Privacy Policy
Last updated: 1 November 2026
This policy explains what information TrackWatch collects, why, who we share it with, how long we keep it, and the rights you have. It covers visitors to trackwatch.info and partners.trackwatch.info, the UK businesses whose public websites we scan, businesses we contact about what we found, and people who buy from us: businesses buying help to fix their own website, and agencies buying prospects.
Who we are
This website is owned and operated by Stuart McCulloch trading as TrackWatch. For the purposes of UK data protection law, I am the data controller responsible for the personal information described in this policy. Information Commissioner's Office Registration (ICO): Stuart McCulloch, registration reference ZC275210, registered 14 October 2026. The entry can be checked on the ICO public register.
The law we work to
We apply UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) to all processing relating to UK businesses and UK buyers, and EU GDPR where it applies to EU buyers.
Visitors to this website
We don't use cookies, analytics, or any tracking scripts on our websites, and we don't collect anything about you if you're simply browsing. Our fonts and icons are served from our own website, not loaded from outside services such as Google Fonts, so opening one of our pages doesn't send your IP address to them.
Information we collect
About scanned businesses. To find UK businesses with a problem in how their website handles ad tracking and visitor consent, we process: business name, website address, technical findings and a screenshot of the homepage from an automated visit to their public website (the homepage and, for online shops, one product page), whether the business appears to be running paid ads on Google or Meta, its Companies House number and status, and a business contact email address published on its own website. We only keep general business addresses (such as info@ or sales@) on the business's own domain: usually its website's domain, or occasionally another domain we've confirmed belongs to the same registered company (for example, the domain of its trading name). We don't keep an address that includes a person's name, an address at another organisation, or a free webmail address such as Gmail, even where it's the only one published. Only businesses confirmed as live, registered limited companies or LLPs are ever contacted by us or supplied to an agency. We do not collect home addresses, personal (non-business) email addresses, or any data about visitors to the sites we scan.
Personal details in a website's own tracking. While we look at a website, its tracking tools sometimes send personal details to an advertising or analytics platform (for example, an email address carried in a page address). We check for this, because it is one of the problems we report. When we find it, we record only that it happened, what kind of detail it was (such as "an email address"), which platform it went to and on which page. The detail itself is discarded on the spot and never stored, shown in an audit or passed to anyone. Full detail is in our scanning methodology.
About businesses we contact. If we email a business about what we found, we keep a record that we did, when, and the address we used. Each business we contact has its own audit page on this website, at an address we send only to that business. Audit pages aren't listed or linked anywhere on our site, and are marked so search engines don't index them.
If you buy help to fix your website. Your name, business name, website, email address, and what you bought. If you choose "Fix it for me", we also hold the access details needed to carry out the fix, only for as long as the work takes.
If you buy a Full Scan. The website and verification email address you give at checkout, a record of when and from which address ownership was confirmed, and your results. The test identity our scan types into your forms is invented by us and belongs to no one. Your results page is at a private address we send only to you.
If you're an agency buying prospects. Your company name, a contact email, the criteria you set at checkout, and a record of your purchases and deliveries.
Payments are handled by our payment provider, Creem. We do not see or store card details.
If you contact us. The details you include in an email to us, which we use only to reply and keep a record of the conversation.
Why we use it, and our lawful basis
- To scan and verify businesses and record what we find: legitimate interests (Article 6(1)(f) UK GDPR / EU GDPR).
- To contact a business directly about a problem we found on its own website, and offer help to fix it: legitimate interests. We send at most a short series of emails (up to three, within 30 days), stopping as soon as the business replies or opts out. We email only limited companies and LLPs, which PECR allows without prior consent provided we identify ourselves and offer a simple opt-out. Every email we send does both.
- To supply findings to agencies that help businesses fix these problems: legitimate interests.
- To deliver what you buy from us and keep a transaction record: contract, and legal obligation for accounting records.
- To reply to your enquiries: legitimate interests.
We have carried out a Legitimate Interest Assessment covering this processing, available on request.
Each business is used once
A business we scan is used for at most one thing: either we contact it ourselves, with one short series of emails, or we supply it to one agency. Never both, and never more than once. A business we've contacted is never supplied to an agency, and once our series of emails ends it is never contacted by us again. A business supplied to an agency is never contacted by us (other than to reply if it gets in touch with us). This applies even if the business turns up again in a later scan, and our system enforces it directly.
Who we share it with
We do not sell personal data about individuals. We share information only where needed:
- Agencies. We supply findings about some businesses to digital marketing agencies that help businesses fix these problems. They are licensed to use them only under our Data License & Usage Terms, which require their own lawful basis for any contact, prohibit resale, and require deletion after 12 months.
- Specialists. If a business buys "Fix it for me", we share the details needed with the specialist who carries out the work, under a written agreement requiring them to keep it confidential and use it only for that job.
- Service providers. Hosting (Hetzner, Germany), email (Google Workspace), payments (Creem), and the data sources we use to verify businesses and their advertising (the Companies House register and public ad libraries).
International transfers
Our systems are hosted in Germany (EU). Where a provider processes information outside the UK or EEA, we rely on an adequacy decision or appropriate safeguards such as standard contractual clauses.
How long we keep it
- Scan data, including audit pages and screenshots, is deleted automatically 12 months after the scan, or earlier if the business opts out. Records tied to a completed sale to an agency are kept as our transaction record.
- We keep a permanent, minimal record that a business has been contacted by us or supplied to an agency (its name, website and the date), because that is how we make sure it is never contacted or offered again.
- Opt-out requests are kept permanently, so an opted-out business is never scanned again.
- Access details for "Fix it for me" are deleted once the work is complete.
- Full Scan results pages are deleted 12 months after the scan. The record that ownership was confirmed is kept with the purchase record.
- Purchase and accounting records are kept for as long as the law requires. Enquiry emails are kept for as long as needed to deal with the enquiry.
Your rights
Under UK and EU data protection law, you have the right to ask what information we hold about you or your company, ask us to correct or delete it, restrict or object to our processing, and receive your data in a portable format. To exercise any of these, email hello@trackwatch.info. We aim to respond within one month.
To opt out of scanning, email optout@trackwatch.info. If we've emailed you, you can also reply asking us to stop, or use the opt-out link in our email.
How we keep information secure
We use appropriate technical and organisational measures to protect the information we hold, including access controls and encrypted connections. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.
Children
Our services are for businesses. We do not knowingly collect information from anyone under 16.
Complaints
If you have a concern, please contact us first at hello@trackwatch.info so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by phone on 0303 123 1113.
Changes to this policy
If this policy changes in any meaningful way, we'll update the date at the top of this page.