Privacy Policy

Effective date: October 8, 2026 · Last updated: October 8, 2026

This policy explains what iComponent Software Solutions Inc., a Massachusetts corporation (“iComponent”, “we”, “us”), collects when you use Nodworthy, why we collect it, who else sees it, and what you can ask us to do about it. It covers nodworthy.ai, the free scan, the paid audit, and the reports we deliver. It is part of our Terms of Use.

Nodworthy is a service for businesses, so most of what we hold is information about a business. Some of it — your name, your email address, your IP address — is about you personally, and that is what this policy is mainly about.

1. What you give us

When you ask for a free scan: your website, your name, and your email address. That is the whole of it.

When you confirm an audit: corrections to the business details we found — the business name, what you sell and the brands you carry, and the city and state you are in.

When you buy an audit: Stripe takes the payment. We never see or store your card details. What we keep is the amount, the currency, Stripe’s identifiers for the payment, and the email address on the payment — which may be a different person from the account holder, if somebody else paid.

When you write to us: your name, your email address, and the message you sent. The form invites a phone number if you would rather be called back, so your message may contain one. Nothing else on the site asks for a phone number, and we use it only to return your call.

2. What we collect automatically

Your IP address. The server logs below record it with every request. Beyond that, we use it for one thing: enforcing the daily limits that stop the free scan being abused, when you request a scan, sign in, or start a checkout. For that it is stored in a table that keys its counters on whichever of an IP address, an email address, or a website the limit applies to. A sweep runs every hour and deletes every row that is more than 26 hours old.

Server logs, which record the IP address, the page requested, the time, and the browser and device details your browser sends with each request, as ordinary server logs do. If a message you send us through the contact form cannot be delivered to us, your email address and message are written to our logs so that it is not lost. Other errors we record can also include the email address they concern. These logs rotate when they grow past a fixed size rather than after a fixed period.

We run no analytics, no advertising, and no tracking of any kind — there is no analytics package, no tag manager, and no advertising pixel anywhere on this site.

One thing does reach outside, and it is not tracking: our pages load their typefaces from Google Fonts, so Google sees the IP address and browser of anyone who opens a page here, including this one. We use it to load fonts and nothing else, and section 6 counts Google among the companies that see your information for that reason.

3. What we look up about your business

The service works by measuring how your business appears in public, so most of what we hold we looked up rather than asked you for.

• Your website. We read a handful of pages to work out what your business does and what services it offers.
• Your Google Business Profile, through a search-data provider. We record it as published: the name, the address, the phone number, the categories, the rating, and the review count.
• Search results and AI assistant answers for the questions we ask on your behalf, including the other businesses named instead of yours.

We keep all of this as the evidence behind your report. It is what lets us show you what an assistant actually said, rather than only our conclusion about it.

If your website carries information about other people — staff biographies, testimonials, a team page — that text is read along with the rest of the page, and is included in what we send for analysis under section 4.

4. The AI assistants, and what we send them

This is the part of the service most worth being precise about.

To measure your visibility we put questions to three AI assistants, on the free scan and the paid audit alike. ChatGPT and Claude we ask through their ordinary developer interfaces. Google AI — the AI-written answer Google Search gives — we read through DataForSEO, a data provider that runs the search on Google as though from your city and returns what Google showed.

What we send them is the question, and the city and state we are asking from. The questions are built from your business details, so a question can contain your business name and your location. We also send the text of your own website pages to Anthropic once, at the start, so we can work out what your business does and which questions are worth asking.

What we never send them from your account: the email address and name you gave us, and anything to do with your payment. None of that is part of any question we ask, and no assistant we measure receives it from us.

One caveat, because it concerns your own website: the pages we read under section 3 are sent as they are written. If your contact page prints your name and email address, that text goes along with the rest of the page — just as it would to anyone else who reads your site.

What each provider then does with a request is governed by that provider’s own terms, not ours. We do not control it, and their answers change without notice — which is why your report is a record of what we observed on a particular day.

5. Why we use it

To run your scan or audit and produce the report; to deliver it, to email you about it and to follow up on a full audit; to send re-check reminders and occasional Nodworthy updates, until you unsubscribe; to take payment and handle refunds; to answer you when you write to us; to keep the service secure and within its limits; and to improve how we measure, using results that have been aggregated and stripped of anything identifying.

We do not use your information to make automated decisions about you, and we do not profile you as an individual. The analysis is about a business’s visibility, not about a person.

6. Who else sees it

Our own team. A Nodworthy audit is checked and sent by a person, so our operators can see your account details, your business details, your audits, and your reports.

The companies that run parts of the service for us. Each receives only what its job needs:

• Anthropic and OpenAI — the questions we ask, and the location we ask from. Anthropic also receives your website’s page text, as section 4 describes.
• DataForSEO — your business name and location, to look up your Google Business Profile and search results; and the questions we put to Google AI, with the city we ask from. DataForSEO runs those as searches on Google, so Google receives them too.
• Brave Search — the searches we run, and the city and region they are run from.
• Stripe — your email address, to take payment. Stripe holds the card details; we do not.
• Resend — your email address and the content of the emails we send you.
• Atlassian — anything you send through our contact form, which becomes a support ticket.
• Google Fonts — the typefaces this site is set in. Your browser fetches them from Google on every page, so Google sees your IP address and which browser you are using. Nothing else about you is sent, and it happens whether or not you have an account with us.
• DigitalOcean — hosting. Everything above runs on servers they operate.
• Backblaze — copies of our nightly backups, which include the database and your audit files.

Nobody else, except in two situations: if we are required to disclose something by law or legal process, and if the business is sold or merged, in which case your information moves with it and this policy continues to apply until we tell you otherwise.

7. What we do not do

• We do not sell your personal information. We never have, and we have no plans to.
• We do not share it for advertising. There are no ad networks, no data brokers, and no audience-matching services involved in Nodworthy.
• We do not keep emailing you after you say stop. Most of what we send is about something you asked for or something you bought — your report, your order, your sign-in link. After a full audit we also send two short follow-ups about it: one asking how it went, and one asking which of the fixes you have made. They sell nothing. We also email you when it is time to re-check your results, plus the occasional Nodworthy update; those are advertising, and each one says so. Every marketing email can be unsubscribed from: the unsubscribe link in them stops them, and you can turn them off, or back on, at any time on your account page.
• We do not track you across other websites.

8. Cookies and browser storage

We set three cookies and all three are strictly functional. There is no cookie banner because there is nothing here to consent to.

• A session cookie — keeps you signed in to your account for 30 days. No script can read it, and it travels only over an encrypted connection.
• A staff session cookie — the same, for our own operators.
• A test-site cookie — the password cookie for our internal test site. You will only have it if we gave you that password.

Your browser also stores two things locally, which never reach us:

• the scan form’s draft, so what you typed survives a reload. It stays for the rest of the browser tab — the page after you submit uses it to show which address we wrote to — and it goes when you choose “start again” there, or when you close the tab;
• your light-or-dark theme preference.

9. How long we keep it

• Rate-limit counters, including the IP addresses in them — deleted once more than 26 hours old, by a sweep that runs every hour.
• Unclicked scan confirmations — 7 days.
• Sign-in links and expired sessions — 7 days.
• Your account, your orders, your audits, and the evidence behind them — kept until you ask us to delete them. See section 11.
• Backups — nightly copies of the database and the audit files are kept off-site. Each copy is locked against deletion for one year; database copies are then removed automatically, and audit-file copies are not currently removed.
• Server logs — kept on our server, not in the backups, and rotated by size rather than on a schedule: the oldest lines are removed as new ones arrive, so how long a line lasts depends on how busy the site is.

We are being plain rather than reassuring about the fourth item: today we do not delete audits or accounts on a schedule. Your report link has to keep working for its 90 days, and the record of what you ordered and what we delivered is what we would produce if a payment of yours were ever disputed. Beyond that, keeping it is a default rather than a decision, and we would rather say so than imply a retention period we do not enforce.

10. Your report link

Paid reports are delivered as a private link that works for 90 days. Anyone who has that link can open the report — there is no second sign-in — so treat it as confidential, and think before forwarding it.

Short of refunding your purchase — which ends your license to the report and stops its links — we cannot withdraw a single link once it has been sent. If you believe a link has gone somewhere it should not, write to us: what we can do is talk you through the options, which may include re-issuing your report.

11. Asking us what we hold, correcting it, or deleting it

Send us a message and a person will answer. You can ask us to tell you what we hold about you, to correct it, or to delete it. We do not charge for any of this, and you do not need to give a reason.

You can change the name on your account yourself, from your dashboard. Changing the email address on an account is something we do for you, so that the change can be checked.

What deleting gets you: we remove your account, your audits, and the evidence files behind them. Your report links stop working, because the reports are gone.

What it cannot reach, and we would rather you knew before you asked:

• Backups. A deletion removes your information from the live service immediately. It does not reach our nightly off-site backups. To protect them against ransomware, each backup copy is locked when it is made and cannot be deleted by anyone, including us, for one year. After that, the copies of our database are removed automatically; the copies of audit files are not currently removed. Ask us and we will tell you what is still held.
• The payment record. We keep the record of what you bought, when, and what we delivered — the minimum needed for tax and accounting, and the evidence we would need if a payment were disputed. Section 7 of our Terms of Use describes it.
• A copy somebody already saved. Deleting your data does stop your report links working — there is nothing left to serve. What we cannot reach is a file or a printout somebody made while the link was live. And if you want a link stopped without deleting your data, that is the one thing we cannot do: section 10 explains why.
• Logs. A deletion does not reach our server logs. Anything about you in them is removed as the logs rotate, as section 2 describes, rather than on request.

12. Security

Accounts have no passwords: you sign in with a single-use link that expires quickly. Sign-in tokens and session tokens are stored hashed, never in the clear — so what we hold is not something anybody could sign in with. Session cookies cannot be read by scripts. Everything is served over an encrypted connection. Access to our admin tools is limited to a named list of our own staff, each signing in the same way.

No service can promise perfect security, and we will not. What we can tell you is what an attacker would find: no card numbers, no passwords, and no more personal information than sections 1 and 2 describe.

13. Children

Nodworthy is a service for businesses and is not directed at children. You must be at least 18 to use it. We do not knowingly collect information from anyone under 18, and if we learn that we have, we will delete it.

14. Changes, and how to reach us

We may update this policy. When we do, we will change the “Last updated” date above, and for changes that materially affect what we do with your information we will email account holders. We keep a dated record of every published version, and will give you an earlier one on request.

Questions, requests, or anything else about this policy: