Legal

Privacy

Last updated: 20 September 2026

What we collect

When you run a scan we collect the details you type into the form: your business name, website, industry, first name, email address, and phone number if you choose to give one. We also record which pages of our own site you visited, using a random identifier stored in your browser that is not linked to any third party.

What we fetch from your website

We fetch publicly accessible pages from the address you give us — the same pages any visitor or search engine can read. We do not attempt to access anything behind a login, and we will never ask you for a password to your website, your hosting, or any other system. If anyone claiming to be us does, it is not us.

What we do with it

We use your details to produce your report, send it to you, and follow up a small number of times about it. We keep the analysis behind your report so that a finding can be explained later if you ask about it.

We do not sell your information, and we do not share it with advertisers or data brokers.

Who else is involved

Payments are handled by Stripe. Card details go directly to Stripe and never reach our systems — we receive only a confirmation and a reference. Email is delivered by our email provider. Report text may be phrased by Anthropic's Claude API, which receives the findings and your business name, and is not given your email address, phone number, or your website's raw content.

Our forms are protected by Cloudflare Turnstile, which checks that a submission came from a person rather than a script. It receives technical signals from your browser for that check. It does not read what you typed into the form.

What we record when you tick a consent box

When you agree to receive email or text messages, we store the date and time, the exact wording you were shown, the version of that wording, which form it was, your IP address and your browser's user-agent string.

We keep that because consent is only worth something if it can be shown. If you ever ask what you agreed to, we can tell you exactly, and if we are ever asked to prove it, we can. That record is kept even if you later withdraw consent — withdrawing adds a new entry rather than erasing the old one — because a record that can be quietly rewritten is not a record.

Stopping the emails and texts

Every email we send carries a one-click unsubscribe link, which cancels the remaining messages immediately. Your report link keeps working afterwards.

Text messages only ever go to people who ticked the separate SMS box, and never as a condition of anything else. Reply STOP to any message to stop them, or HELP for help. You can also email us and we will remove your number. Message frequency varies, and message and data rates may apply.

Deleting your data

Email hello@myhavenreport.com from the address you signed up with and we will delete your lead record, your scans and your reports. We will confirm when it is done.

Report links

Report links contain a long random token and are not indexed by search engines. Anyone holding the full link can open the report, so treat it as you would any private link. Ask us and we will revoke one.