated version here with a revised "Last updated" date. For significant changes, we will notify authenticated users by email or through a clear notice in the service where appropriate. The updated policy will explain the effective date and the material change. Your rights under applicable data-protection law are not reduced by continued use of the service.
| Date | Change |
|---|
| August 2026 | Added Google Analytics 4 disclosure and cookie table. Added legal basis for processing section. Expanded data retention schedule. Added user rights table. Added third-party processor table with privacy policy links. Added changelog. |
| January 2026 | Initial policy published. |
Contact us
Questions about this policy or how we handle your data? Contact our privacy team at privacy@pageonebrand.com, or use our contact page. We aim to respond to all privacy enquiries within 5 business days.
To exercise your data rights, email privacy@pageonebrand.com with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and respond fully within 30 days.