Privacy policy

The controller under the EU General Data Protection Regulation (GDPR) is Nick Aloys-Ecker, Persuttweg 3, 6561 Ischgl, Austria, email hello@mail.foldscore.com. Write to this address for any privacy question or request.

Our hosting provider (Vercel) processes technical data of every request, such as IP address, time, requested page and browser type, to deliver the site and keep it secure. These server logs are kept only briefly. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).

We count visits and a few anonymous actions (for example "analysis started" or "share button clicked") with Vercel Web Analytics. It sets no cookies and doesn't track you across sites or days; visitors are counted via a hash that is discarded after 24 hours. Legal basis: Art. 6(1)(f) GDPR (understanding how the product is used).

When you submit a URL, we load that public page, take screenshots, measure its speed and have an AI model review it. We store the URL, the page's text and structure, the screenshots and the result.

Results are visible to anyone who has the result link. Screenshots are deleted after 30 days. Results are kept until FoldScore is discontinued, and at most 12 months after the analysis.

Your IP address is never stored. We store a salted, one-way hash of it to enforce rate limits and stop abuse. If bot protection is active, Cloudflare Turnstile checks your browser when you submit the form.

A submitted page may itself contain personal data (for example names in testimonials). We only process what the public page shows, only to score it.

Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse and controlling costs (Art. 6(1)(f) GDPR).

If you enter your email to see the three biggest weaknesses, we store the email address, which result you unlocked and when, and email you the results with a link back to them. This is a transactional email, not a newsletter.

Legal basis: Art. 6(1)(b) GDPR. We keep the address until you unsubscribe or ask us to delete it, and at most 12 months after the last email we sent you. If you also subscribed to the newsletter, section 5 applies.

If you tick "Send me one landing page teardown a week (pages that scored 85+ and why), plus occasional tips and offers.", we first send a confirmation email (double opt-in). Only after you click the link do you get marketing emails. As proof of your consent we store the checkbox text, the time of consent and the time of confirmation.

After confirming, you receive a short welcome sequence: a tip 2 days later and an offer for the full report with a personal 20 % discount code 5 days later. After that, one landing page teardown a week, plus occasional tips and offers.

Every email has an unsubscribe link, and unsubscribing takes one click. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

If our daily capacity is used up, you can leave your email and URL. We score the page the next day and email you the link. Legal basis: Art. 6(1)(b) GDPR.

Payment is handled by Stripe on Stripe's own checkout page. We never see your card or bank details. We store the order (email address, result, product, amount, currency, Stripe payment ID, status and time) and email you the link to your report.

Legal basis: performing the contract (Art. 6(1)(b) GDPR) and our legal obligations to keep accounting records (Art. 6(1)(c) GDPR). Order records are kept for 7 years, as Austrian tax law requires (§ 132 BAO).

We only use cookies that are strictly necessary for features you use. They don't track you and need no consent:

• owner_<id>: remembers that you started this analysis, so you see the owner view (share texts, report link). Set when you submit a URL.
• unlocked_<id>: remembers that you unlocked the weaknesses of this result in this browser. Kept for 90 days.

Cloudflare Turnstile may store technical data in your browser for the bot check.

We use the following providers as processors, bound by data processing agreements. Some are located outside the EU; transfers are based on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses.

• Vercel Inc.

  Purpose

  Hosting of this website and its server functions, storage of screenshots (Vercel Blob), scheduled jobs, privacy-friendly visitor statistics (Web Analytics).

  Data

  Technical request data incl. IP address (short-term server logs), screenshots of scored pages, anonymous usage events.

  Location

  USA (server functions in Washington, D.C.); EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

  Privacy policy

  vercel.com/legal/privacy-policy

• Neon (Databricks, Inc.)

  Purpose

  Database for results, email addresses, consents and orders.

  Data

  Everything listed in sections 3–7 of this policy, except payment details.

  Location

  USA (database hosted on Amazon Web Services); Standard Contractual Clauses.

  Privacy policy

  neon.com/privacy-policy

• Upstash, Inc.

  Purpose

  Counters for rate limits and the daily cost limit.

  Data

  Salted hashes of IP addresses, result IDs, counters. No raw IP addresses.

  Location

  USA; Standard Contractual Clauses.

  Privacy policy

  upstash.com/trust/privacy.pdf

• ScreenshotOne

  Purpose

  Loads the page you submit and takes screenshots of it.

  Data

  The submitted URL and the public content of that page.

  Location

  Servers in the USA (DigitalOcean, Google Cloud) and the EU (Hetzner). Only the public page you submit is processed, no data about you.

  Privacy policy

  screenshotone.com/privacy-policy/

• Google Ireland Ltd. (PageSpeed Insights API)

  Purpose

  Measures the loading speed of the page you submit.

  Data

  The submitted URL. Google loads the public page itself.

  Location

  Ireland / USA; EU-U.S. Data Privacy Framework.

  Privacy policy

  policies.google.com/privacy

• Anthropic PBC

  Purpose

  AI model (Claude) that reviews the page and writes the results and the full report.

  Data

  The submitted URL, the text and structure of the page, screenshots, speed metrics. No email addresses or payment data. Under Anthropic's commercial terms, this data is not used to train models.

  Location

  USA; Standard Contractual Clauses (part of Anthropic's data processing addendum).

  Privacy policy

  www.anthropic.com/legal/privacy

• Resend (Plus Five Five, Inc.)

  Purpose

  Sends our emails (results, confirmations, follow-ups, the link to your report).

  Data

  Email address, email content, delivery and bounce events.

  Location

  USA; EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

  Privacy policy

  resend.com/legal/privacy-policy

• Stripe Payments Europe, Ltd.

  Purpose

  Payment processing for the full report. Stripe also acts as an independent controller for fraud prevention and its legal obligations.

  Data

  Email address, payment details (entered on Stripe's page, never seen by us), billing country, order ID, amount.

  Location

  Ireland; transfers to Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

  Privacy policy

  stripe.com/privacy

• Cloudflare, Inc.

  Purpose

  Bot protection on the URL form (Turnstile) and DNS for our domain.

  Data

  IP address and technical browser signals, only for the bot check.

  Location

  USA; EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

  Privacy policy

  www.cloudflare.com/privacypolicy/

The score is an automated assessment of a web page, not of a person. It has no legal or similarly significant effect on you.

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw any consent at any time. Just email us.

You also have the right to lodge a complaint with a data protection authority, for example the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

We update this policy when the service changes. The current version is always on this page.