Privacy notice

Who we are

Proxa is run by a sole trader based in the United Kingdom. Proxa is not yet a registered company. We are the controller of the personal data described here.

To contact us about your data, send a message through our contact form and say it’s a privacy request.

What we collect and why

Contact form

Your email address, the platform you use, and optionally your name, store URL, the plan you’re interested in and your message. We also record when you agreed to the consent statement. We use this to reply to you and help you get started with Proxa.

Lawful basis: your consent, which you give by ticking the box on the form.

Partner applications

Your name, email address, agency name, and optionally your agency’s website. We also collect how many client stores you look after, which platforms you work with and any message you add. We use this to assess your application and to contact you about the partner programme.

Lawful basis: your consent, which you give by ticking the box on the form.

Free audit

The store web address you enter and the results of the audit: score, findings, detected platform and the public page addresses we checked. We use this to:

• show you your report;
• avoid re-crawling the same store within 24 hours;
• understand which stores are interested in Proxa.

Anyone who has a report’s link can view it. The audit only reads public pages of the store; it never submits forms or touches checkout.

Lawful basis: legitimate interests (providing the tool).

IP addresses (rate limiting and abuse prevention)

We never store your IP address itself. We store a one-way, salted hash of it, which is used in two ways:

• Short-term rate-limiting records, deleted within 2 hours.
• A copy kept alongside audits and form submissions, so we can tell when someone has used their free audit or already completed a form. These hashes are erased after 30 days.

Lawful basis: legitimate interests (protecting the service from abuse).

Bot protection

Our forms use Cloudflare Turnstile to tell people from bots. Turnstile processes signals such as your IP address and information about your browser. Cloudflare states that it uses these signals only to detect bots, not to identify, profile or target individuals.

Lawful basis: legitimate interests (preventing spam and abuse).

Technical logs

Like any website, our hosting provider handles your IP address and browser details to deliver pages to you. It also keeps short-lived technical logs to keep the service running and secure.

Lawful basis: legitimate interests (running a secure website).

Analytics

We don’t currently use any analytics on this site.

What we don’t do

We don’t sell your data, use it for advertising, or use tracking cookies. We don’t make automated decisions about you.

How long we keep it

• Contact form enquiries: until you ask us to delete them or withdraw consent, and no longer than 24 months after we last hear from you.
• Partner applications: 24 months.
• Audit results: 12 months.
• Hashed IP addresses: 2 hours for rate limiting; 30 days when kept alongside an audit or form submission.

Data is deleted automatically once these periods end.

Who we share it with

We use Cloudflare, Inc. to host the website and its database, provide bot protection, and keep technical logs. Cloudflare processes personal data on our behalf, under our instructions. We don’t share your data with anyone else unless the law requires it.

International transfers

Cloudflare runs a global network and may process data outside the UK. Where that happens, Cloudflare uses appropriate safeguards required under UK data protection law.

Cookies

Our website doesn’t set any cookies or store anything in your browser to track you. To tell people from bots, Cloudflare Turnstile and Cloudflare’s security systems may store strictly necessary data in your browser. Because that’s needed only for security, we don’t ask for consent and there’s no cookie banner.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use it;
• object to our use of it, where we rely on legitimate interests;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting anything we did before you withdrew it.

To use any of these rights, send a message through our contact form saying it’s a privacy request. We’ll reply within one month.

If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first.

Changes to this notice

If we change how we use personal data, we’ll update this page and the date at the top.