Legal
Privacy notice
AIEO is run by CBK Solutions, a UK limited company. This notice explains what we process when you use the scanner, why, and for how long — in plain English.
Who we are
AIEO is run by CBK Solutions, a UK limited company. CBK Solutions is the data controller for the scan service and enquiries described here. For any privacy question, correction, or request, contact hello@aieo.fyi.
What we process
The free scan needs a domain, not an account or email address. It reads public website pages, structured data, crawler instructions and DNS records. Findings can include page titles, URLs and public information about people or businesses on the scanned site.
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Scanned domain, public page findings and report metadata | Generate and share your report; review recent scans and service use | Legitimate interests | 7 days in the report store, when storage is available |
| IP-derived counter identifier | Limit repeated scan requests and protect service availability | Legitimate interests | Up to 1 hour in the scan limiter |
| Domain used for an email-verified scan | Limit repeated verification emails for the same domain | Legitimate interests | 24 hours in the verification-request limiter |
| Optional email address, verification link and emailed report | Verify and deliver the report you request through Resend | Consent | Verification link valid for 1 hour; message and provider records have separate retention, explained below |
Reports and shareable links
When report storage is available, we keep the report, its domain, score and creation time in Cloudflare KV for 7 days. The report can then be reopened or shared. Anyone who has the report link can read it. There is no account login protecting that link, so share it only with people you want to see the findings.
The stored report expires automatically. Copies you or other people download, email or keep in a browser can remain after the server copy expires. If storage is unavailable, the scanner can display the findings without creating a working share link.
How we review recent scans
Authorised operators can inspect the existing, short-lived domain and report metadata to understand use of the scanner and investigate problems. We can also calculate totals, such as retained reports per day and the number of different domains scanned. This review uses the existing seven-day records; it does not create a separate domain history.
A submitted domain does not tell us who submitted it or whether they own it. We do not use scanned domains to identify visitors, build an unsolicited contact list or infer permission to send marketing. Counts include automated and repeated scans; they are not counts of people or potential customers.
If you connect AIEO to an AI assistant through MCP, the assistant sends the domain, report ID or check ID needed for the tool you request. AIEO returns the findings to that assistant. We do not need your email address, conversation history or access to your private accounts. The same seven-day report policy applies; your assistant provider's own terms govern its handling of the returned information.
Abuse prevention
The scan limiter uses a secret-keyed hash of the connecting IP address for short-lived counters, kept for up to an hour. The application does not put the raw IP address in those counter keys. If its secret or hashing is unavailable, it skips storing that counter. Hashing is a safeguard, not a promise that data is anonymous. Cloudflare also receives your IP address when it handles the request.
For email-verified scans, a separate counter stores the normalised domain for 24 hours after the verification email is accepted for sending. This limits repeated requests for that domain; it is not a visitor profile.
If you ask for the report by email
The free scan works with no email at all. If you choose to receive the verified report by email, we pass your address, the verification message and the report to Resend for delivery. The verification link is valid for one hour and contains signed information including the domain and email address. Keep it private. Signing protects against alteration; it does not make the contents secret.
We do not add report recipients to a marketing list. Verification links can remain in your mailbox or browser history, and email delivery or hosting records may contain related information. Those records are separate from the seven-day report store, so expiry of a link or report does not delete every copy of an email or technical record.
Hosting, email and technical records
Cloudflare hosts the website and processes requests, stored reports and technical information needed to deliver and secure the service. Resend processes optional scan emails. Hosting logs and delivery records can include IP addresses, request information, recipients and message-related data. Their retention depends on the provider service, configuration and applicable terms; the report-store expiry does not govern those logs.
These providers operate internationally, so data may be processed outside the UK. Contact us for details about the provider arrangements, retention and applicable transfer safeguards for your information.
Browser storage and your choices
The site code does not install advertising pixels or third-party visitor analytics. It does use browser storage for the following display and report functions. We do not use these stored values to follow you across websites or choose advertising.
| Browser storage | Purpose | Duration |
|---|---|---|
| Theme preference (local storage) | Remember the light or dark theme you choose | Until you change it or clear site storage; no automatic expiry |
| Report handoff (session storage) | Carry your scan result to its report page without waiting for server storage | Removed when consumed by the report page; otherwise remains for the browser session |
| AIEO self-scan scores (session storage) | Reuse the homepage demonstration scores and avoid repeated scans of our own site | Reused for up to 1 hour; the stored entry can remain for the browser session |
| Display-storage objection (local storage) | Respect your choice not to remember display preferences; no visitor identifier | Until you re-enable remembering or clear site storage |
Turn this off to clear and stop remembering your theme and our homepage demonstration scores. The theme control still works on the current page. We store only your objection for this choice, so it is respected on your next visit. The report handoff remains available.
You can also clear or block site storage in your browser settings. Clearing it removes the objection above, so you may need to set your choice again. Blocking storage can reset remembered preferences or make a report take longer to load. Browser session restoration may preserve session storage beyond closing a window. Clearing browser storage does not delete a server-side report; contact us if you want to request its removal.
Lawful basis
Where the scan or operational information is personal data, we rely on legitimate interests: providing the scan you request, keeping the service available, preventing abuse and understanding problems using recent records. Optional verification and report emails are sent with your consent. Withdrawing consent stops future processing that relies on it; it cannot recall a message already delivered.
If you email us directly, we use your contact details and message to answer the enquiry and arrange any work you request. We keep that correspondence for as long as needed to resolve the enquiry, document agreed work and meet applicable recordkeeping obligations. This relies on our legitimate interest in responding, or steps towards an agreement at your request where applicable.
Your rights
Depending on the information and lawful basis, your UK GDPR rights include:
- Ask what personal data we hold about you and get a copy of it
- Ask us to correct inaccurate data
- Ask us to delete data we hold about you
- Ask us to restrict processing, or receive portable data where that right applies
- Object to processing based on legitimate interests
- Withdraw consent at any time where processing relies on it
To exercise a right, email hello@aieo.fyi. A report link, domain and approximate scan time can help us find the relevant record; we may need enough information to verify your request. If you're unhappy with how we've handled your data, you can also complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Last updated: 9 September 2026.