Privacy policy

Heath Road BV is the controller for Marketing Scan and determines why and how data on this website is processed. Registered office: Heistraat 1, 9052 Ghent, Belgium. Company and VAT number: BE0729951130. Contact address: IJzerlaan 13/001, 9000 Ghent, Belgium. For privacy questions or requests, use the email address below or reply to an email you received from us.

info@marketingscan.be

• Advertising measurement after consent: for a newly verified account we may report CompleteRegistration to Meta through the browser and our server using the same event ID. Only after renewed consent do we share a SHA-256 hash of your email, any Meta browser and click IDs, and browser identification. A hash is not anonymous information. No passwords, website content or IP address are shared in this server event. Matching data is cleared on accepted delivery or, after 24 hours, at the next scheduled cleanup; delivery status contains no email. Withdrawing via Cookie preferences stops pending events. Earlier delivery cannot be undone.
• Quick scan: domain, publicly accessible homepage content, technical headers, DNS and security signals. Purpose: provide the requested report. The scan is a snapshot and does not inspect protected systems.
• Report request: name, business email, optional company and phone, domain, score and campaign data. Purpose: deliver and meaningfully follow up the report.
• Contact and quote: messages, appointments, quote details and relevant contact history. Purpose: answer questions and prepare or provide requested services.
• Site use, without cookies and for everyone: which pages are viewed and for how long, where you came from (search engine, ad, campaign), the type of device and browser, the country based on your network and what you do on the site (for example starting a scan or opening a form). We do not store IP addresses; to count visits we use a code that changes every day and cannot be traced back to you. Your origin is only kept in your browser during your visit. Purpose: see what works and improve the site (legitimate interest). Only after your consent: cookies from Google Analytics and Microsoft Clarity (recordings and heatmaps of visits, with input fields masked) and the advertising pixels of Meta and OpenAI.
• Business outreach: public company and professional contact details, scan result, sending status and objection status. Purpose: propose relevant B2B services. This relies on legitimate interests after a balancing test, not merely because data is public.
• Platform account: email address, your projects (websites), the results of the checks, any connected Google data, your answer to 'How is it going?' and, if you came through another user's link, who invited you. We also record which screens and features you use in the platform and when, to see what works and what can be better (kept for 13 months). Purpose: provide the dashboard, improve the platform and see which recommendations work. You can have your account and projects deleted at any time. We also save your chosen improvements with your account. Within the same browser tab, a random session code links your campaign source to your confirmed signup and later platform activity (up to 13 months). Campaign labels contain no email addresses. Account and audit email sending and delivery statuses are retained for up to 60 days.
• Google Analytics 4, if you connect it: the selected property and web stream, aggregated users, sessions, page views, key events and traffic channels over 28 days, and an encrypted OAuth refresh token. We read these for your dashboard and refresh them automatically about once a day; manual refreshes may occur more often. Disconnecting deletes the token and saved figures from our platform.
• Facebook and Instagram, if you connect them: the names of the Pages and Instagram business accounts you choose, their follower counts and the statistics of their posts, and an encrypted access token. Purpose: show them to you in your dashboard and compare them over time. We do not sell them or use them for advertising. Disconnecting deletes the token and the statistics straight away; how to have everything deleted is on the Data deletion page.
• Beta waitlist: your email address, which beta you signed up for and, if you fill them in, your answers to two questions (what you use now and what you would pay per month). Purpose: tell you when it opens and shape the offer. Kept until the beta opens, at most 24 months. For a visit without a campaign link we only keep the name of the website you came from (e.g. google.be), never the full address.
• Affiliate programme: we process your accepted terms version, name, address, country, VAT number if applicable, account holder and IBAN for participation and reviewed payouts. Referral codes link new accounts to their referrer; affiliates cannot see referred users’ identities or websites. Commissions, adjustments and payout evidence support the agreement and accounting. Account deletion removes the active affiliate profile; financial evidence and necessary payment details remain for applicable legal obligations and outstanding settlements.
• Referral links: we count link visits by referrer, Belgian calendar day and sharing channel for up to ninety days. These counts store no IP address, visitor identity or raw browser data and use no additional visitor cookie. Known bots and previews are filtered on a best-effort basis; counts do not represent unique people. Deleting a referrer account removes its visit counts. Financial settlement references remain part of separate accounting records where required.

We do not sell personal data. We only share what is necessary with hosting, database, email, analytics and scheduling providers working for us. This may currently include Vercel (hosting and cookieless visitor statistics), Neon (PostgreSQL), Resend, Anthropic (optional AI analyst), Google Tag Manager/Analytics, Microsoft Clarity, the Meta pixel (Facebook and Instagram) and the OpenAI pixel; those two pixels measure which enquiries come from our ads. Analytics, Clarity and those pixels load only after consent. Some providers process data outside the EEA; in that case we rely on an adequacy decision or appropriate contractual safeguards.

IP addresses for report requests are removed within 30 days and for scans within 90 days. Anonymous visit events are kept for 180 days by default, platform use per account for 13 months, support questions and reports for up to 24 months. Other report and contact data is kept for no more than 24 months after the last meaningful contact, unless a contract or legal duty requires longer. After an objection, only the minimum suppression record needed to prevent further outreach remains.

To diagnose scan problems, we keep the domain without a URL path, an error category, scan type and coarse device class for up to 180 days. API diagnostics are aggregated per day without visitor identifiers; browser reports are part of the daily anonymous visitor measurement. We do not retain raw error messages or full browser details in these diagnostics.

You may request access, correction, deletion, restriction, portability or object, and may withdraw consent at any time. You can object to direct marketing free of charge at any time; we will stop that communication. You may also complain to the Belgian Data Protection Authority at dataprotectionauthority.be.