Privacy Policy

1. Who we are

PageGlass is operated by FourFourFive Limited, a company registered in Scotland, with its registered office at FourFourFive Ltd, 4 Hughes Close, Edinburgh, EH7 4FU. We are the data controller for the personal data described in this policy.

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC118959.

If you have any questions about how we handle your data, you can contact us at ben@445innovation.com.

2. What data we collect

a) Account data (provided by you)

When you create an account, we collect your name, email address, username, company name, and profile picture. If you sign in with Google, we receive your name and email from Google.

b) Billing data

We store a Stripe customer identifier and your subscription status (plan type, billing period, cancellation state). We do not store your card number, bank details, or full billing address - these are held securely by Stripe, our payment processor.

c) Marketing attribution data

When you sign up, we capture the UTM parameters, Google Click Identifier (GCLID), and landing page URL from your visit. This helps us understand which marketing channels are effective. This data is linked to your account.

d) Site configuration data

For each site you connect to PageGlass, we store the domain name, origin server URL, DNS configuration, and any custom robots.txt or sitemap.xml content you provide.

e) Service usage data (generated automatically)

As part of operating the service, we generate and store:

• Crawl logs - which bots visited your site, which pages they accessed, and whether the page was served from cache
• Cache records - which pages have been rendered, their size, and when they expire
• SEO audit results - page-level issues detected during audits you initiate
• Rate limit records - a hash of your IP address (not the full IP) used for abuse prevention

f) AI tool inputs (when you use them)

The dashboard includes optional AI-assisted tools (such as the article writer and the per-issue fix walkthroughs). When you use these tools, the text you submit (page content, draft topics, prompts) is sent to a large language model provider for processing - by default Anthropic's Claude API, with OpenRouter available as an alternative routing layer. The provider returns a generated response which we display to you and store against your account so you can return to it later. We do not train any model on your data. AI tool usage is opt-in: nothing is sent to a model unless you actively click into a tool and submit content.

g) Analytics data

We use PostHog (EU-hosted in Frankfurt) for product analytics, including page views, engagement signals, heatmaps, and session replay. Session replays mask all input fields and all text content (so we cannot see what you type or read sensitive content from your screen). The lawful basis is our legitimate interest in understanding product usage to diagnose issues and improve the service. You can opt out at any time by visiting any page with ?ph_optout=1 appended to the URL, which permanently disables PostHog for your browser across pageglass.dev. If you accept cookies via our consent banner, we additionally enable Google Analytics 4 (page views and events) and Google Ads conversion tracking. See the Cookies section below for full details.

3. Our lawful bases for processing

Under UK data protection law, we must have a lawful basis for processing your personal data. We rely on the following bases:

• Performance of a contract - Processing your account data, billing data, site configuration, and service usage data is necessary to provide thePageGlass service to you.
• Legitimate interests - Rate limiting and IP hashing for security and abuse prevention. Marketing attribution data to understand and improve our marketing. Product analytics, heatmaps, and session replay via PostHog (EU-hosted, with full input and text masking). These interests do not override your rights and freedoms; you can opt out of PostHog at any time using the URL parameter described in section 2f.
• Consent - Cookied analytics (Google Analytics 4) and advertising conversion tracking (Google Ads) are only activated when you explicitly accept cookies via our consent banner. You can withdraw consent at any time by clearing your cookies.

4. How we use your data

We use your data for the following purposes:

• Providing and operating the prerendering service
• Processing subscription payments and managing your billing
• Sending transactional emails - welcome messages, password resets, trial expiry reminders, site connection confirmations, and organisation invitations
• Responding to contact form submissions and feedback
• Security and abuse prevention (rate limiting, input validation)
• Improving the service through analytics (with your consent)
• Measuring advertising effectiveness through conversion tracking (with your consent)

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Cookies and similar technologies

a) Essential storage

These are necessary for the service to function and do not require consent:

• cookie_consent - Stores your consent preference (accepted or rejected). Set on the .pageglass.dev domain, expires after 1 year. SameSite=Lax, Secure.
• Authentication tokens - Stored in your browser's local storage (not as cookies) to keep you signed in. These are removed when you sign out.
• Cloudflare Turnstile - A CAPTCHA service used on our contact form to prevent spam. This may set short-lived cookies during the verification process.

b) Analytics (consent required)

These are only set if you click "Accept" on our consent banner:

• Google Analytics 4 - Measures page views and interactions. Includes cross-domain tracking between pageglass.dev and go.pageglass.dev.
• PostHog (product analytics, heatmaps, session replay) - PostHog runs under legitimate interest, not consent — see section 2f. It sets a persistent identifier cookie on .pageglass.dev to enable cross-session continuity for product analytics. To opt out, visit any page on pageglass.dev with ?ph_optout=1 appended to the URL.

c) Google Consent Mode v2

We implement Google Consent Mode v2. By default, all storage types (ad storage, analytics storage, ad user data, ad personalisation) are denied. They are only granted when you explicitly accept cookies. If you reject cookies, all storage remains denied and no analytics or advertising cookies are set.

d) Managing your preferences

You can withdraw your consent at any time by clearing your browser cookies for pageglass.dev. The consent banner will reappear on your next visit. You can also configure your browser to block or delete cookies. Rejecting analytics cookies does not affect the functionality of the PageGlass service.

6. Third-party data processors

We share your data with the following processors, who act on our instructions under appropriate data processing agreements:

We do not sell your personal data to anyone. Data is only shared with processors as described above, and only to the extent necessary for them to perform their function.

7. Data retention

We retain different types of data for different periods, depending on their purpose:

8. International data transfers

Your core account and service data is stored in the EU (via Supabase) and session analytics are processed in the EU (via PostHog in Frankfurt).

Some of our processors are based in the United States (Stripe, Resend, Google). Where data is transferred to the USA, these transfers are protected by appropriate safeguards, including the UK Extension to the EU-US Data Privacy Framework, UK Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreements (IDTAs) as applicable to each processor.

Cloudflare processes data across its global edge network. Data may be transiently processed in multiple jurisdictions as part of CDN operations, protected under Cloudflare's data processing agreement.

9. Your rights

Under UK data protection law, you have the following rights:

• Right of access - You can request a copy of the personal data we hold about you.
• Right to rectification - You can update your personal data through your account settings, or ask us to correct inaccuracies.
• Right to erasure - You can delete your account from your account settings. This permanently removes all your data (see section 10 below). You can also request erasure by contacting us.
• Right to restrict processing - You can ask us to limit how we use your data in certain circumstances.
• Right to data portability - You can request a copy of your data in a structured, commonly used format. Contact us at ben@445innovation.com to make a portability request.
• Right to object - You can object to processing based on legitimate interests.
• Rights related to consent - Where we process data based on consent (analytics, session recording), you can withdraw consent at any time by clearing your cookies.

To exercise any of these rights, contact us at ben@445innovation.com. We will respond within 30 days.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Account deletion

You can delete your account at any time from your account settings. Deletion is permanent and irreversible. When you delete your account:

• Your active Stripe subscription is cancelled immediately
• All your personal data, sites, crawl logs, cache entries, and audit results are permanently deleted
• Any organisation membership is removed (if you are an organisation owner, you must transfer ownership or delete the organisation first)

Account deletion is processed promptly. Some data may persist in encrypted backups for a short period as part of our standard infrastructure, but is not accessible or used.

11. Organisations and team data

When you create or join an organisation:

• Organisation members share a single subscription but do not have access to each other's sites or data
• Your name, email, and role within the organisation are visible to other members
• The organisation owner can remove members and manage roles
• Organisation invitations include the inviter's name and the organisation name

12. How we protect your data

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• Row-level security on all database tables, ensuring users can only access their own data
• Multi-factor authentication (TOTP) available for all accounts
• Input validation on all API endpoints to prevent injection attacks
• HTML sanitisation to prevent cross-site scripting (XSS)
• Rate limiting on public-facing endpoints
• CORS restrictions limiting which domains can make API requests
• Encryption in transit (TLS) and at rest (provided by our database infrastructure)
• Passwords are never stored in plain text

13. Children's privacy

PageGlass is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

14. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email or an in-app notification. The "Last updated" date at the top of this page will always reflect the most recent version.

15. Contact

For any questions about this Privacy Policy or how we handle your data, contact the data controller:

FourFourFive Limited
FourFourFive Ltd, 4 Hughes Close, Edinburgh, EH7 4FU
ICO registration: ZC118959

Email: ben@445innovation.com