This Privacy Policy explains how Bouncing Bean Ltd ("we", "our", "us"), operating SortMySite (sortmy.site), collects, uses, and protects your personal data. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Bouncing Bean Ltd
Contact: [email protected]

1. What Data We Collect

Email address — provided when you request scan results or purchase a service.
Website URLs — the URLs you submit for scanning.
Scan results — the output generated from scanning your submitted URLs.
Payment information — processed and stored by Paddle (our payment processor), not by us directly. We receive confirmation of payment and your email address from Paddle.

We do not require you to create an account. We do not collect names, physical addresses, or phone numbers unless you provide them voluntarily.

2. Why We Collect It

Email address — to send you scan results and purchased reports. Legal basis: legitimate interest / contract performance.
Website URLs — to perform the scan you requested. Legal basis: contract performance.
Scan results — to deliver the service and generate reports. Legal basis: contract performance.
Payment data (held by Paddle) — to process your purchase. Legal basis: contract performance.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Data Processors

We use the following third-party services to deliver our product:

Paddle (Paddle.com Market Limited) — payment processing, billing, and tax compliance. Paddle acts as the merchant of record.
Postmark (ActiveCampaign LLC) — transactional email delivery for sending scan results and reports.
Google PageSpeed Insights (Google LLC) — website performance analysis. The URLs you submit are sent to Google's API as part of the scan.

4. Cookies

We use a single essential cookie:

Laravel session cookie — required for the website to function. This is a session cookie that does not track you and is not used for analytics or advertising.

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

5. Data Retention

Email addresses and scan results — retained for 12 months from the date of your last interaction, after which they are deleted.
Purchase data — retained for 24 months for customer support purposes.
Payment records — retained by Paddle in accordance with their own retention policies.

6. Your Rights

Under UK GDPR, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — request correction of inaccurate data.
Erasure — request deletion of your data ("right to be forgotten").
Portability — request your data in a structured, machine-readable format.
Object — object to processing based on legitimate interest.
Restrict processing — request that we limit how we use your data.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. International Transfers

Some of our data processors (Postmark, Google) are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions, in compliance with UK GDPR.

8. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), secure server infrastructure, and restricted access to personal data.

9. Children

Our service is not directed at individuals under 18. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent version.

11. Contact

For any questions about this Privacy Policy or your personal data, contact us at [email protected].