# Privacy notice How personal information is used when you contact Tityra or request an MX Audit. ## Who operates Tityra This website is operated by Digital Domain Technologies Ltd, trading as CogNovaMX, company number 03651124. 33 Merchant Way, York, United Kingdom, YO23 3TS For privacy enquiries, contact [info@tityra.com](mailto:info@tityra.com). ## Information collected ### Audit requests Audit requests ask for your name, work email, company, website URL, audit package and scope / type, your relationship to the website and your authorisation declaration. Organisation type and notes are optional. The request record includes a request identifier, the time of the declaration and the notice version. ### General enquiries General enquiries collect your name, email and enquiry details, plus a phone number if you choose to provide one. Please do not send passwords or sensitive personal information. ### Audit content An audit collects content from the agreed websites, including text, HTML, links, metadata, rendered content and scan findings. This content may contain personal information such as authors' names. Audit request details, contact information and request progress are stored in our private CRM using MongoDB Atlas. Collected website content, scan data and reports are stored in our Microsoft 365 enquiry mailbox. Access is restricted to our team. We do not send audit content to any external AI or analysis service. ### Form verification The website uses an IP address temporarily to limit abusive form submissions. Cloudflare Turnstile may process technical browser and network information for verification. ## How we use audit information We use audit requests to respond to you, check the scope and your authority, and carry out the audit. A request does not start an automatic scan. Each report is reviewed by a member of our team before delivery. An authorisation declaration does not itself prove authority; domain-mismatched and other suspicious requests require manual checks before a report is disclosed. We also use findings from audits to produce aggregated analysis and research about how automated systems access and interpret websites. We publish or share that analysis only in a form that does not identify you, your organisation or your website, and it does not include your contact details. You can object to this use by contacting [info@tityra.com](mailto:info@tityra.com). We use general enquiry information to respond to your message and communicate with you. ## Who receives your information We do not sell personal information. We use the following service providers to run this website and receive requests. We provide request and audit information to service providers for these services, rather than for their own marketing purposes. - **Microsoft (Microsoft 365)**: Hosts our enquiry mailbox. - **Google (Google Cloud Run)**: Hosts this website, the audit request form and our private CRM. - **MongoDB Atlas**: Stores audit request details, contact information and request progress in our private CRM. - **Resend**: Delivers audit requests and general enquiries to our enquiry mailbox. - **Cloudflare Turnstile**: Helps prevent abusive form submissions. - **Google Analytics**: Delivered through Google Tag Manager, measures page and section visits, audit package interest, sample report download clicks, form progress and successful requests only if you accept analytics cookies. Contact details, company names, messages and URLs entered into our forms are not included in analytics. See our [cookie information](/cookies). Cloudflare also uses Turnstile's technical verification signals to improve its bot detection, acting as a controller for that purpose. Its [Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/) explains this processing. ## How long we keep information We delete audit requests, collected website content, raw scan data and reports within 90 days of report delivery. If a request ends without a report (for example, it is declined, withdrawn or not completed), we delete it within 90 days of that outcome. If you buy a paid audit or Expert Review, we keep contracts, invoices and payment records for six years from the end of the last company financial year they relate to, or longer where [UK accounting and tax rules](https://www.gov.uk/running-a-limited-company/company-and-accounting-records) require it. Reports and audit data are still deleted within 90 days of delivery unless we agree a longer period with you in writing, for example for repeat audits. Aggregated analysis that does not identify you or your website is not subject to this deletion period. Our hosting provider's server logs, which may include IP addresses and technical request details, are kept for up to 30 days. We delete general enquiry messages and contact details within 12 months of the enquiry being closed. This lets us respond to follow-up questions and keep a record of our response. If an enquiry leads to an audit or a paid service, the relevant audit or accounting retention period above applies to those records. ## International transfers Some of our service providers may process information outside the UK. Where information is processed outside the UK, we rely on the applicable transfer protections in our providers' data processing terms. These include UK adequacy regulations (including the UK Extension to the EU-U.S. Data Privacy Framework for covered transfers) and standard contractual clauses with the UK International Data Transfer Addendum for other restricted transfers. - **MongoDB Atlas**: Standard contractual clauses and the UK International Data Transfer Addendum for applicable restricted transfers under its [Data Processing Agreement](https://www.mongodb.com/legal/data-processing-agreement). - **Microsoft 365**: Standard contractual clauses with the UK International Data Transfer Addendum. Microsoft also certifies to the UK Extension to the EU-U.S. Data Privacy Framework. [Data processing terms](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA). - **Google Cloud Run**: The UK Extension to the EU-U.S. Data Privacy Framework for covered U.S. transfers; standard contractual clauses with the UK Addendum for other restricted transfers under the Cloud Data Processing Addendum. [Data processing terms](https://cloud.google.com/terms/data-processing-addendum). - **Resend**: Standard contractual clauses with the UK Addendum, incorporated in its Data Processing Addendum. [Data processing terms](https://resend.com/legal/dpa). - **Cloudflare Turnstile**: The UK Extension to the EU-U.S. Data Privacy Framework for covered transfers; standard contractual clauses with the UK Addendum for restricted transfers under its Data Processing Addendum. [Data processing terms](https://www.cloudflare.com/cloudflare-customer-dpa/). - **Google Analytics**: The UK Extension to the EU-U.S. Data Privacy Framework for covered U.S. transfers; standard contractual clauses with the UK Addendum where the Google Ads Data Processing Terms require them. [Data processing terms](https://business.safety.google/adsprocessorterms/). Contact [info@tityra.com](mailto:info@tityra.com) for information about the safeguards or a copy of the relevant terms. ## Lawful basis We rely on the following lawful bases under the UK GDPR, depending on why we use your personal information. - **Legitimate interests**: To respond to general enquiries and business contacts, check audit scope and authority, carry out requested audits, protect our website and forms from abuse, and prepare aggregated analysis that does not identify you, your organisation or your website. Our interests are providing and improving our audit service, maintaining relevant business communications and keeping the service secure. We limit the personal information we use to what is needed for these purposes and balance our interests against your rights and reasonable expectations. You can object at any time (see Your rights and choices). - **Contract**: Where processing is necessary to provide a service under a contract with you as an individual, or to take steps you ask us to take before entering that contract, such as preparing a quote. Where a contract is with your organisation, we rely on legitimate interests for its representatives' contact details. - **Legal obligation**: To keep accounting and tax records required by law. - **Consent**: For optional analytics cookies. You can withdraw your consent at any time through our cookie information page. [Cookie information](/cookies). ## Your rights and choices Depending on the applicable law and lawful basis, you may have rights to access, correct or erase personal information, restrict processing, object to processing or receive a portable copy. Contact [info@tityra.com](mailto:info@tityra.com) to make a request. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent. Optional analytics preferences can be changed through the [cookie information page](/cookies). You can also raise a concern with the UK [Information Commissioner's Office](https://ico.org.uk/make-a-complaint/).