Privacy notice
The Privacy Register reads a website you name and checks its privacy policy. It sets no cookies on the public site, counts page views without identifying anyone, uses no AI, and keeps nothing about the websites you check or the answers you give.
Last updated 15 October 2026: added counting page views, error reports and the owner's daily totals email.
Who is responsible
Phil Swindin, trading as Second Lens, based in West Yorkshire. I am the controller for any personal data this service handles, and there is nobody else to pass you to. Email hello@secondlens.co.uk about anything in this notice.
What is collected, and why
When you check a website
The website address you enter. It is sent to our server, which fetches that site's homepage and privacy policy and passes them back to your browser. The check itself runs in your browser. We do not store the address, the pages or the results.
What that website contains. A homepage often shows a business's name, email address, phone number and postal address. Your browser reads these to fill in the organisation details on the results. We do not store them.
Policy text you paste. Checked in your browser and never sent to us.
Your answers to the questions, and the PDF report. Your answers stay in your browser for the length of the check. The report is made in your browser and saved to your device. Neither is sent to us.
A short count to stop misuse. To stop the checker being used as a free proxy or flooded with automated requests, we count how many checks come from your connection in the last minute. The count is stored against a scrambled, one-way form of your IP address, not the address itself, and it is overwritten the next time you run a check. We cannot work back from it to your address.
Server records. Our host, Netlify, records the usual information about each request, including your IP address and the address of the page requested, to serve the site and keep it running. Because the website you enter is part of the request to our server, it can appear in these records. I do not use them for anything else.
Settings in your browser, only if you use them. If you press the Motion button, your choice is remembered in your browser's local storage so the page stays still next time. If you turn counting off (below), that choice is remembered the same way. You can clear either in your browser settings. Nothing else is written to your device.
Counting page views
To see which pages are used and improve the site, each page you open sends one short message to our own server. It says:
- which page of this site it was
- the hour, never the minute
- roughly how wide your screen is, as one of five bands, never the exact size
- the name of the website that sent you here, if any, never the full address
- any campaign tag in the link you followed
When you start a check, check a pasted policy, try the demo, see your results or download a report, one more message says which of those it was.
If something on a page breaks, one more message says what broke, so it can be fixed: the error message, which of our files and line it came from, and a short description of the page element involved, never its contents. Before anything is stored, web addresses, email addresses, long numbers and quoted text are removed from the message, so nothing you typed is kept. Errors caused by browser extensions or other websites are not sent. That is all.
It sets no cookie and gives you no identifier, so one page view cannot be linked to the next, or to you. We do not use your IP address or your browser's identity for counting, and we do not work out your country or your device. There is no count of visitors, because counting visitors means telling people apart. Nothing is shared with anyone else.
The owner gets a short email with the totals, usually once a day, sent through Netlify: page views, checks started, reports downloaded, error counts and the most common error message, already cleaned as described above. It holds totals only, nothing about any one visit.
Under the e-privacy rules (PECR Schedule A1, paragraph 5) a website may count how it is used without asking first, provided it tells you and lets you object simply and for free. This is how you object:
Counting is on. No cookie is set and nothing identifies you.
It applies to this browser on this device. If your browser sends the Global Privacy Control signal, we treat that as an objection and count nothing.
If you try to sign in to the admin area
The site has a private admin area for its owner. To protect it, each sign-in attempt is recorded with the time, the IP address and the browser it came from, and whether it succeeded. Repeated failures from one address are counted against a scrambled form of that address, so it can be locked out for a while. If an address or the whole sign-in is locked out, an alert email is sent to the owner, which includes the address. The admin area sets cookies, but only for someone signing in to it.
If you email us
Your name, email address and whatever you write, so we can reply.
What we do not do
No cookies on the public site, no analytics from other companies, no tracking of you across pages, visits or other websites, no advertising, no fonts or scripts from other companies, no AI, and no automated decisions about you. Nothing is sold.
What we use it for, and the lawful basis
We rely on legitimate interests for each purpose below. You can object to any of them: see your rights below.
| Purpose | Lawful basis and the interest |
|---|---|
| Fetching the website you asked us to check | Legitimate interests: providing the check you asked for. Fetching the site is the only way to do it. |
| Running and protecting the site (server records) | Legitimate interests: keeping the service working and secure. |
| Recording and limiting sign-in attempts to the admin area, and alerting the owner | Legitimate interests: stopping people breaking into the service. |
| Counting page views, and reports of errors on our pages, to improve the site | Legitimate interests: knowing which pages are used, so the site can be improved. The records are designed so that no one can be identified from them, and you can turn counting off. |
| Answering your emails | Legitimate interests: replying to people who contact us. |
Do you have to give us anything?
No. Nothing is required by law or by contract. A scan needs a website address, but you can paste a policy instead, and that never leaves your browser.
Who else can see it
Netlify hosts the site, runs our server and keeps the server records, the page-view counts, the admin area records and the alert emails. It acts on our instructions as a processor. Our server runs in Netlify's United States region, so the address you enter and your IP address are processed in the US. Netlify's data processing agreement covers transfers of personal data from the UK. You can get a copy of it from Netlify's website, or ask us.
The website you ask us to check receives a request from our server, which identifies itself as SecondLensPolicyChecker. That website does not receive your IP address.
Our email provider holds emails you send us.
How long it is kept
| What | How long |
|---|---|
| The address you enter, the pages fetched, your answers and the results | Not kept by us at all |
| The short per-connection check count (a scrambled address) | Overwritten on your next check; it holds only a count and a start time |
| Netlify's server records | For the period Netlify keeps them on our plan. We do not copy or export them. |
| Admin area sign-in records | 90 days |
| Failed sign-in counts for an address | Deleted by the nightly clean-up once a full day has passed since the last failure, unless a lock-out is still running |
| Alert emails | Until the owner deletes them |
| Emails you send us | Twelve months after the last message, unless a complaint or legal matter needs them for longer |
| Page-view records (page, hour, screen band, referring site, campaign tag, and any error report) | 7 days, then deleted. Only daily totals are kept after that. |
| Daily totals of page views | Kept as the site's history. They are counts, and identify no one. |
| The Motion and counting settings | In your browser until you clear them |
Keeping it safe
Every connection is encrypted with HTTPS. Our server only fetches public web pages, refuses private and internal addresses, and keeps nothing once it has replied. The admin area needs a password and a code from an authenticator app.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you (the right of access)
- ask us to correct it
- ask us to delete it
- ask us to restrict what we do with it
- object to our relying on legitimate interests
The right to data portability applies only to data held on the basis of consent or a contract, so it does not apply here. In practice we hold very little: email hello@secondlens.co.uk and we will deal with your request within one month.
Complaints
If you are unhappy with how your personal data has been handled, you have the right to complain to us. Email hello@secondlens.co.uk with "Complaint" in the subject line, saying what happened and what you would like done. If email is difficult for you, say so and we will find another way. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the UK data protection regulator, the Information Commission, which took over from the Information Commissioner's Office on 30 September 2026, at ico.org.uk. We would rather you told us first, but it is your right either way.
The right to complain to us is in section 164A of the Data Protection Act 2018. What this notice must contain is set out in UK GDPR Article 13.
Changes to this notice
If this notice changes in a way that matters, the date at the top changes and the change is described here.