Privacy Notice
1. Who we are
AuditCrow is operated by 4D Services Limited, a company registered in the United Kingdom (4dservices.co.uk). Depending on how you use the service, 4D Services acts either as a data controller (for your own account with us, and for our own platform operations) or as a data processor (for client data you or your agency submit for audit, on your instructions). See §2 below for which applies to you.
2. Controller or processor — which applies to you
| Data | Who controls it | 4D Services' role |
|---|---|---|
| Your account, billing and support interactions with us | You / your agency | Controller |
| Audit data for sites you audit directly as a customer | You | Processor |
| Audit data an agency submits about its own client | The agency | Processor |
| Connected Google/Microsoft Clarity data (Search Console, Analytics, Business Profile) | You / your agency | Processor |
| Anonymised, cross-client visibility insights (where you have opted in) | 4D Services | Controller |
3. What we collect and why
- Account data — name, email, authentication details (via Clerk) — to provide and secure your account.
- Site & audit data — URLs, crawled page content, technical signals, and connected analytics (Google Search Console, Google Analytics, Google Business Profile, Microsoft Clarity) — to generate your visibility audit and recommendations.
- AI-generated content — audit summaries, persona insights and draft recommendations, produced using AI models (see §6) — always labelled as AI-drafted for your review.
- Usage & support data — to operate, secure and improve the service, and to respond to support requests.
4. Lawful basis
We process account and billing data under contract (Art. 6(1)(b)). Audit and connected-account data is processed on your instructions as processor, under the contract between you and us. Where we process third-party data found during an audit (e.g. names in crawled pages or Google Business Profile reviews), our lawful basis is legitimate interests (Art. 6(1)(f)) — enabling the audit you requested — balanced against that person's rights.
5. Third-party data found during an audit
An audit can incidentally capture personal data about people who have no direct relationship with us or with you — for example names in crawled testimonials or team pages, reviewer names on a connected Google Business Profile, or search-intent captured in Search Console query data. We rely on legitimate interests (Art. 6(1)(f)) as our lawful basis for this: enabling the audit you or your agency requested, balanced against that person's rights. Direct notice to each such individual is frequently disproportionate to the purpose (Art. 14(5)(b)) given the scale and public nature of the source. Anyone who believes their data has been processed this way and wishes to object can contact privacy@4dservices.co.uk.
6. Sub-processors and international transfers
We use a defined set of sub-processors to deliver the service — see the full, current sub-processor list. Our primary data store is in the UK; several sub-processors are US-based, and transfers to them rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or an International Data Transfer Agreement (IDTA) otherwise.
7. AI & automated processing
AuditCrow uses AI models (including Anthropic and, optionally, OpenAI models) to draft audit summaries, persona insights and recommendations from your site and connected-account data. AI-drafted content is always clearly labelled in the product and is intended for your review — no decision producing a legal or similarly significant effect on you is made solely by AI.
8. Retention
We retain audit results for as long as your account is active, and for a limited period after closure to support re-onboarding and legal/accounting requirements. Immutable operational logs (cost, security and impersonation logs) are retained separately for security and audit purposes. We are implementing automated deletion in line with our published retention schedule.
9. Your rights
Subject to UK GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Request erasure of your data (already automated for account deletion)
- Request a portable export of your data
- Object to or restrict certain processing
- Withdraw consent where processing relies on it (e.g. the cross-client insight layer)
To exercise any of these rights, email privacy@4dservices.co.uk. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO).
10. Cookies
See our separate Cookie Policy for details of the cookies we use and how to control them.
11. Contact
4D Services Limited · Data Protection Officer: Ben Foord · privacy@4dservices.co.uk