3.1 Website enquiries (contact form)
We collect your name, email, and message, and optionally your phone number and company, to respond to your enquiry and follow up about it. Lawful basis: legitimate interest in responding to business enquiries (Art. 6(1)(f)). If you tick the optional box to receive occasional updates, we rely on your consent (Art. 6(1)(a)) and you can withdraw it any time.
3.2 Booking a demo (GoHighLevel calendar)
Our booking calendar is provided by GoHighLevel (LeadConnector). It loads only when you choose to open it. If you book, GoHighLevel processes your name, email, and scheduling details on our behalf. Lawful basis: legitimate interest / consent when you choose to load and use it.
3.3 Analytics
Simple Analytics loads on every page. It is cookieless, sets no cookies, is hosted in the EU (Netherlands), and produces aggregate statistics that do not identify a visitor. Lawful basis: legitimate interests (Art. 6(1)(f)). You can opt out of Simple Analytics. We also honour Do Not Track when your browser sends it.
3.4 Marketing attribution
When you arrive from an advertisement, we store campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term, and the Google click identifier gclid) in your browser's sessionStorage so we can measure which campaigns lead to interest. This is cleared when you close the tab and is not used to track you across other websites. Lawful basis: legitimate interest in measuring our own marketing (Art. 6(1)(f)).
3.5 Instant Check (no account)
When you use the Instant Check without an account:
- We receive the manufacturer part number (MPN) you submit, and a one-way hash of your IP address used only for rate limiting.
- We do not store your IP address. The hash is retained for 7 days, then deleted.
- We look up the MPN via Octopart, server-side. The request contains the part number (and optional manufacturer name), not your IP, email, or account. We may cache the result against that MPN for 7 days. The cache is not linked to you or your IP hash. Octopart and DigiKey are component data sources, not sub-processors — see section 5.
- We keep daily aggregate counts of Instant Check usage (no IP, no MPN).
- We use Cloudflare Turnstile to distinguish humans from bots.
- Lawful basis: legitimate interests (Art. 6(1)(f) GDPR) — operating and protecting a free public tool. We do not profile you or use Instant Check data for marketing.
- If you later create an account, the name and email you provide are processed under 3.7 FairSpec app (account holders).
If you ask us to email the result, we use your email to deliver that requested result (and related transactional follow-up about it). Lawful basis: legitimate interest in fulfilling your request (Art. 6(1)(f)). If you separately tick the optional box for occasional FairSpec updates, we rely on your consent (Art. 6(1)(a)) for that marketing only; you can withdraw it any time. Delivery of the result is not conditioned on marketing consent. Processors for CRM and email delivery are listed in section 5 (GoHighLevel and, where used, Resend). Retention and rights are in sections 7 and 8.
3.6 Server logs
Our hosting and API functions record technical logs including IP addresses for security and operation. Lawful basis: legitimate interest (Art. 6(1)(f)). Retention in section 7.
3.7 FairSpec app (account holders)
For the Service we process:
- Account details (name, email, organisation) for sign-in via Google OAuth or email
- Bills of materials and analysis results you upload or generate
- Usage records, feature interactions, and API request logs (for enterprise users)
- Payment-related identifiers via Stripe (we do not store full card numbers)
- Session and authentication tokens in HTTP-only cookies
Lawful basis: performance of contract (Art. 6(1)(b)) to deliver the Service, and legitimate interest in securing and improving it (Art. 6(1)(f)).
