Privacy Policy

Clunky AI is built around public website scans, emailed reports, editorial publishing, and benchmark reporting. We collect the minimum personal data needed to run those surfaces.

What we collect

• URLs submitted for scans and the raw signals produced by a scan.
• Email addresses submitted for reports or scan follow-ups.
• Names, email addresses, company names, website URLs and messages submitted with a Clunk Removal or AI Visibility Sprint inquiry.
• Optional industry and builder information submitted with a scan.
• The normalised domain submitted to the llms.txt generator or checker, together with the tool action and outcome.
• Hashed IP addresses for abuse prevention and dataset integrity.

We do not store raw IP addresses. IPs are hashed with a server-side salt before storage.

How we use scan data

Every scan contributes to the Clunky Index. We retain scan rows indefinitely so the benchmark can track methodology versions and trends over time. Public rollups are aggregated; we do not publish personal email addresses.

Email

Report delivery and scan follow-ups are handled separately from the scan itself. You can unsubscribe from future follow-up emails with one click.

Service inquiry details are used to assess the requested work, reply to the inquiry and keep a record of the proposed scope. They are not added to marketing lists unless you separately opt in.

Customer Check requests

When you request a free Customer Check, we keep the website address, your email, the type of business, the business name if you give it, your confirmation that you run the business or manage its website, whether you asked about the Customer Watch pilot, and a one-way hash of your IP address, which we use to limit abuse. A copy of the request also goes into our internal notification email. We use these details to do the check, send your report and reply to you, and, only if you ticked the box, to tell you about the Customer Watch pilot. The check report we make for you (what we found, the screenshots and any note we add) is kept with your request. We keep requests and their check reports for up to 12 months, then delete them.

Clunky Watch

When you buy Clunky Watch we keep the email address and website address from your report, the scan it started from, the Stripe customer, subscription and checkout IDs for your watch, its billing status and paid-until date, the results of each scheduled check and weekly scan, the alerts we queue, and a log of checks, emails and billing events. We do not see or store your card details.

We use these details to run the checks you paid for, send the service emails Watch promises (confirmation, alerts and four-weekly updates), handle cancellations and refunds, and answer your replies. Our lawful basis is the contract with you; for billing, tax and dispute records it is our legal obligations and legitimate interests.

Payment is taken by Onelink, Stripe's merchant of record for Clunky Watch. Onelink sells you the subscription and handles payment, VAT and refunds as an independent controller under its own privacy notice. Stripe sends renewal reminders and tells us the payment and subscription events we need to turn your watch on and off.

We keep a watch record and its check history while the subscription runs, and afterwards only as long as we need it for billing, tax and dispute records. You can ask us to delete it sooner where the law allows.

The weekly readiness scans Watch runs are stored like any other scan and, as described above, kept for the Clunky Index. They hold the website address and results, not your email. Each one carries the ID of your watch, which may remain linkable to you through the related payment and billing records even after the watch record is deleted.

Analytics

We measure how the site is used only to produce aggregate statistics, such as how many people visit, which pages they land on, and which sources (search engines, AI assistants, social sites, newsletters or campaigns) bring visitors, scans, report requests, newsletter sign-ups and service inquiries. We use those statistics to improve the site. We rely on the statistical purposes exception in the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025. We do not use analytics to work out who you are, to build a profile of you or for advertising.

Our own first-party measurement sets no cookies and stores nothing in your browser, except the opt-out cookie described below if you choose it. For each page view our server keeps the page's route template (for example /scan/[id], or the address of a published article, never the address as you typed it, its query string or any identifier in it), the referring website's domain, the UTM source, medium and campaign tags reduced to a fixed list of values, whether an advertising click identifier was present (never the identifier itself), your device type (mobile, tablet or desktop), your country and a daily visitor hash. The hash is a one-way hash of your IP address and browser details combined with a random value for that day. We do not store your IP address or browser details. The random value is deleted at our daily clean-up shortly after midnight UTC, so visits on different days cannot be linked, and stored hashes are erased by the same daily clean-up, within 48 hours. The remaining rows are deleted at the first daily clean-up after 400 days.

We also count some actions, such as starting a scan, copying a share link, opening the Watch details or expanding a fix prompt, with a few fixed values (for example, whether it was a rescan). Clicks on some links are counted by link type (internal, external or email), never where the link goes or what it says. On scan and report pages we also count when a part of the page, such as an offer or the fix prompts, first comes into view. Views, clicks and other events on those pages also carry whether the score was below 70 or not, and clicks on a Clunk Removal Sprint offer carry where on the page the offer sat (for example, leading the page or as a one-line mention). These events never carry the score, the site or the scan.

When you start a scan, request a report, subscribe to the newsletter, send a service inquiry or request a Customer Check, we add one to an aggregate count for the source of that visit. The count is never stored with your scan, email address or inquiry, and nothing links it to you.

We also use Vercel Web Analytics to count page views without cookies. Before a page address is sent to Vercel or to our own measurement, your browser removes its query string, report addresses are reduced to templates such as /scan/[id], and any other part that looks like an identifier or an email address is replaced. Our pages tell your browser to share only our domain, never a page address, as the referrer. Vercel receives event names with, at most, the same fixed values as our own measurement, with one addition: for the llms.txt tool, the normalised domain is attached to generation, checking, copy and download events so we can understand which websites use the tool. We do not send the full submitted URL, fetched page content, generated file, scan identifiers, link text or link destinations to analytics. Website URLs entered into the general scanner or service inquiry are not sent to any analytics service.

Turning analytics off

You can object at any time with the control below. It sets a strictly necessary cookie, clunky_analytics_off, for one year so that we remember your choice. While that cookie is set, or while your browser sends a Do Not Track or Global Privacy Control signal, this site sends no page views or events to Vercel Web Analytics and nothing to our own measurement, and our server records no page views or conversion counts for your visits.

After a successful server-side llms.txt generation or published-file check, we send Clunky an internal operational email containing the normalised domain, action and summary result counts. It does not contain the submitted path, fetched page content or generated file. Pasted files are checked entirely in the browser and do not trigger a notification.

Processors

Depending on environment configuration, we may use Supabase, Resend, Vercel, Fly.io or Railway, Google PageSpeed Insights, OpenAI for narrative text. Clunky Watch payments go through Stripe and Onelink, as described above. LLMs are not used to produce numeric scores.

Your rights

If you are in the UK or EEA, you can ask for access to, correction, deletion or restriction of your personal data, such as your email address, and for a copy of data you gave us in a portable format. Scan rows may be retained in anonymised or aggregated form to protect benchmark integrity.

Where we rely on legitimate interests, you can object to that processing at any time by emailing privacy@clunky.ai.

You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, though we would like the chance to help first.

Contact

Email: privacy@clunky.ai