Privacy Policy

This policy covers MakeItFlow ("we", "us") and the website audit tool at makeitflow.si. It describes exactly what the service does with data — nothing here is boilerplate about features we do not have.

What we collect

When you run an audit

• The URL you submit, the domain it resolves to, and the full audit result — scores, individual checks, DNS and email records, response headers and detected technologies.
• Your IP address, browser user-agent and referring page. We use these to enforce the free daily scan limit and to detect abuse. Nothing more.

When you download a PDF report

• Your email address, and optionally your name, company and phone number, together with a timestamp recording when you gave consent.

When you subscribe to the newsletter

• Your email address and a timestamp recording when you gave consent. We use it only to send the weekly newsletter, and every email carries a one-click unsubscribe link.

When you request a free checklist

• Your email address and the industry page you requested it from. We use it to email you the checklist. We only send you tips as well if you tick the optional box, and we record when you did.

When you use a free tool

• The domain you enter. We look up its public DNS records or connect to it over HTTPS to produce the result, and keep that result in a short-lived cache (about ten minutes). It is not linked to you.

When you create an account

• Your name, email address and a one-way hash of your password. We never store the password itself.
• Any branding you upload for white-label reports (logo, company name, colour).
• If you subscribe: a Stripe customer reference and your subscription status. Card details are entered on Stripe and never touch our servers.

Why we collect it

Who else sees it

We do not sell your data. It is shared only with the services that make an audit possible:

• Google (PageSpeed Insights API) — Measures the performance of the URL you submit. The URL is sent to Google; your personal details are not. Their privacy policy.
• Cloudflare (DNS-over-HTTPS resolver) — Answers the DNSSEC lookup for the domain you audit. Only the domain name is sent. Their privacy policy.
• Stripe — Processes subscription payments. Card details are entered on Stripe and never reach our servers. Their privacy policy.

Reports and who can see them

Every report has a sharing setting, and you control it from your dashboard:

• Public — reachable by anyone holding the report URL, and may be listed to other signed-in account holders on our Recent audits page. It is not published to the open web, indexed by search engines, or shown to visitors who are not signed in. This is the default for scans run without an account.
• Link only — reachable by anyone holding the report URL, never listed or aggregated. This is the default for every scan you run while signed in.
• Private — visible only to you.

Report URLs contain an unguessable identifier, but a "link only" report is not a secret: anyone you send the link to can open it. Set a report to Private if that matters.

Google sign-in and Google Search Console

If you choose Continue with Google, Google gives us your name, email address and a Google account ID. We use them only to create and sign in to your account.

If you choose to connect Google Search Console, you grant us read-only access (webmasters.readonly) to the Search Console properties of the Google account you pick. We use it only to show you your own search performance — clicks, impressions, click-through rate, average position, keywords and pages — and the opportunities we calculate from it, inside your account. Specifically:

• We never change anything in your Search Console; the access is read-only.
• Your Search Console data is shown only to you. It is not shared, sold, used for advertising, used to train AI models, or combined into other customers' results.
• We keep the access tokens encrypted. Report data is cached for up to six hours to avoid repeated requests, then fetched again from Google.
• If you track keywords, we store the daily position, clicks and impressions for those keywords only, so we can show their history. They are deleted when you stop tracking a keyword or disconnect.
• If the weekly email is on, we send you a Monday summary of the same data. Every email has a one-click link to stop it.
• You can disconnect at any time from the Search Console page in your account. We then delete the tokens and tracked keyword history, and ask Google to revoke our access. You can also remove it yourself at myaccount.google.com/permissions.

If you add a Bing Webmaster Tools API key, we store it encrypted and use it only to show you your own Bing search data in the same way. Disconnecting deletes the key.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

• Audit reports — kept while your account is active, up to the report limit on your plan. You can delete any report from your dashboard at any time; deletion is immediate and permanent.
• Lead details from the PDF form — kept until you unsubscribe or ask us to erase them.
• Account and billing records — kept while your account exists, then for as long as tax and accounting law requires.
• Site analytics — individual page views are deleted after 180 days; the visitor counter row behind them after two years. Both are pruned automatically, not on request.

Cookies

We set three cookies, all first-party — none of them is readable by anyone but us:

• Session — keeps you signed in. Strictly necessary.
• CSRF token — protects forms from cross-site abuse. Strictly necessary.
• Visitor identifier — a random identifier, kept for a year, that lets us count how many people visit and which pages they read. It is not tied to your name unless you sign in, and it is never shared, sold or combined with data from anywhere else.

We run no advertising, no ad networks and no third-party analytics. There is no Google Analytics, no Meta pixel and no data broker in this site. The visitor counting is our own, on our own server.

Site analytics

We record which pages are visited, when, how long the server took to respond, the page you arrived from, and rough device details (mobile or desktop, browser, operating system) taken from your browser's user-agent string. We use it to see which pages are worth keeping and which are slow or broken.

We do not store your IP address in our analytics. It is put through a one-way keyed hash before it is written, which lets us group one person's requests without keeping an address that points back at you. Automated traffic — search-engine crawlers and monitoring bots — is recorded separately and excluded from our figures.

Your rights

Depending on where you live you may have the right to access, correct, export or erase your data, to object to processing, and to withdraw consent. To exercise any of these:

• Delete a report — do it yourself from your dashboard.
• Stop marketing email — use the unsubscribe page or the link in any email we send.
• Anything else — contact us and we will respond within 30 days.

Auditing sites you do not own

The tool only requests pages the way any visitor's browser would, and only reads public DNS records. It does not attempt to log in, submit forms or bypass access controls. Even so, please audit sites you own or have permission to test.

Security

Traffic is encrypted in transit, passwords are hashed with bcrypt, and payment details never reach us. Audits are restricted to public web addresses — the scanner refuses private, loopback and reserved network ranges.

Changes

If we change how we handle data we will update this page and the date at the top. Material changes affecting existing accounts will be emailed.

Who we are

MakeItFlow

Questions about this policy? Use the contact page and we will respond.