Privacy policy

ZeroPixel is a trading name of Milex Systems Ltd, a company registered in England and Wales under company number 12168672. We are the “controller” of the personal data described on this page, which means we decide why and how it is used, and we are accountable for it.

• Registered office: 9, 50a The Viewpoint, Sheep Street, Northampton, NN1 2LZ, United Kingdom
• Privacy contact: privacy@zeropixel.io
• General contact: sales@zeropixel.io

We are not required to appoint a Data Protection Officer, and have not appointed one. The privacy address above reaches the people who can actually action a request.

Nothing here is collected “just in case”. Each item below exists because a specific part of the site would not work without it.

When you browse the site

Our hosting provider processes the technical information every website receives in order to serve a page — your IP address, the page requested, your browser type and the site you came from. This sits in server logs and is used to keep the site up and to investigate faults and attacks. If something fails on our side — a page, the audit, the enquiry form — a record of the error, saying what failed and where, goes into the same logs so we can fix it.

If you accept analytics, Google Analytics records the pages you view, the site you came from, your browser and device type, and an approximate location worked out from your IP address (Google does not store the address itself). Two cookies let it recognise a returning visitor across days. Nothing is collected this way until you accept, and if you decline it is never loaded.

You can switch it off at any point from the cookie preferences, at which point it stops immediately and its cookies are deleted. Google also offers a browser add-on that blocks Google Analytics on every site. Full detail is in the cookie policy.

When you send an enquiry

The form at /discuss asks for your first and last name, email address, phone number, a project title and description, and optionally your budget and timeline. If you came from the audit tool, the report you were looking at is attached to the enquiry so we know what we are talking about before we reply.

We use this to answer you, scope the work and prepare a quote. Please do not put anything confidential or sensitive in the project description — it is a first contact form, not a secure channel, and a mutual NDA is a better place for the detail.

When you run a free website audit

The tool at /audit takes a website address and produces a report. It needs no name, email or account. To run it we process:

• The website address you enter, and everything the scan then finds on that site — page titles, headings, visible text, images, links, and any contact details published on it.
• A random identifier stored in your browser (the zp_audit_id cookie) and a one-way hash of your IP address, used purely to count how many free scans have come from you. We store the hash, not the IP, and it cannot be turned back into an address.
• Bot-detection signals from your browser, assessed at the moment you submit. Every scan costs us a live browser session, two Google PageSpeed calls and an AI analysis, so the endpoint has to be able to tell a person from a script.

When you email us

We keep the correspondence, along with your address and anything you chose to put in it, so there is a record of what was agreed.

UK GDPR requires a specific legal reason for every use of personal data. Ours are:

• Answering your enquiry and quoting — Article 6(1)(b), steps before a contract. You asked us to get in touch about a possible engagement; we cannot do that without your contact details.
• Delivering work we have been engaged for — Article 6(1)(b), contract.
• Running the free audit tool — Article 6(1)(f), legitimate interests. Our interest is offering a genuinely useful free tool that introduces our work, and running it without it being drained by automated abuse. The impact on you is minimal: no account, no name, no email, and the anti-abuse data is a random identifier and a hash.
• Security, fraud prevention, fixing faults and keeping the site available — Article 6(1)(f), legitimate interests, and, for the storage that involves, the strictly-necessary exemption in regulation 6(4) of PECR.
• Analytics — Article 6(1)(a), consent. Our interest is knowing which pages are read so we can stop maintaining the ones that are not. Google Analytics only runs once you accept it in the cookie banner; until then, and if you decline, it is not loaded at all. Withdrawing consent deletes its cookies and stops it immediately. You can withdraw by switching it off in the cookie preferences.
• Keeping records and meeting our own legal and tax obligations — Article 6(1)(c).

We do not ask for, and have no use for, special category data — health, ethnicity, political opinions, and so on. Please do not send it to us.

The audit tool will scan any publicly reachable website, and the report may contain personal data belonging to people who never visited this site — typically staff email addresses and phone numbers published on a contact page. Where that happens we rely on legitimate interests, and we limit the intrusion in specific ways:

• The scan only reads pages that are publicly published and reachable from the homepage. It does not log in, guess URLs, bypass any restriction, or read anything a search engine could not.
• It follows the same limits as an ordinary visitor and stops after a small number of pages.
• Contact details found during a scan are shown in that report and are never added to a marketing list, sold, or used to contact anyone.
• Anyone whose details appear in a report can have them removed by emailing privacy@zeropixel.io with the domain concerned.

You may only scan a site you own or are authorised to test. That obligation is set out in the audit tool terms.

The written part of an audit report is generated by a large language model. We send it the measurements and page content gathered during the scan, and it produces the summary, the list of issues and the suggested priorities.

• The provider processes this on our instructions as our processor. Under our API terms the content is not used to train their models.
• Enquiry form submissions are never sent to an AI provider. Only audit scan data is.
• There is no automated decision-making producing legal or similarly significant effects about you, within the meaning of Article 22. A report is an opinion about a website. No person is scored, ranked, profiled or refused anything on the strength of it.

AI-written text can be wrong. Reports are offered as a starting point for a conversation, not as professional advice — see the audit tool terms.

We use a small number of established suppliers to run the site. They process data on our written instructions under Article 28 contracts, and none of them are permitted to use it for their own purposes.

• Vercel Inc. — hosting, content delivery, server logs and bot protection.
• Google LLC (Google Analytics) — page-view analytics, only if you accept analytics cookies. Google processes this data in the United States; the transfer is covered by the UK extension to the EU-US Data Privacy Framework. Google’s advertising features and Google signals are switched off.
• Convex, Inc. — the database that stores enquiry submissions and audit reports.
• Resend, Inc. — sends the confirmation email to you and the notification email to us when you submit the enquiry form.
• OpenAI — writes the analysis in an audit report from the scan data described above.
• Onkernel, Inc. (Kernel) — provides the managed browser that visits and reads the site being audited.
• Google LLC — the PageSpeed Insights API measures the loading performance of the site being audited.

Beyond that, we share personal data only with our professional advisers where they need it (accountants, insurers, lawyers), where the law requires us to, or if the business is sold — in which case the buyer would be bound by this policy until they gave you notice of their own.

We never sell personal data, and we do not share it for anyone else’s marketing.

We are based in the UK and prefer UK and EU processing regions where a supplier offers them. Some of the suppliers listed above are US companies, so some data is processed outside the UK.

Where that happens, the transfer is covered by one or more of the safeguards UK GDPR allows: the UK extension to the EU-US Data Privacy Framework where the supplier is certified, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment of the protections in place.

You can ask us for the specific mechanism relied on for any supplier by emailing privacy@zeropixel.io.

We do not keep things indefinitely by default.

• Enquiries that do not become work — up to 24 months from your last contact with us, then deleted. Projects have long lead times and people come back.
• Enquiries that become work — for the length of the engagement and then 6 years, which is the limitation period for contract claims in England and Wales and the retention HMRC expects for business records.
• Audit reports — up to 12 months. A report can be re-used to answer a repeat scan of the same site for 24 hours, so a fresh scan is not paid for twice.
• Audit abuse counters — the identifier and IP hash are held in a rolling 24-hour window and overwritten, not accumulated. There is no history of who scanned what.
• Email correspondence — up to 6 years, for the same reason as above.
• Analytics — Google Analytics deletes event data 14 months after it is collected. Its cookies expire after six months, or immediately if you switch analytics off.
• Server logs — short-term, per our hosting provider’s standard retention.

The site is served over HTTPS only. Secrets and API keys are held in the hosting platform’s encrypted environment, never in the codebase. Data is encrypted in transit and at rest by our suppliers. Access to the enquiry database is limited to the people who need it. The audit endpoint is rate-limited, capped and bot-protected.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to be a risk to your rights, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell you directly where the risk is high.

Under UK GDPR you can ask us to do any of the following. Email privacy@zeropixel.io — there is no form to fill in and no charge.

• See what we hold about you, and get a copy of it.
• Correct anything that is wrong or incomplete.
• Delete it. We will, unless we are required to keep a record — for example an invoice we must retain for tax.
• Restrict or object to our use of it, particularly where we rely on legitimate interests.
• Receive it in a portable format, where we hold it on the basis of your consent or a contract.
• Withdraw consent at any time, where we relied on it, without affecting anything done before you withdrew it.
• Switch analytics off with one click. You do not have to email us or give a reason — switching it off in the cookie preferences withdraws your consent completely and immediately.

We will respond within one month. We may ask you to confirm your identity first — only enough to be sure we are not handing your data to someone else.

This site sells business services and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, email privacy@zeropixel.io and we will delete it.

When this policy changes we update the date and version at the top of the page. If a change materially affects how we use data you have already given us, we will say so on the site rather than rely on you noticing a date. Previous versions are available on request.