Privacy Policy

Last updated: 28 September 2026

This policy explains what personal data Check My Sitemap (checkmysitemap.com) collects, why, how long we keep it, and your rights. We collect as little as we can: only what we need to run your audits and take payment.

Who we are

Check My Sitemap, operated by CheckMySiteMap, Maynooth, Co. Kildare, Ireland, is the data controller for the personal data described here. Contact us about anything in this policy at info@checkmysitemap.com.

What we collect

• Account data. When you sign in with Google we receive your name, email address and a Google account identifier. We never see your Google password, and we don't access your contacts, files, calendar or any other Google data.
• Audits. The website addresses you submit and the results we collect by fetching the pages in that site's public sitemap. If those public pages happen to contain personal data (for example a name in a page title), it's stored as part of your audit.
• Branding. If you set up white-label reports, the agency name, website, contact email and phone, colour and logo you provide, which we add to your exports.
• Payments. Stripe processes all payments. We receive and store the payment status, amount, currency and Stripe reference numbers, and a record of credit you buy and spend. We never see or store your card details.
• Emails. We send you service emails about your audits (started, finished or failed). We don't send marketing emails and don't track opens or clicks.
• A session cookie. One strictly necessary cookie (sc_session) keeps you signed in, remembers which audits you started before signing in, and protects forms against forgery. It expires after 7 days, or when you sign out.

We don't use analytics, advertising or tracking cookies, and we don't log visitors' IP addresses. Our servers keep only error and security logs.

To stop abuse of the free checks you can run without an account (audits and the free tools), we count them per IP address. We never store the address itself: the counter uses a keyed, one-way hash of it, is kept only in memory and expires automatically within 24 hours.

To understand how the service is used, we count anonymous events on our own server, such as "a scan was started" or "a report was unlocked", together with the page a visit started from. These counts contain no cookies, IP addresses or browser details, and can't be used to identify you.

How we use it, and our legal basis

• To provide the service you asked for: signing you in, running audits, showing your reports and emailing you about them (performance of a contract).
• To take payment and keep payment records (contract, and legal obligation for tax and accounting records).
• To keep the service secure and prevent abuse, for example by limiting how many audits an account can run (legitimate interests).
• To improve the service using the anonymous event counts described above (legitimate interests).

We don't sell your data, share it for advertising, or use it for automated decisions that affect you.

Google user data

We use the name and email address from your Google account only to identify you when you sign in and to send you emails about your own audits. Check My Sitemap's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't transfer this data to others except the service providers below who help us run the service, and we don't use it for advertising.

Who processes data for us

• Hostinger hosts our server and database, in the United Kingdom.
• Stripe processes payments.
• Google provides sign-in.
• Resend delivers our service emails.
• Backblaze stores encrypted copies of our database backups, in the EU.

Each provider only processes data to provide its service to us. The UK has an EU adequacy decision. Where a provider processes data elsewhere, including the United States, it relies on safeguards recognised under EU and UK law, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

• Audits stay in your account until you archive or delete them. Archived audits, including paid reports, are permanently deleted 90 days after you archive them.
• Audits started without signing in are permanently deleted after 7 days unless you sign in, which moves them to your account.
• Your account stays until you delete it. Deleting it immediately removes your account and all your audits from the service.
• Backups. We back up our database every night so we can recover from failures. Deleted accounts and audits may remain in these backups for up to 30 days, after which they are permanently deleted. Backups are only used to restore the service, never for anything else.
• Payment records held by us are deleted with the audit they belong to. Stripe keeps its own records for as long as the law requires.
• Error and security logs contain no visitor IP addresses or email addresses, and are rotated automatically so only recent activity is kept.

Your rights

Under the GDPR (and the UK GDPR) you can ask us to access, correct, delete or export your personal data, to restrict or object to how we process it, and you can withdraw consent at any time where we rely on it.

• Delete everything yourself at any time from your account page.
• Anything else: email info@checkmysitemap.com. We'll reply within one month.

You can also complain to a data protection authority. In Ireland, that's the Data Protection Commission.

Security

All traffic is encrypted with HTTPS. Reports are only visible to the account (or, before you sign in, the browser) that created them. Our database isn't reachable from the internet, and server access is restricted to key-based logins.

Children

The service isn't directed at children under 16, and we don't knowingly collect their data.

Changes

If we make material changes to this policy, we'll update the date at the top of this page.