PRIVACY
Last updated:
IsAgentReady.com is operated by Bart Waardenburg, based in The Hague, the Netherlands. This statement describes which data the service processes, why, for how long, with which processors, and which rights you have under the GDPR. The service is designed to process as little personal data as possible: scanning requires no account and optional analytics run only with your consent.
Private site audits and payments
Paid site audits store the submitted website URL, payment identifiers, selected page limit and private page reports. Stripe processes the one-off payment; we do not store payment card details. A functional browser session or a saved private access link authorizes access to the report and its included recheck. Anyone who possesses that link can use these rights. Reports and payment records are retained without an automatic expiry; you can request deletion through the contact page, subject to applicable payment record obligations. Buying an audit does not subscribe you to a newsletter.
Website scans
A scan only fetches publicly reachable pages and discovery files (such as robots.txt, sitemap.xml, llms.txt and /.well-known documents) of the submitted domain, the same way a crawler does. The results (scores, findings, recommendations, fetched headers and HTML fragments kept as evidence) are stored and are publicly visible in the report and the rankings. No credentials are used and forms are never submitted. Domain owners can have a report rescanned, removed from the rankings or deleted through the contact page; ownership is verified with a DNS or file challenge.
Emailed reports and leads
When you request a PDF report we store your email address and, optionally, your company name to deliver the report and verify the address. Every email contains an unsubscribe link; unsubscribe links stay valid for 90 days. Your address is never sold or shared for third-party marketing. Deletion can be requested through the contact page.
Monitoring
To monitor your own site, we process your confirmed email address, site-verification state, selected checks, scheduled checks, and email-delivery records. A random opaque session value in a functional cookie gives you private browser access and is revoked when you sign out. Operational emails provide private access and alert you only when an important selected result changes, recovers, or needs action. Monitoring setup does not enroll you in advertising or marketing. Optional webhook channels and outcome data that you add through the owner API remain private and can be deleted. Deleting monitoring removes its private history and pending setup data for that site.
Analytics and error tracking
With your consent, PostHog measures public page visits and accepted browser scan requests and their viewed outcomes. Events contain a random session identifier, language, device category, public page type or blog slug, and a recognized referral service. Scanned domains, input values, email addresses, query strings and private access links are excluded. Private audit, monitoring and workspace pages are excluded. We do not enable session recordings, automatic click tracking, advertising or identified person profiles. PostHog necessarily receives your network address to deliver requests; geographic enrichment is disabled. Your choice is saved for 180 days. A random session identifier and temporary scan correlation are saved in this tab only after permission. You can withdraw permission through Analytics settings; Do Not Track and Global Privacy Control are honored. Application errors are recorded with Sentry; error reports can contain an IP address and request details and are deleted automatically after a limited period.
Technically necessary data
The application sets one functional session cookie (_isagentready_key) to protect forms and to keep a per-browser scan quota. IP addresses are used briefly for rate limiting and security and are not kept as a profile. No advertising or tracking cookies are set.
Processors and hosting
The application and database run on Fly.io in the Amsterdam region. PDF reports are stored in Tigris object storage (through Fly.io). Emails are sent through Resend. Analytics run on PostHog (EU hosting) and error tracking on Sentry. Data processing agreements apply to these providers and data is processed within the EU unless the provider documents otherwise.
Retention
Scan results are retained to show history and rankings; stale and unfinished scans are cleaned up periodically. Lead data is kept while you are subscribed or until you request deletion. Monitoring data is kept for as long as the monitor exists. Unfinished monitoring setups expire after 24 hours, access links expire after 30 minutes, and expired records are deleted by an hourly cleanup. Analytics events are retained for up to one year. Server logs and error reports are deleted automatically after a limited period.
Your rights
You have the right to access, rectify, erase, restrict and object, and to port the data you supplied yourself. Requests can be submitted through the contact page; we normally respond within two working days and at the latest within one month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
This statement may change as the service changes. The date at the top marks the latest revision. Material changes for subscribed users are announced by email.
Contact
Questions about privacy, or want to submit a request? Use the contact page.