Privacy notice

1. Who we are

DD SiteGuard is provided by DD Network, a brand of Bascora Ltd. For privacy questions or requests, contact support@ddnetwork.co.uk.

Depending on the information and the reason it is used, Bascora Ltd may act as a data controller for account, billing, security, and service-operation information, and may process website data on a customer’s instructions to provide an audit.

2. Personal data we use

We use information you provide, information created by use of the service, and information returned by websites you ask us to audit. This may include:

• Account details: your name, email address, password hash, account identifiers, and account or subscription status.
• Billing references: selected plan, Stripe customer and subscription identifiers, checkout status, and payment-related records. Stripe handles card details; DD SiteGuard does not store your full card number.
• Audit information: submitted website URLs and host names, pages and responses crawled, audit status and timing, scan allowance usage, findings, evidence, and report history.
• Shopify crawler settings: the store name and domain, signature values, signature-agent information, and expiry date you choose to save. The signature and signature-input values are encrypted in the application database.
• Google Search Console connection: selected property URLs and permission levels, plus encrypted Google access and refresh tokens. If you connect Search Console, reports may include the returned search-performance metrics, such as clicks, impressions, click-through rate, average position, and available query context.
• Agency and monitoring settings: an Agency name and logo, client names and associated audit history, share-link access records, scheduled scan frequency, and the latest monitoring result.
• Technical and session information: sign-in session data, IP address, browser user-agent, and operational or security logs needed to run and protect the service.
• Support and service messages: information you send to support and details used to deliver audit completion or Shopify credential expiry notices.

Only submit URLs, website responses, and store access details that you are authorised to provide. A page you ask us to audit may itself contain personal data; you are responsible for having an appropriate basis to ask us to process it for your audit.

3. How and why we use information

• To create and secure accounts, authenticate users, and provide support.
• To crawl submitted websites, generate audits and reports, compare findings, and apply plan limits.
• To request read-only Search Console data for a selected matching property, add available performance context to reports, and temporarily cache those changing metrics. Search data does not change technical issue severity or audit scores.
• To run scheduled scans for eligible plans, record their outcomes, and identify newly found critical issues.
• To set up subscriptions, process payments, manage billing, and maintain scan-credit and subscription records.
• To send service messages, including audit completion notices and reminders about expiring Shopify crawler access.
• To protect the service, investigate abuse or faults, keep operational records, and meet legal or accounting obligations.
• To measure paid subscription activations and service reliability through limited analytics where that integration is configured.

Where UK data protection law applies, we generally rely on the need to perform our contract with you, our legitimate interests in operating and protecting the service, and compliance with legal obligations. Where consent is required by law, we will ask for it before the relevant processing.

4. Who receives information

We share information only as needed to provide and protect DD SiteGuard, process a payment, respond to a lawful request, or carry out an action you request. Relevant service providers include:

• Replit: hosts and runs the application and its supporting services. See the Replit Privacy Policy.
• Stripe: processes subscription checkout, payment, and billing-management requests. Stripe receives the information needed to create and manage your subscription. See the Stripe Privacy Policy.
• Google: when you connect Search Console, Google handles the account authorization and receives read-only Search Console API requests for the property and report data you select. See Google’s Privacy Policy.
• Umami: when the analytics integration is configured, receives a server-side subscription-activation event containing the selected plan and a stable event reference. This event does not include your email address or audit findings. See the Umami Privacy Policy.
• Transactional email: the published configuration does not identify an external email delivery provider and falls back to the application's log mailer. Transactional messages may therefore be written to application logs instead of being delivered by email.
• Websites you ask us to audit: our crawler sends requests to the relevant website. If you enable Shopify crawler access, the saved signature is sent in an authorization header only to the matching store host for eligible crawl requests. The website operator may log these requests and their technical details.

Agency report links are read-only and expire after 30 days unless revoked sooner. Anyone holding an active link can view the shared report, so share it only with the intended recipient.

We may also disclose information where required by law, to protect users or the service, or as part of a business transfer, subject to applicable law.

5. Cookies and analytics

DD SiteGuard uses essential session and security cookies to keep you signed in, remember session state, and protect forms. These are needed for the service to work.

When configured, subscription-activation analytics are sent server-to-server to Umami and do not rely on a browser tracking cookie. The application’s analytics event contains a plan identifier and event reference, not your email address or audit findings. Third-party payment pages and links may use their own technologies under their providers’ policies.

6. How long we keep information

We keep information for as long as needed to provide the service, maintain your account, meet legal or accounting obligations, resolve disputes, and protect the service. The exact period depends on the type of information and your plan.

• Audit reports and findings are available in history for 30 days on Starter, 90 days on Professional, and without a fixed plan limit on Agency. When a plan's history window expires, reports and findings are not automatically erased: they become unavailable on that plan and may become accessible again after an upgrade. You can delete individual reports. A minimal anonymised scan-usage record may remain to administer scan allowances and billing.
• Saved Shopify crawler settings remain until you remove them or they are no longer needed. Expired credentials may remain in your settings until deleted, but should not be relied on for crawling.
• Google Search Console tokens and selected-property records remain while the connection is saved. Disconnecting deletes the SiteGuard connection and property records and requests token revocation from Google. Search-performance results are temporarily cached for up to 15 minutes and are not stored as permanent audit findings.
• Agency names, logos, client groupings, and report-sharing records remain while needed to provide those features. Share links expire after 30 days or can be revoked sooner.
• Scheduled monitoring settings and run summaries remain while the schedule and related account records are kept.
• Account and billing records may be kept after cancellation for legal, accounting, fraud-prevention, and dispute-resolution purposes.
• Transactional messages may be written to application logs under the current mail configuration. Application logs and sent-message debugging entries are typically rotated or purged daily and are retained for no more than 30 days.
• Incomplete signup and session records are kept only for the period needed to complete signup, maintain security, or operate the service. Exact deployment-specific periods have not been confirmed.

7. Security

We use access controls and technical measures intended to protect information. Account passwords are stored as one-way hashes, and saved Shopify signature values are encrypted by the application. No method of storage or transmission can be guaranteed to be completely secure.

Please use a strong, unique password, keep your sign-in details private, and contact us promptly if you suspect unauthorised access to your account.

8. International transfers

Some service providers process information outside the United Kingdom. The safeguards below are based on the confirmed deployment region and provider terms; the transfer mechanism used for a particular transfer depends on the applicable agreement and circumstances.

• Replit: this deployment is hosted in Replit's Europe (EU) managed cloud region. Replit's Data Processing Agreement refers to the EU Standard Contractual Clauses and, where applicable, the UK Addendum or UK International Data Transfer Agreement. See the Replit Data Processing Agreement.
• Stripe: its Data Processing Agreement and Data Transfers Addendum provide for the EU-U.S. Data Privacy Framework, the UK extension to that framework, and the UK International Data Transfer Agreement, as applicable. See Stripe's Data Processing Agreement and Data Transfers Addendum.
• Google: this integration uses Google OAuth and Search Console APIs. The processing location and applicable transfer mechanism can depend on Google's services and terms; the specific transfer arrangements for this integration have not been independently verified in this draft. See Google’s Privacy Policy.
• Umami: its published Data Processing Agreement refers to EU Standard Contractual Clauses and a UK Addendum where applicable. Umami Cloud offers EU and US server regions, but the analytics integration is not configured in this deployment, so the application is not currently sending its subscription-activation event to Umami. See the Umami Data Processing Agreement.

9. Your privacy rights

Depending on the law that applies, you may have the right to request access to, correction of, or deletion of your personal data, to restrict or object to certain processing, and to receive certain data in a portable format. Where we rely on consent, you may withdraw it; this does not affect processing that took place before withdrawal.

To make a request, email support@ddnetwork.co.uk. We may need to verify your identity and may retain information where the law permits or requires it. You may also complain to the UK Information Commissioner’s Office (ICO).

10. Children

DD SiteGuard is intended for business and professional use and is not designed for children. If you believe a child has provided personal data through the service, contact us so we can review it.

11. Changes to this notice

We may update this notice as the service or its providers change. We will publish the current version here and update its effective date. If a change materially affects how we use personal data, we will provide any additional notice required by law.