Privacy Policy

Who we are

FormedEasy is a website SEO audit service. In this policy, "FormedEasy", "we" and "us" means FormedEasy. We are the controller of the personal data described here, which means we decide how and why it is used.

If you have any questions about this policy or how we handle your data, email hello@formedeasy.com.

What we collect

Your account

• Your name and email address.
• Your password, stored only as a secure one-way hash. We never see or store the password itself.
• Whether your email address is confirmed, and when you last signed in.

Signing in and security

• For each device you sign in on: the IP address, the browser and operating system it reports, and when the session started and expires.
• IP addresses are also used briefly to limit repeated attempts to sign in, register or reset a password. These limits are held in memory and are not stored long term.

Your audits

• The website addresses you ask us to audit and the options you choose.
• The results of each audit: scores, issues, and the addresses of affected pages with details such as page titles or status codes.
• Any Screaming Frog Issues Overview files you import.

Web design enquiries

• If you send us an enquiry from our web design page: your name, email address, company and current website (if you give them), the service you are interested in, your rough budget and your message.
• Your IP address is used briefly to limit how many enquiries can be sent, to stop spam. Like the sign-in limits, this is held in memory and not stored long term.

Emails we send

• When we send you an email such as a newsletter or service update, we keep the email, the list of addresses it was sent to, and whether each one was accepted for delivery.

Paid plans

• Which plan you are on, your subscription status and renewal date, and the reference numbers Stripe gives your customer record and subscription.
• Card and payment details are entered on Stripe's pages and stored by Stripe. We never see or store your full card number.

We do not use analytics, advertising or tracking tools, and we do not build profiles of you.

Websites you audit

When you run an audit, our crawler visits the public pages of the website you entered, as a search engine would. It identifies itself as FormedEasyBot and follows robots.txt unless you turn that option off. It reads what the website's server sends — the HTML, response headers and image sizes — and does not sign in, fill in forms or access anything that is not publicly available.

Reports can contain text that appears on those pages, such as titles and headings. If a page publishes personal information, some of it could appear in your report. Reports are private to your account.

How and why we use it

Under UK data protection law we must have a lawful basis for using personal data. We rely on:

• Providing the service (contract) — creating and running your account, running audits, storing your reports, and sending the emails the service needs, such as confirming your address and resetting your password.
• Payments (contract) — taking payment for a paid plan and keeping your plan in step with your subscription.
• Answering enquiries (steps before a contract, and legitimate interests) — replying to your web design enquiry, preparing a quote and discussing your project with you.
• Emails about our services (consent, or legitimate interests for customers) — newsletters and updates, sent only to people who have agreed to receive them, or to existing customers about similar services where the law allows it.
• Legitimate interests — keeping accounts secure, preventing abuse such as repeated sign-in attempts or overloading websites with audits, and fixing problems.
• Legal obligations — where the law requires us to keep or share information.

We do not sell your personal data. Every marketing email we send is sent to you individually — other recipients cannot see your address — and tells you how to opt out. To stop receiving them, reply to any of our emails or email hello@formedeasy.com. If you opt out, we keep your email address only so we can make sure we do not email you again.

Cookies

We only use cookies that are strictly necessary for the service to work:

• session — keeps you signed in. It lasts up to 30 days and is renewed while you use the service. It contains a random token; we store only a scrambled (hashed) copy of it.
• pending_email — remembers the address we sent a confirmation link to, so we can show it on the "check your inbox" page. It lasts up to 24 hours.

When you pay for a plan you are taken to Stripe's checkout and billing pages, which set their own cookies to process payments securely and prevent fraud.

Because these cookies are essential, we do not ask for consent to set them. We do not use analytics or advertising cookies.

Who we share it with

We use a small number of trusted providers to run the service. They process data only on our instructions and under contracts that protect it:

• Vercel — hosts the website and runs the audits.
• MongoDB Atlas — stores account and audit data.
• Resend — sends our emails: account emails such as confirmation and password reset links, notifications of your web design enquiry to our inbox, and newsletters and updates.
• Stripe — takes payments and manages subscriptions for paid plans. Stripe is also an independent controller of payment data for its own legal obligations, such as fraud prevention; see Stripe's privacy policy.

We may also share information if required by law, or to protect our rights or the safety of others. If FormedEasy is ever sold or merged, your data may transfer to the new owner under this policy.

International transfers

Some of our providers store or process data outside the UK, including in the United States. Where that happens, the transfer is covered by appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.

How long we keep it

• Account and audits — for as long as your account exists. You can delete individual reports at any time.
• Deleting your account — from Settings. Any paid plan is cancelled, and your account, sign-in sessions, pending email links and every report are deleted immediately. Stripe keeps records of past payments and invoices for as long as tax and accounting law requires (usually six years). Copies may remain in our providers' encrypted backups for a limited period before they are overwritten.
• Web design enquiries — while we discuss your project, and for up to two years after we were last in touch, unless you become a customer. You can ask us to delete your enquiry at any time.
• Emails we send — the email, its recipient list and delivery results are kept until we delete that email from our records.
• Sign-in sessions — expire after 30 days without use.
• Email links — confirmation links expire after 24 hours and password reset links after 1 hour. Each works only once.

How we protect it

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt, and session and email tokens are stored only as hashes, so a copy of our database would not let anyone sign in as you. Changing your password signs you out on every device. No system is perfectly secure, but we work to keep your data safe and will tell you and the regulator about any breach where the law requires it.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format.

You can update your name and delete your account yourself in Settings, and export any report as a CSV. For anything else, email hello@formedeasy.com. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

Changes to this policy

We may update this policy as the service changes. The date at the top shows when it was last updated. If we make significant changes, we will let you know by email or in the app before they take effect.

Contact us

Email hello@formedeasy.com with any question about your privacy or this policy.