Privacy policy
What we collect, why, and how to get it deleted. Short version: we fetch public pages, we keep results, we do not sell anything about you.
- Overview
- What we collect
- How we use it
- Cookies
- Browser extensions
- Who we share it with
- How long we keep it
- Your rights
- California
- EEA, UK and Switzerland
- Security
- Children
- Changes
- Contact
Overview
BlueFrogAnalytics LLC ("we", "us") operates bluefroganalytics.com and the products sold on it: the free website checks, TagFrog, Watch, the GTM container, Websites and Stores, and help by email. This policy explains what personal data we collect when you use the site or those products, what we do with it, and the rights you have over it. OpsBlu (opsblu.com) is a separate site of the same company with its own policy.
What we collect
What you give us
- Contact details: your name, email address and business name when you send the contact form, join a waitlist or request a website mock.
- Account details: email and sign-in data if you create an account for TagFrog, Watch or a Website.
- Messages: what you write to us by email, the contact form or your changes-by-chat channel.
- Payment details: handled by Stripe. We never see or store card numbers.
What the site records
- Usage data: pages visited, time on page, referrer and interactions, through Google Tag Manager and Google Analytics, only after you consent.
- Device data: browser, operating system, screen size and language.
- Network data: IP address (anonymised in analytics) and approximate location.
- Cookies: see the cookies section below.
What the checks record
- URLs: the site you enter into a free check. Nothing about you is stored with it.
- Results: the status, headers, scores and technologies found on the public pages of that site. A result may be kept so the next person who checks the same domain gets an answer without a new fetch.
- Store data, if you install TagFrog: order events and the one-cent test orders TagFrog places and refunds to verify tracking. The details are in the TagFrog app listing.
- We only fetch publicly reachable pages. We never log in to or crawl private areas of a site. How the crawler behaves is described on the crawler page.
If you ask us to email you a report
When you use "Email me this report" we store your email address, the URL you checked, a summary of the results, when you asked, whether you ticked the box for occasional notes, your browser's user agent and a keyed one-way hash of your IP address (never the address itself). We use them to send that one report through our email provider (Resend), to avoid sending the same report twice in a day, and to stop abuse. Only if you ticked the box may we also send occasional notes on fixing what we found. We keep these records for 24 months and then delete them. Every email has a one-click unsubscribe link; once you use it we send nothing more, and we keep only the fact that you unsubscribed so that it stays that way. To have it deleted sooner, use the data rights form.
How we use it
- To run the checks and products you asked for and send you the results.
- To reply to you about an order, a request or a question.
- To take payment for paid products.
- To understand how the site is used and improve it.
- To send one email when a waitlist you joined opens. We do not run a newsletter.
- To meet legal obligations.
Cookies
No analytics or advertising cookie is set until you accept it. The choice is made in the banner on your first visit and can be changed at any time with "Cookie settings" in the footer.
- Essential: needed for the site to work. Always on.
- Analytics: how visitors use the site (Google Analytics through Tag Manager). Off by default.
- Advertising: conversion measurement for ads we run about our own products. Off by default.
- Functional: remembered settings. Off by default.
- Personalization: content tailored to what you looked at. Off by default.
We use Google Tag Manager with Consent Mode v2, with every category denied until you grant it.
Browser extensions
Our browser extensions have their own policies, because they work differently from this site:
- Infrasight (what does this site run?): Infrasight extension privacy policy.
- TagFrog Inspector (record and debug analytics tags; recordings stay on your device): TagFrog Inspector privacy policy.
Who we share it with
We do not sell personal data. We share it only with:
- Processors: Stripe (payments), Google (analytics and Tag Manager), our email provider (transactional email), and the hosting providers that run the site and the products. Each is bound by a data processing agreement.
- Authorities: when a law, subpoena or court order requires it.
- A buyer: if the company or its products are sold, under the same terms as this policy.
How long we keep it
- Account data: while the account is active, then deleted within 90 days of closure.
- Check results: up to 12 months from the check.
- Contact and waitlist emails: until the request is closed or the waitlist opens, or until you ask us to delete them.
- Billing records: as long as tax law requires, including the 14-day refund window.
- Server logs: 30 days.
Your rights
Depending on where you live, you can ask us to:
- Access the personal data we hold about you.
- Correct data that is wrong.
- Delete your data.
- Export your data in a portable format.
- Opt out of any sale of personal data (we do not sell it).
- Withdraw consent for non-essential processing.
Use the data rights form or email privacy@bluefroganalytics.com. We answer verified requests within 30 days (45 days for complex requests, with notice).
California (CCPA and CPRA)
California residents also have the right to know what personal data is collected, used and shared, to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal data, and not to be treated differently for exercising these rights. We do not sell personal data as the CCPA defines it.
EEA, UK and Switzerland (GDPR)
- Our legal bases are consent, performance of a contract, legitimate interest and legal obligation.
- You can complain to your local data protection authority.
- Transfers to the United States are covered by Standard Contractual Clauses.
Security
- TLS for all data in transit.
- Encrypted storage for sensitive data at rest.
- Least-privilege access to production systems.
- An incident response procedure, with notice to you where the law requires it.
No system is perfectly secure. We protect data with care and cannot promise absolute security.
Children
The site and products are for businesses and are not directed at anyone under 16. If we learn we hold data about a child under 16, we delete it.
Changes
When this policy changes, the new version goes on this page with a new date. For a material change we also email account holders.
Contact
- Privacy: privacy@bluefroganalytics.com
- Data rights form: bluefroganalytics.com/data-rights
- Anything else: bluefroganalytics.com/contact
BlueFrogAnalytics LLC, Portland, Oregon.