Insite Found ("we", "us", "our") is an AI-first growth agency operating from Toronto, Ontario, Canada. We are the organization responsible for the personal information described in this policy. You can reach us at hello@insitefound.com.
This policy covers insite-found-preview.pages.dev, the free first look tool at /audit/, the contact form, and any email exchange that starts from them. It does not cover the websites you ask us to check (we only read their public pages, see section 7), or the separate written agreement that governs paid work, which has its own confidentiality terms.
| Where | What | Why |
|---|---|---|
| Contact form | Your name, email address, your website address, which service you are interested in, and any note you add | To reply, and to prepare the free first look you asked for |
| Free first look gate | Your name and email address, plus the website address you checked and the results of that check | To email you the full check-by-check report and to talk to you about it if you reply |
| Whatever you choose to write to us, and your email address | To answer you and keep the thread |
All of this is optional. You can run the free first look and see the scorecard without giving us anything. You only give us your name and email if you want the full report sent to you.
| What | How | Why |
|---|---|---|
| Request logs | Our host, Cloudflare, records the network address, browser user-agent string, page requested and time of each request, the way any web host does | Security, abuse prevention and keeping the site up |
| Form metadata | When you submit a form we store the time, your browser's user-agent string and the network address the request came from alongside the submission | To stop spam and abuse of the tool, and to investigate a request you make about your data |
| Site usage | Google Analytics 4, loaded through Google Tag Manager, records page views, clicks and events on this site, your browser and device details, screen size, language, the page that referred you, and an approximate location derived from a truncated network address | To understand which pages people read, how they arrive and what needs improving |
| Advertising pixels | The Meta Pixel, the TikTok Pixel and the LinkedIn Insight Tag record that a browser visited this site and which pages, set a cookie or identifier, and, if you are logged in to that platform, let the platform match the visit to your account there | To measure whether our own ads on those platforms led to visits, and to show our ads to people who have visited this site (retargeting) |
| Font requests | Our pages load type from Google Fonts, so your browser sends Google a request that includes your network address | To display the site's typefaces. Google's privacy policy applies to that request |
Analytics data is aggregate and we do not connect it to your name or email. The advertising pixels are different: each platform can connect the visit to your account on that platform, under its own privacy policy. We never send them your name, email or anything you typed into a form. Section 6 explains how to opt out of all of it.
We do not buy lists, scrape contact details or collect information about you from data brokers.
We do not use your information for automated decisions that have a legal or similarly significant effect on you. The first look score is an automated reading of a public website; it is not a decision about you.
We do not sell personal information and have not done so. The advertising pixels described in sections 3, 5 and 6 send browsing signals to Meta, TikTok and LinkedIn, which some laws (including California's) treat as "sharing" for cross-context behavioural advertising. You can opt out (section 6) and we honour the Global Privacy Control signal automatically. We do not use your information for any purpose you have not asked for or would not reasonably expect.
Only the service providers we need to run the site and send you what you asked for. Each processes data on our instructions under its own privacy terms.
| Provider | Purpose | What it handles |
|---|---|---|
| Cloudflare | Hosting the site, running the first look tool, and storing form submissions in its key-value storage | Request logs, form submissions, first look results |
| Resend | Sending the first look report and form notifications by email (when enabled) | Your name, email address and the report contents |
| Google Analytics 4 | Measuring site usage in aggregate | Cookies, truncated network address, browser and device details, pages and events |
| Google Tag Manager | Loading the analytics and advertising tags on every page | Passes page and event data to the tags listed here; loads nothing else |
| Meta (Facebook and Instagram) | Measuring our Meta ads and retargeting site visitors on Meta platforms | Pixel cookie and identifier, pages visited, browser details, matched to your Meta account if you are logged in |
| TikTok | Measuring our TikTok ads and retargeting site visitors on TikTok | Pixel cookie and identifier, pages visited, browser details, matched to your TikTok account if you are logged in |
| Measuring our LinkedIn ads and retargeting site visitors on LinkedIn | Insight Tag cookies, pages visited, browser details, matched to your LinkedIn account if you are logged in | |
| Google Fonts | Serving the site's typefaces | Your network address and browser details, in the font request |
We may also disclose information if the law requires it, to protect our rights or safety, or as part of a sale or reorganization of the business, in which case the new owner would be bound by this policy. We have no other categories of recipients.
Cookies: Google Analytics sets cookies to tell one visitor from another. The Meta, TikTok and LinkedIn tags set advertising cookies and identifiers. Cloudflare may set a small security cookie. None of them holds your name or email.
| Cookie | Set by | Lasts | Purpose |
|---|---|---|---|
| _ga | Google Analytics | Up to 24 months | Distinguishes unique visitors |
| _ga_<id> | Google Analytics | Up to 24 months | Keeps session state for this site's property |
| _gid | Google Analytics | 24 hours | Distinguishes visitors within a day |
| _fbp | Meta Pixel | 90 days | Identifies a browser for Meta ad measurement and retargeting |
| _ttp | TikTok Pixel | 13 months | Identifies a browser for TikTok ad measurement and retargeting |
| li_sugr, bcookie, lidc, UserMatchHistory | LinkedIn Insight Tag | Up to 12 months | Identifies a browser and matches it to a LinkedIn member for ad measurement and retargeting |
| __cf_bm | Cloudflare | 30 minutes | Bot protection |
The one-click opt-out: if your browser sends the Global Privacy Control signal, none of these tags loads, not analytics, not the pixels. Most browsers and privacy extensions can turn it on in one setting. We treat it as an opt-out under every law that recognizes it.
Other ways to opt out: turn on your browser's tracking protection or "block third-party cookies" setting; install Google's Analytics opt-out add-on; adjust your ad preferences on Meta, TikTok and LinkedIn; or clear this site's data in your browser. We do not currently show a cookie banner. If you are visiting from the EU, EEA or UK, or you simply want nothing measured, turn on Global Privacy Control before you browse.
Local storage: when you start the contact form, your browser keeps a copy of what you have typed so far in its own local storage, so you can come back and finish. It stays on your device, is never sent to us until you press send, and you can clear it with the "Start over" option or by clearing your browser's site data.
What we do not do: we do not build profiles of you, we do not buy audience data, and we never pass your name, email or form contents to any of these platforms. The pixels see a browser and the pages it visited; the platforms do the matching under their own policies.
The free first look reads public pages of the website you enter, the same way a browser or a search engine crawler would: the home page, robots.txt, llms.txt, sitemap.xml, and the home page again as three named AI crawlers, plus one request asking for a markdown version. Five to eight requests, then it stops. It does not log in, submit forms, run scripts or change anything. We keep the results so we can send you the report and so a later check can show what changed.
Only check a site you own or have permission to review. If you believe someone has used the tool on your site without permission and want the record removed, write to us and we will remove it.
We are an AI-first agency, and we use AI tools in our own work. Here is exactly how that touches you.
Questions about any of this go to the same address as every other privacy question, and a person answers them.
| What | How long |
|---|---|
| Form submissions and first look requests | Until you ask us to delete them, or 24 months after our last exchange with you, whichever comes first |
| First look results | Same as the request they belong to. Results run without giving us an email are not linked to anyone and are not kept beyond the session |
| Email threads | As long as we are working with you or the conversation is open, then archived and deleted on request |
| Analytics data | Google Analytics keeps user-level and event-level data for 14 months, then aggregates it |
| Advertising pixel data | Held by Meta, TikTok and LinkedIn under their own retention rules; retargeting audiences we build from site visits expire after 180 days at most |
| Request logs | Cloudflare keeps standard request logs for a short, rolling period set by Cloudflare |
| Email delivery logs | Resend keeps delivery logs for a short, rolling period set by Resend |
When we delete something we delete it from our storage and ask any provider that holds a copy to do the same. Backups roll off on the providers' schedules.
Everything travels over HTTPS. Submissions are stored in Cloudflare's key-value storage, encrypted at rest, and reachable only with our account credentials, which use two-factor authentication. The first look tool rejects private addresses and rate-limits abuse. We keep the amount of data we hold small on purpose; the best protection for information is not collecting it.
No system is perfect. If we learn of a breach that creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as the law requires, and we will say what happened and what we are doing about it.
We are in Canada. Our providers run global networks, so your information may be stored or processed on servers outside Canada, including in the United States, where it may be subject to the laws of that country. We choose providers with strong security and contractual privacy commitments, and we transfer only what is needed to provide the service.
Wherever you are, you can ask us to:
Email hello@insitefound.com with the subject "Privacy request". We will confirm within five business days and complete the request within ten, and in any case within the 30 days the law allows. We may ask you to confirm you are the person the information is about. We will not charge you and we will not treat you differently for asking.
We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec's Law 25. If you are in the European Economic Area or the United Kingdom, you also have rights under the GDPR and UK GDPR, including the right to object and to complain to your supervisory authority. If you are a California resident, you have rights under the CCPA as amended by the CPRA, including the right to know, delete, correct and opt out of sale or sharing. We do not sell personal information. The advertising pixels may count as sharing under those laws, and the Global Privacy Control signal and the opt-outs in section 6 are how you exercise that right with us. We honour requests under all of these.
This site is for businesses and the people who run them. It is not directed at children under 16 and we do not knowingly collect information from them. If you believe a child has given us personal information, write to us and we will delete it.
When we change this policy we update the effective date at the top. If a change is material, such as a new category of data, a new analytics tool or a new purpose, we will say so on this page for 30 days after it takes effect, and we will not apply the change to information we already hold without telling you first.
This policy is governed by the laws of the Province of Ontario and the federal laws of Canada that apply in Ontario. Disputes will be resolved in the courts of Ontario, without limiting your right to complain to a privacy regulator.
Privacy questions, requests and complaints: hello@insitefound.com. We read every message and reply within one business day.
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada. In Quebec, the Commission d'accès à l'information. In the EU or UK, your local data protection authority. In California, the California Privacy Protection Agency.