Privacy policy

1. Who we are

Recommended by Agents is a trading name of [LEGAL_ENTITY_NAME], [REGISTERED_ADDRESS]. In this policy, "we" and "us" mean that business.

We are the controller of the personal data described here. That means we decide why and how it is used, and we are responsible for it.

This policy covers this website, www.recommendedbyagents.com, including the free readiness check. It does not cover the work we do for clients. That is covered by the agreement we sign with each client.

For anything about privacy, email hello@recommendedbyagents.com. We are a small business and have not appointed a data protection officer.

2. What we collect and why

You can read the whole site without telling us who you are. We collect personal data in the situations below and nowhere else.

Forms you send us

Each form also sends a label saying which form it was. Forms contain a hidden field that people never see. If a bot fills it in, the submission is dropped and nothing is sent.

Forms are delivered to us by Formspree, a form-handling service. Formspree receives what you typed, along with technical details such as your IP address, and passes the submission to our email inbox.

The free readiness check

When you run the check, your browser sends us one thing: the URL you typed. Our server function then fetches that public page, plus the same site's /robots.txt and /llms.txt. It analyzes them in memory and returns a score to your browser.

• We do not store the URL, the fetched page or the result. There is no database behind the check. Our code writes nothing to disk.
• Our code only logs unexpected internal errors, so we can fix them.
• To stop abuse, the function keeps a short list of request times per IP address in memory. The limit is 10 checks per minute. Entries expire after a minute, and the list disappears when the server instance shuts down.
• The pages we fetch are never shown to anyone else. Only derived facts come back to you, such as the score and short values like the product name and price.
• Our host, Vercel, keeps its usual request logs for this function, as it does for every page. See below.

If JavaScript is turned off in your browser, the check form cannot run the live check. It sends the URL to us through Formspree instead, like any other form.

Please only submit URLs of public pages. More detail is on the Security page and in the Terms.

Analytics

We use Google Analytics 4 to understand which pages people read and where they came from. It only loads after you click "Accept analytics" in the cookie banner. If you decline, or make no choice, Google Analytics does not load, sets no cookies and receives nothing from your visit. See section 9. Once you accept, it runs on every page and collects:

• Pages viewed and time on page. Where Google's standard "enhanced measurement" is on, also scrolling and clicks on links that leave the site.
• The page or site that referred you.
• Browser, device type, screen size and language.
• Your approximate location, such as city and country. Google works this out from your IP address. Google Analytics 4 does not log or store the IP address itself.
• A random ID stored in a cookie, so that repeat visits count as one visitor.

We also send a few events of our own:

• generate_lead: a form was submitted. It carries the name of the form, such as "contact-page".
• readiness_check_result: a check was run. The event carries the score, the grade and whether the page was read as a product page. It does not carry the URL you checked.
• email_click: one of our email links was clicked.

We do not send Google what you typed into a form. Your name, email, message and the URLs you check never go to Google Analytics.

Our Google Analytics property is not linked to a Google Ads account, and we do not run advertising or remarketing tags on this site.

Server logs

The site is hosted by Vercel. Like any web host, Vercel processes your IP address, browser user agent, the page requested and the time of the request. It does this to deliver the site and keep it secure. We do not use these logs to identify visitors.

Booking a call

"Book a call" links open Calendly in a new tab. Calendly collects what you enter there, such as your name, email and chosen time, and sends us the booking. Calendly is a separate service with its own privacy notice.

Email

If you email us, we receive your address and whatever you write. We use it to reply and to keep a record of the conversation.

What we do not collect

• There are no user accounts, so there are no passwords.
• We do not take payments on this site, so we do not collect card details.
• We do not ask for sensitive information, such as health data. Please do not send us any.
• We do not buy data about you from anyone.
• Our fonts are hosted on this site. Loading a page does not contact Google Fonts or any other font service.

3. Our legal bases

UK and EU data protection law requires a legal basis for each use of personal data. These are ours.

Where we rely on legitimate interests, you can object. See your rights.

4. Who else handles your data

We use a small number of providers to run the site. They process data for us, under their own terms and data processing agreements. We do not give personal data to anyone else, unless the law requires it or you ask us to.

If we take on a new provider that handles personal data, we will add it here.

5. International transfers

Our providers are based in the United States, so your data is likely to be processed there and in other countries where they operate.

When personal data leaves the UK or the European Economic Area, it has to be protected by an approved safeguard. Our providers rely on the EU-US Data Privacy Framework and its UK Extension where they are certified, and on standard contractual clauses otherwise. You can ask us which safeguard applies to a particular provider.

6. How long we keep it

• Enquiries, call requests and report requests: for as long as we are in conversation, and up to two years after our last contact. If you become a client, the records follow the client agreement instead.
• Index sign-ups: until you unsubscribe or ask us to remove you.
• Form submissions held by Formspree: Formspree keeps a copy in our account until we delete it. We delete them in line with the periods above.
• Readiness check: nothing is stored by us. Rate limit entries last about a minute in memory.
• Analytics: Google Analytics keeps data tied to a cookie ID for the retention period set in our account, which Google caps at 14 months. The cookies themselves last up to two years.
• Server logs: kept by Vercel for a short period under its own retention rules.
• Business records: as long as tax and accounting law requires.

7. Your rights

If you are in the UK or the EU

You have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct it.
• Ask us to delete it.
• Ask us to restrict how we use it.
• Object to our use of it, where we rely on legitimate interests.
• Withdraw consent at any time, where we rely on consent.
• Receive the data you gave us in a portable format.

To use any of these, email hello@recommendedbyagents.com. It is free. We will reply within one month. We may need to confirm who you are first.

You can also complain to your data protection regulator. In the UK that is the Information Commissioner's Office. In the EU it is the authority in your country. We would appreciate the chance to put things right first.

If you are in California or another US state with a privacy law

• We do not sell personal information. We have not sold any in the past 12 months.
• We do not share personal information for cross-context behavioral advertising.
• The categories we collect are: identifiers (name, email address, IP address, cookie IDs), internet activity (pages viewed on this site), approximate location, and the business details you choose to send us. Sections 2 and 4 say where each comes from, why we use it and which providers receive it.
• You can ask to know what we hold about you, to correct it, or to delete it. Email hello@recommendedbyagents.com.
• We will not treat you differently for using these rights.

Some US state laws only apply to businesses above a certain size. We offer these rights to everyone anyway.

8. How we protect it

The site is served over HTTPS. We do not run a database of visitor data. Form submissions go to Formspree and then to our inbox. The full picture is on the Security page.

No website is perfectly secure. If a breach ever put your data at risk, we would tell you and the regulator as the law requires.

9. Cookies and browser storage

Analytics cookies are only set after you accept them. On your first visit a small banner asks whether we may switch on Google Analytics. Until you click "Accept analytics", Google Analytics does not load, no analytics cookies are set and nothing is sent to Google. If you click "Decline", it stays that way: declining sets no analytics cookies.

We remember your choice in your browser's local storage, under the name rba-consent, for six months. After that we ask again. We also ask again if the way we use cookies changes. If your browser blocks local storage, for example in some private browsing modes, the banner appears on each visit and analytics stays off unless you accept.

If your browser sends a Global Privacy Control signal, or a Do Not Track signal, we treat that as "Decline" and do not show the banner. You can still opt in with the "Cookie settings" link.

We do not use advertising cookies, social media pixels or session recording tools.

Apart from rba-consent, we do not use local storage. If you open Calendly or another linked site, that site sets its own cookies under its own policy.

How to change your choice or switch analytics off

• Click "Cookie settings" in the "Legal" list in the footer of any page. The banner opens again, shows your current choice and lets you change it.
• If you switch from "Accept" to "Decline", we stop sending data to Google Analytics straight away and delete its _ga and _ga_* cookies from your browser.
• Block or clear cookies for this site in your browser settings.
• Install Google's Analytics opt-out add-on.
• Use a content blocker. The site works the same without analytics.

10. Children

This is a business website. It is not aimed at children, and we do not knowingly collect data from anyone under 16. If you think a child has sent us personal data, email us and we will delete it.

11. Changes to this policy

When we change how we handle data, we will update this page and the date at the top. If a change is significant, we will say so clearly on this page.

12. Contact