What this site collects, and why

The audit form

When you type a website address into the form, our server fetches that site's homepage once, the way a browser would, and reads what it publishes: whether it runs WordPress, which plugins and theme its pages load, its version, and whether its login and XML-RPC endpoints answer. Nothing is submitted to the site and nothing is stored from it except that summary. If a vulnerability check is configured, the plugin names are sent to WPScan's public API to count known issues.

The answers you give on the following screens - site type, what's pushing you to move, design, timeline, budget - and your name and email are sent to us by email when you reach the final step, together with that summary. They are also written to our server logs, where they are kept for the log retention period of our hosting provider (Cloudflare), so that a delivery failure cannot lose your request.

Emails are sent through Resend, which processes your address and the message on our behalf. We use your email to reply to you about your site, and for nothing else. We don't run newsletters, retargeting or lead-scoring, and we don't sell or share the list.

Booking a call

The calendar on the final screen is provided by Cal.com. Booking creates an event in their system under their own privacy policy; we pre-fill your name and email so you don't have to type them twice.

Reading the site

The site itself sets no cookies and loads no analytics or advertising scripts. Pages are served by Cloudflare, which records standard request logs (IP address, user agent, the page requested) to run its network. The calculator on the home page runs entirely in your browser; the numbers you type never leave it.

Your rights

You can ask what we hold about you, ask us to correct it, or ask us to delete it, at any time - email us and we'll do it within a week. If you're in the EU or UK, the GDPR gives you these rights formally; we'd honour them anyway. The controller is LastPatch.