Your page is snooping more than you think
Your website may collect and share more personal data than you realize. Our Privacy Audit examines cookies, trackers, forms, third-party services, consent, and privacy practices to uncover potential risks. Get a clear picture of how your website handles personal data, where gaps exist, and what needs attention.
Decorative targeting display: concentric rings and arc segments settle into place, then a scan sweep circles twice around the audit name at the centre.
Silent Tracking
Your page shares much more than visitors realize.
A real browser visit sees what your privacy policy doesn't always say out loud. These are the three places that talk the most.
Cookies & trackers
What loads without asking
Third-party scripts and tracking pixels can fire before a visitor ever sees a consent banner.
Third-party sharing
Where data actually goes
Every external domain contacted is a party your visitors didn't know they were sharing data with.
Consent & policy
The paper trail
No privacy policy link or consent banner isn't just a UX gap. It's the first thing a regulator checks.
Industry Quote
Privacy audits help organizations identify, assess, prioritize, and respond to risks arising from the way personal data is collected and used
What the scan covers
- Identifies personal data collected through forms, cookies, analytics, trackers, and third-party scripts.
- Checks third-party services, tracking tools, and where data is shared, including transfers outside the EEA.
- Reviews privacy notices, cookie consent, data rights, retention, and whether privacy controls actually work as promised.
Five things your privacy policy won't tell you.
How the privacy audit works
A headless Chromium browser visits your page and records what happens: every outbound request, every cookie that ends up stored, the form fields collected and the third-party domains contacted. We match those domains against a list of known trackers, and we check for HTTPS, a privacy policy link and a consent banner. Requests to internal network addresses are blocked during the visit.
Those recorded facts, and nothing else, go to an AI model that writes the plain-English summary and flags when the pattern usually calls for a formal data protection impact assessment. The model never supplies cookie names or domains itself. The score comes from the signals we collected, not from the model's opinion.
- Observed, not guessed
Every cookie the domain was caught firing
A headless browser loads the page and records every outbound request and every cookie the page ends up storing: first-party and third-party, session and persistent.
- Named third party
Which third-party domains got the data
Each finding names the exact host contacted (doubleclick.net, hotjar.com) and what on the page triggered the call.
- Fixed weight
Ranked by exposure
Personal data, third-party sharing, and trackers that fire before consent each carry a fixed weight in the score. The biggest exposure sits on top.
- Plain-English cost
Why a regulator would care, in plain terms
Each signal is tied to the GDPR expectation it touches (lawful basis, consent, transparency) without the case-law detour.
- Shareable link
A link you can send to anyone
The report gets its own URL the moment it finishes, and stays live 30 days without an account. Claim it and it stays for good.
- Limited Seats
₹999/mo
Pro Subscription
Solo developers & personal sites
100 credits/month
- 1 domain
- Shareable report links
- PDF export for accessibility reports
- WCAG 2.2 AA Compliance Support
What the report cannot show
The first pass never clicks accept, so what loads is what loads before consent. A single visit can't see cookies set on other pages, after login or in response to different consent choices. The report is guidance, not legal advice, and it does not certify GDPR compliance.
Frequently asked questions
Everything you need to know about how the Privacy Audit works.
When you run one, it loads your page in a real browser and records what it actually does: outbound requests and their initiators, cookies (with their flags and likely owner), client-side storage and fingerprinting signals, third-party domains and known trackers, whether data is sent outside the EEA, HTTPS status, and the GPC/Do-Not-Track signal it sent. When a consent banner is present it scans a second time after accepting it, to see what consent actually gates. It then fetches your linked privacy policy and cross-references it against the third parties it saw. Claude turns those facts into a narrative, and it originates none of them.
No, every cookie name, domain, and tracker match comes from the browser capture, not from the model. Claude only writes the narrative and recommendations on top of facts we already collected.
Deterministically, from what was observed. Penalties subtracted from 100: personal-data form fields (20), any third-party requests (20), trackers that fired before consent (15), known trackers at all (10), fingerprinting signals (10), third parties your policy never names (10), data leaving the EEA (10), no privacy-policy link (10), a personal-data form posting to another domain (10), cookies set without the Secure flag (5), no consent banner (5), trackers that ignored the GPC signal (5), no HTTPS (10). The report shows the exact waterfall.
On the first pass, no. It never clicks 'accept', so anything that loads is by definition pre-consent. If a banner is detected it then runs a second pass that does accept, and the report diffs the two so you can see what consent actually changed.
A Data Protection Impact Assessment flag is raised when the scan detects patterns (e.g. sensitive data collection plus third-party sharing) that typically warrant a formal DPIA under GDPR. It's a signal to investigate further, not a legal determination.
No, it checks what loads during an automated single-page visit. Trackers behind consent gating, server-side tracking, or multi-step flows may not appear. Use this as a first-pass signal alongside a full privacy/legal review.
Typically 30-60 seconds: a headless browser visit (twice, if a consent banner is found), a privacy-policy fetch, then a short AI analysis step.
