Privacy Policy

Controller: YOUR EVENINGS LTD (trading as Is My Agent Safe), a company registered in England and Wales, company number 17185055. Registered office: 66 Paul Street, London, England, EC2A 4NA. ICO registration number: [to be added after paying the data protection fee].

Service: Is My Agent Safe (ismyagentsafe.com)

Contact: hello@ismyagentsafe.com (please put "Privacy" in the subject line)

1. What we collect

Data	Why	Legal basis (UK/EU GDPR)
Email address	Send your result/report, receipts, alerts; newsletter only if you opt in	Contract; consent (newsletter)
Audit output, version and config you paste (with secrets hidden first)	Run the check and write your report	Contract
Addresses you ask us to check, verification proof, your authorization confirmation, your IP and time	Run outside checks only on systems you control; prevent abuse; keep a record of consent	Contract; legitimate interests (security, abuse prevention); legal obligations
Payment status (from our payment provider; we don't receive full card numbers)	Billing, refunds, tax records	Contract; legal obligation
Basic technical logs	Keep the Service running and secure	Legitimate interests
Newsletter sign-up (email, time, the page you signed up on)	Send the newsletter you asked for; prove your consent	Consent (you can unsubscribe in any email)
"Email me this result": your email and the free result summary	Send you that one email. We don't add you to any list unless you separately tick the newsletter box, which is unticked by default	Your request (contract); consent (newsletter, only if ticked)
Where you came from: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content or a short "ref" code), the referring website's name (not the full address) and the first page you visited	Count, in aggregate, which channels bring people to the check and which lead to purchases. Kept in your browser's session storage (not a cookie, cleared when you close the tab), sent with your check, stored with the check result, and added to the payment record at Stripe. This never includes your email or what you pasted	Legitimate interests (understanding which channels work); you can object by emailing us

Aggregate statistics. We may publish anonymized, aggregate statistics built from free checks (for example, "X% of checks found the gateway reachable without a password"). These are counts across many checks only. We never publish or share anything about an individual agent, host, IP address, configuration or installed skill, or anything that could identify you, and we only publish a percentage once it's based on at least 100 checks. Our legal basis is legitimate interests (helping people understand common risks); you can object by emailing us. Results of our sample audit ("Try it with a sample audit") are never included.

We don't sell your personal information, and we don't "share" it for cross-context behavioral advertising. We don't use your data to train AI models.

2. Secrets

Our check page hides values that look like API keys, tokens and passwords in your browser before sending. We run the same filter again on our side. We store only a hidden marker and, at most, the last 4 characters so you can tell which key to rotate. Please don't paste secrets.

3. How long we keep data

Check results and reports: 90 days, then deleted (longer only if you ask us to keep them for monitoring).
Technical logs: 30 days.
Consent and verification records for outside checks: kept for as long as needed to show the check was authorized (proposed: 2 years). [Lawyer to confirm.]
Billing records: as long as tax law requires (in the UK, generally 6 years).

Providers acting on our instructions: Cloudflare, Inc. (website hosting, database, security, cookieless web analytics and, if we switch to it, transactional email; global network, US company), Stripe Payments Europe / Stripe, Inc. (payments), Resend (Plus Five Five, Inc., US; transactional email, if used), and beehiiv, Inc. (US; newsletter, only if you subscribe). [Lawyer to confirm the final list, entities and DPAs before publication.] We may disclose data if the law requires it.

5. International transfers

We're based in the UK and serve customers worldwide. Where data is transferred outside the UK/EEA, we use appropriate safeguards such as the UK International Data Transfer Addendum / EU Standard Contractual Clauses, or adequacy decisions.

6. Your rights

UK/EU: access, correction, deletion, restriction, objection, portability, and withdrawing consent at any time. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.
California (CCPA/CPRA) and other US states with privacy laws: the right to know what personal information we collect and how we use it, to delete it, to correct it, and to opt out of sale or sharing (we don't sell or share). We won't discriminate against you for using these rights. You may use an authorized agent.
To use any right, email hello@ismyagentsafe.com. We'll verify your request and reply within the time the law requires (generally 1 month under GDPR, 45 days under CCPA).

7. Cookies

The site uses only cookies that are strictly necessary for it to work. To remember where you came from, we use your browser's session storage (see §1), not a cookie. [Lawyer to confirm whether PECR applies to this storage.] For analytics we use Cloudflare Web Analytics, which is cookieless: it sets no cookies, doesn't use local storage or fingerprinting, and doesn't track you across sites. It gives us aggregate figures only (such as page views, referring sites, country and page load times), not a profile of you. Cloudflare processes this data for us as our processor. The legal basis is our legitimate interest in understanding how the site is used, and you can object at any time (or block static.cloudflareinsights.com). [Lawyer to confirm whether PECR consent is needed for the beacon.]

8. Children

The Service isn't for anyone under 18.

9. Changes

We'll post changes here and email paying customers about material changes.