Privacy Policy
Super Site Report collects as little as possible. We store the website addresses people scan, the public results of those scans, a short-lived hashed form of your IP address for rate limiting, and anything you choose to send us through a form. We do not use advertising or analytics trackers, and we do not sell data.
Last updated: October 27, 2026
Who we are
This site, supersitereport.com, is operated by SuperSiteBros (“we”, “us”). You can reach us through the contact page.
What we collect and why
| Data | Why | How long |
|---|---|---|
| The website address you scan and the scan result | To run the scan and show you the report. Homepage results that meet our quality bar are published as public reports about that website. | Scan jobs are deleted after 2 days. Public reports and their score history are kept until the site is re-scanned or the report is removed. |
| A hashed (one-way) form of your IP address | Rate limiting, so one visitor cannot overload the service. We do not store raw IP addresses with scans. | Deleted with the scan job after 2 days. Rate-limit counters expire after at most a day. |
| Contact form messages (name if given, email, message) | To reply to you. | Until the conversation is finished, then deleted. |
| Lead form submissions (name, email, site, message, issue, report URL) | To follow up on quote/review requests and notify the site owner. | Until the conversation finishes, or on request. |
| Monitoring subscriptions (email, site hostname, tokens) | To confirm opt-in, run weekly rescans, and send change alerts. | Until you unsubscribe or we delete the account on request. |
| Funnel click events (placement, campaign, scanned hostname — no personal data) | To measure which SuperSiteBros links visitors use. | Aggregated indefinitely; raw rows may be pruned after ~90 days. |
| Report removal requests (domain, email, reason) | To review and action the request. | Kept as a record of the removal so the report is not republished. |
| Web server logs (IP address, browser, page requested, time) | Security and troubleshooting. | Rotated automatically within about two weeks. |
Public reports are about websites, not people
Reports describe the public, technical state of a website: headers, page titles, speed measurements and similar facts that anyone can see by visiting it. We do not show who ran a scan. If you own a site and do not want a public report, use the removal link on the report or contact us.
Cookies
We do not set tracking or advertising cookies. The site works without cookies for visitors. If you log in to the site’s admin area, WordPress sets the cookies it needs for that session.
Third parties
Fonts, scripts and images are served from this site. Scans run on our own server, including the Lighthouse speed test, which runs in a headless Chrome browser we host. We do not send your data to analytics, advertising or AI services. Our hosting provider processes data on our behalf to run the server.
How our scanner behaves on other sites
When you scan a site, our crawler identifies itself as SuperSiteReportBot, respects robots.txt, and fetches at most 25 pages, one at a time. Details are on the methodology page.
Lead forms and SuperSiteBros hand-offs
When you use a “Fix this for me”, free expert review, or similar form on SuperSiteReport, we store the details you submit (name, email, website, optional message, the report link, and which issue you asked about) in a private leads table so we can follow up. We email those details only to the site owner address configured in WordPress (admin_email) — never to an address you type as a recipient. We do not sell this data. We keep leads until the conversation is finished or you ask us to delete them.
Every outbound link to SuperSiteBros includes a simple UTM tag (utm_source=supersitereport plus a medium and campaign for the button you clicked) so we can see which placements help. Click logging on our side records only the placement and campaign names and the scanned hostname — not your name or email.
Free weekly monitoring
If you sign up for weekly monitoring, we store your email and the site hostname, send a confirmation link (double opt-in), and then re-scan that site about once a week through the same scan queue used by live visitors, at lower priority and within the same rate limits. We email you only when the score drops or a new critical/high issue appears, and every email includes a one-click unsubscribe link. Caps limit how many sites one email can monitor and how many monitors exist overall. Sign-ups stay closed until outbound email from this server is reliable (SPF, DKIM, DMARC and a working mail path).
Your rights
Depending on where you live (for example under the GDPR in the UK and EU, or the CCPA in California), you can ask to see, correct or delete personal data we hold about you, or object to how we use it. Send the request through the contact page and we will respond within 30 days. You also have the right to complain to your local data protection authority.
Children
This service is not aimed at children under 13, and we do not knowingly collect their personal data.
Changes
If we change this policy, we will update the date at the top of this page.