balevine

Free audit privacy

This page covers the free Support tools audit. It’s the only part of this site that collects personal data.

Last updated 28 October 2026.

Who I am

I’m Brian Levine, and I’m responsible for the data described here (the “controller”, in GDPR terms). Email me at brian@balevine.com about anything on this page.

What I collect

From everyone who asks for access: your email address. I use it to send you the access link and in a short alert to me that someone signed up. The form tells you that I may also email you myself about the audit, and that you can ask me to stop. The alert is my record of that notice. It has your address, the time you confirmed your email, and which version of the notice you saw. I don’t share your address with anyone else.

Never: the audit data you enter in the tool. Your ticket categories, tools, counts, and report stay in your browser. They’re saved on your device and they’re never sent to me or anyone else.

  • Sending the link and giving you access, to provide the tool you asked for (GDPR Art. 6(1)(b)).
  • The signup alert to me, for my legitimate interest in knowing who uses the tool (Art. 6(1)(f)).
  • Follow-up email about the audit you asked for, for my legitimate interest in hearing how the audit went and whether I can help (Art. 6(1)(f)). You can object at any time, and objecting doesn’t affect your access to the audit.

Who processes it

  • Resend sends the access link and the signup alert.
  • Cloudflare hosts this site and runs Turnstile, the check that you’re a person and not a bot. It also stores rate-limit counters that stop the form being used to flood someone’s inbox. The counters are keyed by a hash of your email address and by your IP address, and they expire after an hour.

Transfers outside the EU

Resend and Cloudflare are US companies, and Resend stores its data in the United States. Both have certified under the EU-U.S. Data Privacy Framework, including its UK Extension. Both of their data processing agreements also include the EU Standard Contractual Clauses (and the UK addendum), which apply regardless of that certification.

You can read their terms here: Resend’s DPA, Resend’s GDPR page, Cloudflare’s DPA and Cloudflare’s privacy policy.

How long it’s kept

  • Your email address: nothing is kept on the site’s side. Your address stays in the signup alert in my inbox until you ask me to stop contacting you or to delete it. It also stays in Resend’s sending logs for their log retention period (30 days on their standard plans when I wrote this).
  • Rate-limit counters: up to an hour.

Cookies

The audit sets one cookie, fa_access, when you confirm your email. It lasts 30 days and lets you back into the tool without a new link. It holds a hash of your email address and an expiry date, signed so it can’t be forged. It doesn’t hold your email address. It’s strictly necessary for the gate to work, so there’s no cookie banner.

The tool saves your audit data in your browser’s local storage, on your device. That never leaves your browser either.

Turnstile collects signals such as your IP address and browser details to tell people from bots. Cloudflare covers how it handles them in its Turnstile Privacy Addendum and privacy policy.

Your rights

You can ask me to:

  • show you the data I hold about you;
  • correct it;
  • delete it;
  • stop using it for the signup alert (objection);
  • stop sending follow-up email (objection).

You can also complain to a data protection authority, such as the one in the EU country where you live or the ICO in the UK.

Stopping follow-up and other requests

Follow-up emails come from me personally, not from a mailing list, so they don’t have an unsubscribe link. To stop them, reply to any of them or email brian@balevine.com and I won’t contact you again. Email the same address for anything else. I’ll answer within a week.