Privacy Policy

This notice covers weareoriginate.com and the account area at account.weareoriginate.com. Last updated 28 October 2026.

The controller is Originate Group Ltd, company number 17134310, Unit 24-25, Sovereign, Weston-super-Mare. Questions and requests go to hello@weareoriginate.com.

What we collect and why

Each thing the site does, the data it needs, and the lawful basis we rely on.

• Diagnostic requests. The website address and email you enter. We use them to score the site and send the report. Basis: steps you ask us to take before any contract (UK GDPR Article 6(1)(b)). The form carries a Cloudflare Turnstile check so the queue is not filled by bots; see Cookies below.
• Website security scans. Your name, the website address and the email you enter on the scan page. We use them to scan the website, keep your report at a private link that search engines are told not to index, and email you that link. Basis: steps you ask us to take (UK GDPR Article 6(1)(b)). We also keep the wording of the boxes you ticked and your IP address, as a record of your request. The form carries a Cloudflare Turnstile check.
• Marketing emails. Only if you tick the box on the scan page: the occasional email with ideas for your website. Basis: your consent (UK GDPR Article 6(1)(a) and the Privacy and Electronic Communications Regulations). You can withdraw it at any time by replying to any of our emails or writing to hello@weareoriginate.com.
• Messages to us. Whatever you send by email, WhatsApp or phone, and our reply. Basis: our legitimate interest in answering you, or the contract once you are a client.
• Foundations checkout. Payment details go straight to Stripe inside the checkout; we never see your card number. We receive your email, the plan, the subscription status and Stripe's reference. Basis: performing the contract. Billing records are kept for six years after the subscription ends because tax law requires it.
• Your account. Signing in sends a one-time link to your email and sets a session cookie on account.weareoriginate.com. Your site conversation, change requests and reports live there. Basis: performing the contract.
• Site measurement. Which pages are viewed and which actions are taken, through Google Analytics. Basis: described in the next section, because it depends on your cookie choice.
• Hosting and security. Cloudflare serves the site and keeps standard request logs (IP address, user agent, URL) for a short period to keep it running and defend it. Basis: our legitimate interest in a working, secure site.

Analytics and your cookie choice

Before you choose, and if you decline, Google Analytics receives cookie-free measurements: which pages are viewed and actions such as sending a form or tapping a phone number, each tagged with a random number that is not stored, so visits cannot be linked together. Google uses the IP address to work out a rough location and then discards it. We rely on our legitimate interest in knowing how the site is used. If you accept analytics cookies, a cookie is set so repeat visits are recognised, and that rests on your consent. Your choice is kept in your browser for 180 days. You can change it at any time from Cookie settings in the footer. Data is processed by Google in the EU and the United States under the UK International Data Transfer Addendum.

• We run no advertising cookies and no advertising platform receives anything from this site.
• Google Signals is switched off for our property, so Google does not join your visits to a signed-in Google account for us.
• Measurement runs only on weareoriginate.com. Page addresses are sent without query strings, and event details never carry your email, a URL or free text.
• Google Analytics retention, as set on our property: event-level data two months, user-level data fourteen months, reset on new activity.

Who processes data for us

Four providers, each under a contract that limits what they may do with it.

• Google (Google Analytics): site measurement, as above.
• Stripe: payments, subscriptions and fraud prevention at checkout.
• Resend: delivers our email, including diagnostic and scan reports, sign-in links and welcome emails.
• Cloudflare: hosting, the Turnstile check on the diagnostic and scan forms, the storage behind scan reports, and the servers behind the account area.

Each of them processes some data in the United States. Transfers out of the UK rest on the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. We do not sell personal data and we do not share it with anyone else, unless the law requires it.

How long we keep it

• Website security scans and your report: up to two years, so we can pick the conversation back up. Ask and we delete them sooner.
• Marketing consent: until you withdraw it, then we keep a note that you opted out so we don't email you again.
• Diagnostic requests and messages: while we run the report or deal with your enquiry, and for up to two years afterwards so we can pick the conversation back up. Ask and we delete them sooner.
• Account and subscription records: for the life of the subscription, then billing records for six years as tax law requires.
• Google Analytics: the retention periods set out above.
• Your cookie choice: 180 days in your browser, then we ask again.

Your rights

Under UK GDPR you can ask us for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interests you can object. Email hello@weareoriginate.com and we reply within a month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

When this notice changes in a way that affects what your cookie choice means, the site asks you to choose again. Smaller changes are shown by the date at the top.