Salyant Signal
Privacy Notice
Salyant Signal is operated by Salyant Ltd, a company registered in England and Wales (company number 16837676), registered office 128 City Road, London EC1V 2NX. We are the controller of the personal data described below. Contact: the contact form at salyant.co.uk.
What we collect and why
- Audit requests: the website URL, audit scope, any instructions you write, and your required email address for the free-run limit and audit response. We use these to carry out the audit, reply to you and take payment. Basis: performing our contract with you or steps you ask us to take before one.
- Messages and enquiries: anything you send us through the contact page or by email. Basis: our legitimate interest in answering you.
- Payments: when Stripe Checkout is enabled, Stripe processes the charge. To create a checkout, we send Stripe your email address, the target website URL, audit scope and charge details. We do not receive or store full card numbers. Basis: contract and legal obligation (accounting).
- Free-run limit: a keyed HMAC-SHA-256 digest of your normalised email address and submitted website domain is used as the private server-side quota-marker name to enforce one free audit per email-and-domain pair. The marker contains a timestamp and version, not the raw email address or domain, and is not used for advertising or tracking.
- Technical logs: our hosting provider records standard request data such as IP address, browser and time to keep the site secure and working. Basis: legitimate interest in security.
Cookies and third parties
Signal does not use advertising or analytics cookies and loads no third-party fonts or analytics trackers. The audit form loads Cloudflare Turnstile to reduce automated abuse; Cloudflare receives verification data and processes the challenge under its own terms and privacy notice. Free-run eligibility is checked server-side; no free-run marker is stored in your browser. Salyant Ltd’s main website has its own privacy policy and cookie policy.
Who we share data with
We use Netlify to host Signal and Netlify Blobs to store private server-side free-audit quota markers. Cloudflare Turnstile verifies browser-based audit submissions. Upstash Redis provides the shared hourly IP rate limit and one-time paid-checkout replay protection; its rate-limit keys use HMAC-derived identifiers rather than raw IP addresses, and the payment replay marker is keyed by an HMAC digest rather than a raw Stripe session identifier. A cached paid report is kept for up to 30 days to recover a completed audit if the browser response is lost. When enabled, Stripe Checkout receives the details needed to take and verify a payment, including the email address, target URL, audit scope and amount. Netlify, Cloudflare, Upstash and Stripe process data under their respective terms and privacy notices. We do not sell your data and do not use it for advertising.
International transfers
Some providers are based outside the UK. Where personal data leaves the UK we rely on an adequacy decision, the UK International Data Transfer Addendum or equivalent safeguards.
How long we keep it
Audit requests and related messages that we retain: up to 24 months after the last contact, unless you ask us to delete them sooner. The private free-run marker is retained while needed to enforce the one-free-run policy; it contains a keyed HMAC path, timestamp and version, not the raw email address or domain. The API's IP rate counter is in memory and resets with the serverless instance. Hosting providers may retain technical logs under their own terms. Accounting records: 6 years, as the law requires.
Audited websites
When you submit the audit form, the API automatically fetches the public page after validating the destination, or performs a bounded same-origin crawl of up to five pages. A repeat run requires a verified one-time payment when Stripe Checkout is enabled, or must be arranged with Salyant while checkout is unavailable. Website changes are not published by the audit API. Reports may include publicly visible page content; the paid-report recovery cache is retained for up to 30 days and report history on the dashboard is stored in your browser. Please submit only sites you own or are authorised to audit.
Your rights
Under UK GDPR you can ask to access, correct, delete or restrict the use of your data, object to our use of it, and ask for a copy you can move elsewhere. Contact us through the contact form at salyant.co.uk. You can also complain to the Information Commissioner’s Office (ico.org.uk).
Children
Signal is for businesses and is not aimed at anyone under 18.
Changes
We will update this page and its date if our practices change.