Free audit privacy

This page covers the free Support tools audit. It’s the only part of this site that collects personal data.

Last updated 21 October 2026.

Who I am

I’m Brian Levine, and I’m responsible for the data described here (the “controller”, in GDPR terms). Email me at [email protected] about anything on this page.

What I collect

From everyone who asks for access: your email address. I use it once to send you the access link and once in a short alert to me that someone signed up. The alert has your address, whether you ticked the follow-up box, and the time. Unless you tick that box, your address isn’t added to any list.

Only if you tick the follow-up box: I add your email address to my own follow-up list. The signup alert is my record that you agreed. It shows the time you confirmed your email and which version of the checkbox wording you agreed to.

Never: the audit data you enter in the tool. Your ticket categories, tools, counts, and report stay in your browser. They’re saved on your device and they’re never sent to me or anyone else.

Why, and the legal basis

Sending the link and giving you access, to provide the tool you asked for (GDPR Art. 6(1)(b)).
The signup alert to me, for my legitimate interest in knowing who uses the tool (Art. 6(1)(f)).
Follow-up email, only with your consent (Art. 6(1)(a)). You can withdraw it at any time. Withdrawing doesn’t affect your access to the audit.

Who processes it

Resend sends the access link and the signup alert.
Cloudflare hosts this site and runs Turnstile, the check that you’re a person and not a bot. It also stores rate-limit counters that stop the form being used to flood someone’s inbox. The counters are keyed by a hash of your email address and by your IP address, and they expire after an hour.

Transfers outside the EU

Resend and Cloudflare are US companies, and Resend stores its data in the United States. Both have certified under the EU-U.S. Data Privacy Framework, including its UK Extension. Both of their data processing agreements also include the EU Standard Contractual Clauses (and the UK addendum), which apply regardless of that certification.

You can read their terms here: Resend’s DPA, Resend’s GDPR page, Cloudflare’s DPA and Cloudflare’s privacy policy.

How long it’s kept

If you opted in to follow-up: until you ask me to stop or to delete it.
Everyone else: nothing is kept on the site’s side. Your address stays in the signup alert in my inbox until you ask me to delete it. It also stays in Resend’s sending logs for their log retention period (30 days on their standard plans when I wrote this).
Rate-limit counters: up to an hour.

Cookies

The audit sets one cookie, fa_access, when you confirm your email. It lasts 30 days and lets you back into the tool without a new link. It holds a hash of your email address and an expiry date, signed so it can’t be forged. It doesn’t hold your email address. It’s strictly necessary for the gate to work, so there’s no cookie banner.

The tool saves your audit data in your browser’s local storage, on your device. That never leaves your browser either.

Turnstile collects signals such as your IP address and browser details to tell people from bots. Cloudflare covers how it handles them in its Turnstile Privacy Addendum and privacy policy.

Your rights

You can ask me to:

show you the data I hold about you;
correct it;
delete it;
stop using it for the signup alert (objection);
stop sending follow-up email (withdrawing consent).

You can also complain to a data protection authority, such as the one in the EU country where you live or the ICO in the UK.

Stopping follow-up and other requests

Follow-up emails come from me personally, not from a mailing list, so they don’t have an unsubscribe link. To stop them, reply to any of them or email [email protected] and I’ll take you off the list. Email the same address for anything else. I’ll answer within a week.