Privacy Policy

AG AgentReady is owned and operated by Lee Stephens, trading as AG AgentReady. Lee Stephens is the data controller for the personal data described in this notice and decides why and how it is processed.

You can reach us about anything in this notice at support@agagentready.com.

When you run a scan we store the website address you submit, the public content we read from it, the scores and findings we generate, and a timestamp. We also record a coarse record of the request (such as your IP address, device and browser information) to prevent abuse and rate-limit scans.

We record lightweight product events — for example that a report was viewed or a checkout was started — so we can understand how the tool is used.

When you buy a report, our reseller Paddle collects your billing details and payment information directly. We receive only order confirmation data such as the order reference, product, amount, country and the email address used at checkout.

We don't require an account, so we don't hold passwords. We don't read content behind a login, and we never see or store card details — payment data is handled by Paddle and never reaches our servers.

To produce and host your report and to complete your order: performance of our contract with you.

To reply to support messages: performance of a contract or our legitimate interest in answering enquiries.

To prevent abuse, rate-limit scans and keep the service secure: our legitimate interest in protecting the service, and compliance with legal obligations.

To improve the product and publish anonymised benchmarks: our legitimate interest in developing and documenting our methodology.

For any optional marketing email: your consent, which you can withdraw at any time.

We do not sell your data or use it for advertising profiling.

Each report is reachable through a long, unguessable link. Anyone with that link can view the report, so treat it as private and share it only with people you want to see it.

We use anonymised, aggregated results from completed scans to improve our scoring, publish benchmarks and document our methodology. Published research reports aggregates only — for example average scores across qualifying websites in the research corpus, or the share of websites affected by a category of issue. It does not identify individual scanned domains and never includes website addresses, report links, email addresses, IP addresses, finding evidence or anything you submit through the enquiry form.

To be clear about what this does and does not mean: the aggregation happens on our servers and only the resulting figures are published, but the underlying operational records — the address you scanned, your report and its findings — remain stored internally as described above. We can also exclude specific domains from research aggregates on request.

Service providers and subprocessors acting on our instructions: our hosting and application platform, our managed database, and an AI provider that helps write the plain-language summary and recommendations in your report.

Paddle.com, our Merchant of Record for the sale of our products. Paddle handles checkout, payment processing, billing, invoicing, tax compliance and refunds, and acts as controller for that payment data under its own privacy notice.

Professional advisers such as accountants or lawyers, where needed.

Public authorities, where we are legally required to disclose information.

Our providers may process data outside your country, including in the United States and the European Union. Where personal data is transferred out of the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

We apply appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS), encryption at rest on our managed database, row-level access rules, unguessable report tokens, restricted administrative access on a need-to-know basis, and secrets kept out of client-side code. No system is perfectly secure, but we review these measures as the product changes.

Audits and findings are kept so your report link continues to work. Lead submissions are kept while we're in contact with you and for our own records afterwards. Order records are retained as long as required for tax and accounting purposes. When data is no longer needed for these purposes we delete or anonymise it.

Depending on where you live, you may ask us to give you access to your data, correct it, delete it, restrict or object to our processing, or provide it in a portable form, and you may withdraw any consent you gave. Contact us with the report link or the email address you used and we will respond within one month.

If you are in the UK or EEA and are unhappy with how we handled your request, you can complain to your local data protection supervisory authority.

We use only essential cookies and local storage needed to run the service — for example keeping your place during a scan and remembering which report you unlocked. We do not use advertising cookies. Paddle may set cookies necessary to operate its checkout. You can clear or block cookies in your browser, though essential ones are required for the service to work.