Privacy Policy
Effective date: October 23, 2026
Can AI Agents Use My Site? is operated by Fraser Media in British Columbia, Canada. This policy explains how we handle information when you use the checker or contact us.
Privacy contact: Privacy Officer, Fraser Media — privacy@canagentsusemysite.com.
The short version
We use the URLs you submit to run a public website check and produce a report. The report can contain excerpts of public website content. Scans contact the website being checked and other services described below. Do not submit credentials, private links, access tokens or sensitive personal information.
Original reports are stored on the scanner’s VPS and restricted to the signed visitor session that created them. Other visitors cannot list, retrieve or delete your original reports. If you deliberately create a public report link, anyone with that link can read its summary. Trusted operators can administer the server; this is not an end-to-end encrypted report vault.
Information we handle
Scan submissions. The website address, any additional page addresses and scan settings you choose. Scheduled monitoring is disabled.
Website evidence. Public page addresses and titles, excerpts of page content, metadata, structured data, selected response headers, discovery documents, observed navigation and browser-check results. Public pages may contain personal information, including names and business contact details. We may retain that information when it appears in report evidence.
Operational information. The server receives your network address and request details to answer requests and enforce abuse limits. Admission counters use a hashed client-network key in memory. Application access logging omits request paths, submitted URLs, cookies and payloads; runtime service events and error messages may be logged. Scanning a website also involves resolving domain names and making network requests.
Correspondence. If you contact us, we receive the contact details and information you include in your message. We do not need payment details, government identifiers or other sensitive information to respond to an ordinary support request.
Why we use it
We use information to run requested scans, show and compare reports, troubleshoot errors, protect the service from misuse, answer questions and meet applicable legal obligations. We limit collection and use to purposes appropriate to the service.
The current scanner does not send reports to an external generative-AI model to produce its findings. Scan findings are generated by programmed checks. This does not mean the service has no external network connections.
Where scan requests go
The scanned website, its hosting provider and services loaded by its pages can receive requests from our scanner. They can see the requested addresses and the scanner’s network address and request details. A browser-based scan may load third-party resources embedded in a public page. We do not supply your browser’s login session to the scanner.
DNS-based discovery checks currently use Google Public DNS’s DNS-over-HTTPS service. Google receives the domain names queried and connection information from the scanner. Other discovery checks may follow links to publicly advertised resources on other hosts. These recipients operate under their own privacy practices.
The service runs on a Hetzner VPS identified in our infrastructure records as located in Helsinki, Finland. Application request and error logs are handled on that server. Our contact inbox uses Google Gmail. DNS-based discovery uses Google Public DNS as described above. Information processed outside Canada may be accessible to courts, law enforcement or other authorities under the laws of those locations. Encrypted application and operational recovery backups use Cloudflare R2. Current backup archives exclude visitor and legacy scan databases. Healthchecks.io receives service-health and backup status signals and sends incident emails to our Gmail inbox; these signals do not include report content. Host DNS resolution also uses the VPS-configured network resolvers. These providers may process connection or account information under their own practices. We have not established country-specific processing guarantees for Gmail, R2 or monitoring.
We do not publish reports automatically or provide a public report directory. Choosing Create public link publishes a separate read-only summary containing the scanned site address, sampled page addresses, finding names, reasons, recommended steps and unconfirmed check names. URL query strings and fragments, raw evidence and private scan history are excluded. Anyone with the link can view and redistribute that summary. Links expire after seven days and can be unpublished from the creating visitor session while that session remains valid. Unpublishing cannot recall copies already saved or forwarded. Original reports and legacy operator reports remain private. Review a report before sharing it.
Cookies and browser storage
The checker does not set advertising cookies or require an account. Optional PostHog analytics is described below. A signed, HttpOnly, SameSite visitor cookie scopes access to reports for 24 hours. These are functional cookies. This describes the current application code, not any future hosting platform or added integrations.
A scanned website may set cookies inside the scanner’s separate browser session. Those cookies are not imported from your personal browser. The browser session is closed after the check; reports may still retain the observations collected during it.
Analytics choices are separate from agreement to the Terms of Use. Declining analytics does not prevent you from using the checker.
Storage and retention
Reports are stored on the scanner’s host. Monitoring is currently disabled. Operator-held migration copies, exports and any backups are separate copies and need their own retention and deletion controls. New visitor reports expire after 24 hours and are removed by an hourly cleanup, or sooner when that visitor clears history. Storage is limited to 200 visitor reports overall, 50 per website and scan configuration, 2 MB per report and a 512 MB database ceiling. Limits may remove a report earlier. Legacy operator migration copies are separate private records. Visitor reports are excluded from recovery backups.
Public summaries expire after seven days and are removed by hourly cleanup or sooner when unpublished. Public links stop working at expiry, even before cleanup. Public summaries are separate from the 24-hour original reports and may remain available after an original report expires. Only one link per original report is active at a time, with a limit of ten active summaries per visitor session and 200 overall. These records use the same database excluded from recovery backups.
Clearing scan history does not unpublish a separately shared summary. Unpublish it using the share controls before clearing your session. Clearing scan history removes only that visitor’s records from the active scan-history database; it does not recall downloaded reports, erase recipient copies or necessarily remove log entries or backups.
Application logs omit request paths, submitted URLs, cookies and payloads. Runtime logs are limited to seven days and 32 MB. Encrypted recovery backups contain application source and operational configuration, excluding visitor reports, with seven daily, four weekly and six monthly snapshots. Snapshot expiry follows the backup schedule. Routine support correspondence is retained for 90 days after the case is resolved, with monthly operator review. Open cases are retained while needed for resolution. The shared support inbox is not automatically purged. Existing private legacy scans and disabled monitoring records are scheduled for deletion after November 17, 2026, at the next daily cleanup. A documented legal obligation, unresolved dispute, access request or security incident may require a specific record to be held longer; holds are reviewed monthly. Where information is used to make a decision directly affecting an individual, applicable minimum retention requirements take precedence.
We retain personal information only as needed for the stated purposes and applicable legal requirements. Contact us to request access, correction or deletion of information we control. We may need information to locate the relevant record, verify the request or explain a lawful retention requirement.
Your choices and rights
Automatic form tests send clearly marked generated test values and our dedicated reply address, tests@canagentsusemysite.com to a supported enquiry destination on the scanned website. Those values are processed transiently for the attempt and are not saved in reports, exports or application logs. The selected public form description is retained briefly during preparation and removed when execution begins; an unused prepared form expires after 15 minutes. Redacted submission results expire after 24 hours and are removed during routine cleanup. Clearing your report history also removes your form-test records. The receiving website may retain the enquiry under its own policies. You can choose not to run a scan, limit submissions to appropriate public URLs, and avoid sharing downloaded reports. Send privacy requests or complaints to privacy@canagentsusemysite.com. Depending on applicable law, you may request access to personal information, correction of inaccuracies, or withdrawal of consent, subject to legal and contractual restrictions. Withdrawal may prevent us from continuing the related service.
We will explain how to make a request and respond within the period required by applicable law. If we cannot fulfil it in whole or in part, we will explain the reason where required. You may raise unresolved concerns with the Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca/ or another regulator with jurisdiction.
Optional usage analytics
When enabled, we use PostHog to understand page visits and use of features such as scans, report sections and the contact form. Analytics starts only if you choose Allow analytics. You can decline or change your choice using Analytics preferences. We respect browser Do Not Track and Global Privacy Control signals. We do not send submitted website addresses, report contents, contact details or message text as analytics events. We do not enable session recordings, automatic click capture or advertising profiles. Your consent preference is stored in your browser; an anonymous visit identifier is kept in session storage only after consent. Analytics is processed by PostHog in the United States. Our essential scanner cookie is separate from analytics.
Contact messages
When you use the contact form, we process your optional name, email address and message to respond. Cloudflare handles email delivery, and the message is forwarded to our monitored business inbox. We do not use contact messages for advertising. The website stores only a submission reference, status and a keyed network identifier for duplicate prevention and rate limiting; it does not store message contents. We retain correspondence as needed to answer the enquiry and handle related obligations. You can request deletion through our privacy contact.
Safeguards and disclosures required by law
We use reasonable safeguards appropriate to the information and deployment. No service can guarantee absolute security. We may disclose information when required or permitted by law, including to respond to valid legal process or protect people and the service from unlawful activity. We will handle privacy incidents and notifications as applicable law requires.
Changes
We will update this policy when our practices change and identify its effective date. Where a new purpose or disclosure requires consent, a policy update alone is not a substitute for obtaining it.