SiteVerdictPrivacy policy
Last updated: 13 October 2026
This policy explains how SiteVerdict handles personal data. SiteVerdict is a trading name of BharatFare Travel and Technologies Ltd (company no. 16716642, Plymouth, United Kingdom), trading as SiteVerdict. We are the controller for the personal data described here. Contact: aman.thakran@bharatfare.com.
In short
- We check public websites that our users ask us to check.
- We do not sell personal data or use it for advertising.
- Several of our products (the Chrome extension, the free WordPress checks and the locally run MCP server) send us nothing.
SiteVerdict API, hosted MCP server and website checks
| Data | Why | How long |
|---|---|---|
| Account details for direct customers (name, email, plan) | To provide the service and bill for it | While the account is open, then as required by law |
| RapidAPI customers: RapidAPI's pseudonymous user id and plan | Quotas and support. RapidAPI holds the account and billing data. | While the subscription is active |
| API keys (stored only as a salted hash and a short prefix) | Authentication | Until the key is revoked |
| Usage records: time, check, target URL or domain, credits, status | Billing, quotas, abuse prevention, support | Up to 2 years |
| Scan results | To return results to you | Cache up to 10 minutes; asynchronous job results 7 days |
| Technical logs, including IP address (keys and secrets are removed) | Security and troubleshooting | Up to 30 days |
| Webhook URLs you give us | To deliver your results | Until you remove them |
Hosted MCP sign-in: when you connect an AI app, you paste your own Apify API token on our sign-in page. It is checked once with Apify and then encrypted inside the access token your app holds. We keep no database of these tokens. Disconnecting the app, or changing the token in Apify, ends access.
Websites we scan: results describe public websites. AI-readiness checks do not return email addresses or phone numbers found on pages (only counts). Consent checks record cookie names and domains, not visitor data. Pages can contain personal data (for example names on a team page). Please scan only websites you own, are allowed to test, or are entitled to assess.
MCP server run on your own computer
When you run @siteverdict/mcp yourself (npx, Docker or a desktop app), it sends your request and your Apify token directly to Apify to run the audit on your Apify account. We receive nothing: no telemetry, analytics or crash reports. Apify's privacy policy applies to your Apify account.
Chrome extension (SiteVerdict Inspector)
- It collects, sends, sells and shares no personal or browsing data, and has no analytics or tracking of its own.
- It reads a page only after you click it, and has no access to other tabs.
- Its only network requests are
/robots.txtand/llms.txton the site you are inspecting, sent without cookies. - Only your interface preferences (theme and last tab) are saved, on your device. Results are discarded when you close the panel unless you copy or download them.
WordPress plugin
- It collects nothing about your visitors and adds no cookies or tracking to your public pages.
- Settings and the last report are stored in your own WordPress database and deleted on uninstall.
- Local checks only contact your own website.
- Optional cloud checks (off by default): if an administrator opts in and adds an API key, the plugin sends your public home-page URL, the chosen check names and the API key to the SiteVerdict API. No user accounts, visitor data, passwords or database content are sent. The API section above then applies.
Shopify app
| Data | Why | How long |
|---|---|---|
| Shop domain, store name, primary domain | To know which storefront to check | Until Shopify asks us to delete store data |
| Store contact email | Only to prefill the optional weekly digest address | As above |
| Shopify access token | To run the app | Deleted on uninstall |
| Settings and scan results | To provide the features | Until Shopify asks us to delete store data |
| Theme layout file (read only) | To find tracking code that loads before consent | Not stored; only the vendor name and line number go into a finding |
| Product titles and images missing alt text (read only, up to 20) | Accessibility examples | Inside scan results |
| Compliance webhook log (shop domain, topic, time) | Evidence that we handled deletion requests | 2 years |
The app requests no customer, order or payment access and holds no shopper data. The weekly digest is opt-in and every email has a one-click unsubscribe. About 48 hours after uninstall, Shopify asks us to delete the store's data and we do so automatically.
Emails to us
If you email us, we use your message and address to reply and keep the conversation for up to 2 years.
Lawful bases (UK GDPR)
Contract (providing a service you signed up for), consent (the optional Shopify digest), legitimate interests (security, abuse prevention and improving the service) and legal obligation (tax and accounting records, kept for 6 years).
Who else processes data
- Hostinger (our server host)
- Cloudflare (DNS and email delivery)
- RapidAPI (marketplace, for RapidAPI customers)
- Apify (only where a check runs as an Apify Actor; the target URL and options are sent to Apify)
- Shopify (billing and platform, for Shopify app users)
Where a processor is outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
Your rights
You can ask for access to, correction or deletion of your personal data, restrict or object to its use, or ask for a copy to take elsewhere. Email aman.thakran@bharatfare.com. You can also complain to the Information Commissioner's Office (ico.org.uk).
Children
Our services are for businesses and developers and are not aimed at children under 16.
Changes
We will post changes here and update the date at the top.