Privacy Policy
This policy explains what CROMagnet collects, why we collect it and what you can do about it. We collect what the product needs to run audits and bill for plans, and nothing for advertising.
Last updated 10 October 2026
What we collect
Audit data. The store address you submit, and a snapshot of what the audit reads from the public pages: the rendered HTML, the network requests the pages make, screenshots and timings. We keep the snapshot so a report stays checkable and can be re-scored.
Account data. Your name, email address, password (stored hashed), your role and the sites you have access to, and the branding you set for white-label reports, such as a logo and colours.
Billing data. Plan, billing interval and invoice history. Card details are entered at Stripe and never reach our servers.
Messages and requests. What you send through the contact form, an expert-help request or a comment on a report, including the name and email you give.
Technical data. Standard server logs such as IP address, browser and pages requested, used for security, rate limiting and debugging.
The free audit
A free audit needs no account and no email. If you ask for a PDF or a copy of the report to be emailed, we ask for an email address for that purpose.
How we use it
To run audits and show you the results, to create and secure your account, to take payment, to send the emails the product depends on (report ready, invitations, receipts, password resets), to answer messages, and to prevent abuse.
We also combine the latest audit of each store into anonymous aggregate numbers, such as the average score by platform and how many stores fail each check. These appear on the benchmarks page. A store is never named, and a figure is published only when enough stores are behind it.
Who we share it with
We use a small number of processors to run the service: Stripe for payments, Google PageSpeed Insights for speed measurements of the page being audited, Cloudflare for bot protection and file storage, and an email provider for transactional mail. They process data only to provide those services.
Expert-help requests go to our operations team. We do not sell personal data.
Shared report links are readable by anyone who has the link, and by anyone who also has the password if you set one.
How long we keep it
Audit snapshots and reports are kept while the site remains in your account. Deleting a site deletes its audits, including stored pages, screenshots and PDFs. Account and billing records are kept while the account is open and as long afterwards as the law requires us to keep accounting records.
Cookies
We use cookies that keep you signed in and protect forms from forgery. We do not use advertising cookies.
Your choices
You can ask to see, correct or delete your personal data, and to close your account, by writing to [email protected]. You can delete sites yourself from the dashboard. If you are in a place where data protection law gives you further rights, such as access, portability or objection, we will honour them.
Security
Data is sent over HTTPS, passwords are hashed, files are stored privately and served through signed links, and staff access is limited to what operating the service needs. No system is perfectly secure, and we will tell affected users if a breach affects them.
Changes and contact
We will post changes here with a new date. Questions about this policy: [email protected].