Privacy Policy

1. Introduction

ANET Studios ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

ANET Studios is the data controller responsible for your personal data:

2. Information We Collect

We collect personal data in a few different ways. To make this clear, we have grouped it by where the information comes from:

Information you give us directly

When you contact us, request a service, or use the tools on our website, you may provide:

• Identity and contact details: your name, email address, phone number, and the company you represent
• Enquiry content: the subject and message you send through our contact forms, and any details you share in calls, consultations, or correspondence
• Website Health Score requests: the website address (URL) you enter and, if you request the full report by email, your email address so we can send you the report
• Booking details: the information needed to schedule a call, such as your name, email address, and chosen time
• Client portal account data: if you become a client, your account login details, the files and information you upload, and the messages you exchange with us through the portal

Information we collect automatically

When you visit our website or use our client portal, some technical information is collected automatically:

• Device and connection data: your IP address, browser type, and general device information
• Security data: information processed by our bot-protection and abuse-prevention measures (such as Cloudflare Turnstile), request rate-limiting, and records of sign-in attempts to the client portal
• Usage and analytics data: how you interact with our pages, collected only with your consent
• Cookies and similar technologies: as described in the Cookies section below

Information we generate about you

As part of providing our services and managing our business relationships, we may create additional information, including:

• Records of our interactions: notes from calls, meetings, emails, and support requests
• Status in our process: where an enquiry or account sits in our sales or onboarding workflow
• Assessments from the Website Health Score: the results our Website Health Score calculates for a website you enter. If you request the full report by email, we also store the overall score of that result with your contact details in our customer records. Results of checks that visitors run on our website are never used to contact the operator of the checked website. They are not used to make any automated decision that produces legal or similarly significant effects about you.
• Assessments for business-to-business outreach: for businesses whose professional contact details we collect from public sources (see “Information from other sources” below), we may assess the business's publicly accessible website (for example its loading speed and basic technical features) and record an internal indication of how relevant our services may be to that business. This helps us prioritise our outreach. We do this with our own internal tools, separately from the Website Health Score on our website, and it is not used to make any automated decision that produces legal or similarly significant effects about you.

Information from other sources

We may also receive information about you from sources other than yourself:

• Public and third-party business sources: for business-to-business outreach, we may collect professional contact details (such as a company name, business email address, phone number, website, and a publicly listed business address) and public business-profile details (such as the business category, rating and number of reviews) from publicly available sources, business directories and Google Maps business profiles, where we have a legitimate interest in offering relevant services (Art. 6(1)(f) GDPR). Where this applies, we will inform you, in line with Art. 14 GDPR, that we hold your data and which source it comes from.
• Providers we work with: for example, confirmation of an appointment from our scheduling provider, or confirmation of a payment from our payment processor.
• Publicly accessible websites checked with our Website Health Score: the pages our server retrieves from a website entered into the check may contain personal data of the website operator, such as a name, address, phone number or email address shown in the legal notice (see "Website Health Score" below).

Website Health Score

When you use our free website check, we process the website address (URL) you enter. Our server, not your device, then retrieves publicly accessible content from that website: the home page, the robots.txt, sitemap.xml and llms.txt files and, if linked from the home page and available on the same domain, its legal notice (Impressum) (the requests identify themselves as "ANETHealthScore"). If you also enter the address of a website for comparison, we retrieve its home page and the robots.txt, sitemap.xml and llms.txt files in the same way, but not its legal notice; for that website we only show scores, and its result is never stored in a database. Our server measures loading speed and technical condition itself while retrieving the pages: the server response time, compression and caching, redirects (where applicable, we request the address of each checked website once more over http:// to see whether it redirects to https://), how images are embedded, whether the security certificate is valid and basic smartphone settings. We do not use an external measurement service for this. The retrieved pages may contain personal data of the website operator, such as a name, address, phone number or email address shown in the legal notice; this data comes from publicly accessible sources and is only analysed automatically to produce the result. The legal basis is our legitimate interest in offering this check and your interest in having a website checked (Art. 6(1)(f) GDPR); to prevent abuse we use Cloudflare Turnstile and limit requests per IP address. Results are held in server memory for about one hour and, unless you request the report, are not stored in a database; our logs do not contain the URLs checked. If you request the full report by email, we use your email address to send you the report (Art. 6(1)(b) GDPR). We also keep the URL (without parameters), a summary of the result that contains no content from the checked website and your email address in our customer records for 1 year after your request or our last contact with you, to keep a record of your request and to answer any questions you have about the results (Art. 6(1)(f) GDPR). We count clicks on the booking link in the report without personal data (only source and language); your IP address is held in the server's memory for about one minute only, to limit the number of log entries. We only send you marketing emails with your separate consent. We never use the results of checks that visitors run on our website to contact the operator of the checked website or to include it in our outreach. Operators of checked websites may object to this processing at any time (Art. 21 GDPR): info@anetstudios.com.

Google Business Profile lookup: When this part of the Website Health Score is enabled, our server sends the business name and, where available, the town or city taken from the checked website's legal notice (Impressum) to the Google Places API; if no matching profile is found that way, or the legal notice shows no business name, we send the website's domain instead. The recipient is Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA; see section 6). Only a Google Business Profile that links to the checked website counts as a match. From that profile we use the public rating, the number of reviews and the business status, and we compare the address and phone number shown there with the legal notice. If we already hold the place ID of the matching profile from an earlier check (see below), we send that place ID instead of the name. The first query can return the public profiles of several businesses (name, address, phone number, website, rating and number of reviews); we use them only to recognise the matching profile. If a profile is found, a second query sends its type of business and town to show where it appears among up to 20 results; for the other businesses in that list we receive only their Google place ID, website address, rating and number of reviews, and we show only the rating and number of reviews of the three businesses with the most reviews, without names or website addresses. The results are shown only to you as the person who requested the check. We hold them in server memory for about one hour; they are not stored in a database and are not part of the report sent by email. The only exception is the Google place ID of the matching profile, which we keep for up to 24 hours as a cache. The legal basis is our legitimate interest in offering this check and your interest in having a website checked (Art. 6(1)(f) GDPR). Operators of checked websites and other businesses may object to this processing at any time (Art. 21 GDPR): info@anetstudios.com.

Where we indicate that certain information is required (for example, to respond to an enquiry, deliver a service, or process a booking), not providing it may mean we cannot fulfil your request. Providing any other information is voluntary.

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Consent: Analytics and marketing cookies
• Contractual necessity: Processing required to deliver our services
• Legitimate interest: Improving our website, responding to enquiries, fraud prevention, offering our free website check (Website Health Score)
• Legal obligation: Compliance with applicable laws

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Respond to your inquiries and provide customer support
• Analyze usage patterns and optimize our website
• Detect, prevent, and address technical issues
• Comply with legal obligations

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

• Service providers who assist in our operations
• Professional advisors (lawyers, accountants)
• Law enforcement when required by law
• Business partners with your explicit consent

6. International Data Transfers

Some of our sub-processors are based outside the European Economic Area (EEA), including in the United States. Where we transfer personal data outside the EEA, we rely on appropriate safeguards: the EU-US Data Privacy Framework (DPF) where the recipient is certified, and/or Standard Contractual Clauses (SCCs) approved by the European Commission. Key sub-processors include:

• Google (Workspace, Analytics, Ads, PageSpeed Insights, Places API): Workspace (email), Analytics, and Ads (conversion measurement, only with marketing consent); and PageSpeed Insights: we use Google’s PageSpeed Insights API for the technical assessment of business websites for our B2B outreach (see section 2); our Website Health Score does not use it. For Google Ads conversion measurement, Google does not act as our processor but as an independent controller under the Google Ads Controller-Controller Data Protection Terms; Google describes how it processes this data in its privacy policy at policies.google.com/privacy. Google LLC is certified under the EU-US Data Privacy Framework, so transfers to the US are based on the European Commission's adequacy decision (Art. 45 GDPR); Google's data protection terms also provide for Standard Contractual Clauses as a fallback (Art. 46(2)(c) GDPR).
• Cloudflare: CDN, security and bot protection; processes data under the DPF/SCCs
• Stripe: Payment processing; operates under the DPF/SCCs and is certified under applicable frameworks
• Technology service providers: We use third-party providers for hosting, email delivery, analytics and the productivity software we use to run the business. Our providers for hosting, email delivery and productivity software act only on our instructions under data processing agreements and may not use your personal data for their own purposes, such as developing or improving their own products. For analytics, Google processes Google Analytics 4 data (collected only with your consent) as our processor under the Google Ads Data Processing Terms. We have switched off all data-sharing settings in our Google Analytics account, so, according to Google, this data is used only to provide, maintain and protect the Google Analytics service. This does not apply to Google Ads conversion measurement; for that and for transfers to the US, see the Google entry above. Your personal data is not used to make automated decisions that produce legal or similarly significant effects about you (Art. 22 GDPR). Some providers are located outside the EEA, including in the United States, where we rely on appropriate safeguards such as the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

You may request a copy of the relevant DPF certification or SCCs by contacting us at info@anetstudios.com.

7. Data Security

We take the security of your personal data seriously and apply technical and organisational measures appropriate to the risk, in line with Art. 32 GDPR. These include encryption of data in transit (TLS/HTTPS); firewall, DDoS, and automated bot protection; access granted strictly on a least-privilege basis; hashed (never plain-text) storage of credentials; regular encrypted backups; and ongoing security monitoring and updates. While no method of transmitting or storing data can be guaranteed 100% secure, we work continuously to protect your information and, in the event of a personal-data breach, will notify the competent supervisory authority and affected individuals where required by law (Art. 33-34 GDPR).

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Contact form submissions and call bookings: retained for 2 years from the date of submission, or longer if you become a client
• Website Health Score: results are held in server memory for about one hour; without a report request they are not stored in a database
• Website Health Score with a report request by email: the URL, a summary of the result and your email address are retained for 1 year after your request or our last contact with you, including in our customer records
• Analytics data (Google Analytics 4, only with your consent): event-level data is kept for 2 months and user-level data for 14 months; the 14-month period restarts when you visit again. After that, Google deletes the data automatically. According to Google, Google Analytics 4 does not log or store the IP addresses of users in the EU, Switzerland or the UK; it derives only approximate location data from them.
• Cookie consent preferences: stored for 1 year

You may request earlier deletion of your data at any time by contacting us.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. Our cookies fall into the following categories:

• Essential cookies: Required for the website to function (session management, security). Always active.
• Analytics cookies: Help us understand how visitors use our site (Google Analytics 4). Only activated with your consent.
• Marketing cookies: Used for ad targeting and campaign tracking. Only activated with your consent.

When you first visit our site, a cookie consent banner allows you to accept all cookies, choose essential only, or customise your preferences. You can change your preferences at any time.

You can withdraw your consent at any time on the Cookie Policy page.

10. Your Rights

You have the right to:

• Access your personal information (Article 15)
• Correct inaccurate data (Article 16)
• Request deletion of your data (Article 17)
• Restrict processing of your data (Article 18)
• Object to processing of your data (Article 21)
• Request data portability (Article 20)
• Withdraw consent at any time (Article 7(3))
• Object to direct marketing at any time, an absolute right (Article 21(2) GDPR). Every marketing email also contains an unsubscribe link.
• Lodge a complaint with the Data Protection Commission (DPC) of Ireland, our lead supervisory authority, as our only establishment is in Ireland, at dataprotection.ie. You may also lodge a complaint with any other supervisory authority in the EU, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

For any data protection request (access, correction, deletion, objection, portability, or to withdraw consent), contact our data protection point of contact at info@anetstudios.com. We have not appointed a Data Protection Officer, as one is not required under Article 37 GDPR.