What happens to what you type.

Who holds it

The controller for everything below is:

Questions about any of it go to hello@getmow.ai.

What we collect, and when

Nothing is stored before you press anything. Typing a website into the form and leaving the field starts no request and writes no row: until you press the button, what you have typed has not left your browser.

Your first name, your work email and the revenue band are stored when you press “Get my free report”. That press writes one row, and at that moment this is all of it: the domain, your first name, your work email, the revenue band you picked, whether your address is a work or a consumer one, a flag if the submission tripped the hidden field we use to catch bots, a salted hash of your IP address, and your browser’s user-agent string. A counter, keyed by a salted hash of your email, resets after a day so that one address cannot request a report over and over; the counter itself is deleted after seven, as the table below says.

We also keep a record of what happened to the emails that request sends, filed against the same request. For each one it holds two ids, the one our provider gives the message and the one it gives the notification it sends us about that message, what our provider last told us happened to it (accepted, sent on, delayed, delivered, bounced, marked as spam, refused, or blocked because the address is on our provider’s suppression list), when we learned that, and the provider’s own words for the reason when there is one. It is how we tell a report that reached you from one that did not, and it is deleted when the request is. We do not record whether you opened an email or clicked anything in it, and nothing we send carries a tracking pixel.

We do not buy, enrich or append anything to that row, and you are not added to a marketing list.

We read your website, and an AI reads it with us

We fetch the public homepage of the website you enter, the same page anyone can open, and send an extract of its text to our AI provider, Anthropic (United States), which returns a category, a sub-category, likely competitors and the buyer question we would run. Email addresses and phone numbers are stripped out of the extract before it leaves us.

Under our API agreement, Anthropic does not use that text to train models.

Why we are allowed to

Art. 6(1)(b) GDPR (steps taken at your request) covers your first name, work email and revenue band, the two emails we send you, and the record of what happened to them. You asked for a report; these are what it takes to write it, to deliver it, and to know whether it arrived.

Art. 6(1)(f) GDPR (legitimate interests) covers the domain, the IP hash and the user-agent. Our interest is keeping the form usable and not being flooded by a script. We weighed it against yours and wrote the balancing test down: the domain is a company identifier you typed yourself, the IP is never stored as an address, the user-agent is kept only alongside the request it belongs to, and none of it is used to profile you or to advertise to you. Ask and we will send you the assessment.

Your IP address

Your IP address is never written down. It is combined with a secret salt, hashed, and only the hash is kept, so that one machine cannot submit the form fifty times. We cannot turn the hash back into an address, but we could still match it to you if you gave us the address, so we treat it as your personal data and it is covered by the deletion route below.

It sits in two places, on two different clocks: the counters that cap how often the form and the lookup can be used, which go after seven days, and the request row itself, which goes after 24 months.

The classification is automated. It decides nothing about you

The category, the competitors and the buyer question are produced by a model rather than a person. That is a reading of your website, not a decision about you: it has no legal effect and nothing similarly significant follows from it, so Art. 22 GDPR does not apply. You can correct all three on the page you land on after submitting, and a person writes and signs off the report either way.

What your browser stores

Three values, all of them in your browser’s sessionStorage:

mow-starter-website

The website you typed into the field at the top of the home page, so the request form can fill it in for you rather than asking twice.

mow-ident

That you have already seen the opening animation this session, so it does not play at you again.

mow-report

Your request details (first name, email, domain and the reading of your site), so the booking page can prefill the calendar and show you what we read.

Why none of that asks your permission

None of those three ever leaves your browser, and all three are gone the moment you close the tab. Each one is strictly necessary to provide what you asked for under §25(2) Nr. 2 TDDDG, which is why there is no banner asking you about them.

We set no advertising cookies and no tracking cookies.

Analytics, and the answer you give it

This is the one thing on the site that asks you first. A bar sits at the bottom of the page with two buttons of the same size, one yes and one no. Neither is chosen for you, nothing is measured while it waits, and the site behaves the same whichever you press.

Press no and we load nothing. The analytics library is never fetched, so no script from PostHog runs on the page and no request goes to their servers. Press yes and we load PostHog and send one event for each page you open, to their European servers at eu.i.posthog.com. That event carries the address of the page, the page you came from, the browser and operating system your user-agent describes, your screen and window size, your language and your time zone, and a random id PostHog generates for your browser. Your IP address reaches their server the way it reaches any server whose page you open.

After a yes we also record what you do in the report flow. Each record is a fact about a step and never about you: whether the form was submitted or left, which of the four fields you got to, how many times the form refused an answer, whether the address you gave is a free mail address, whether we had a reading of your site, whether the calendar loaded, and whether you booked a call. Your name, your email address and your company website are in none of them. The code drops any value that is not a yes or no, a number, or one of a short fixed list of words, so it cannot send one by accident.

Two of those records are sent by our server rather than by your browser: one when you submit the form, one when you correct what we read. They are the same facts, they are sent only if you have already pressed yes, and your browser tells our server so with each request. They are filed under a scrambled form of your email address, made with a secret only we hold, which cannot be turned back into the address.

What it is not allowed to do is settled in our code, not in a setting on their side that someone could change later. It does not record your screen. It does not watch clicks, keystrokes or form submissions. It never reads a field in the report form, and it is never told who you are unless you have already told us through that form yourself. Session replay, surveys and heatmaps are switched off in the same place.

Three values carry all of it. The first two sit in your browser’s localStorage. The third is a cookie, and it exists only while we are testing two versions of the opening headline:

mow-analytics-consent

Your answer, stored as the word granted or denied and nothing else. Clearing this site’s data in your browser deletes it and the bar asks again, which is how you change your mind.

ph_[project]_posthog

PostHog’s own record, written only after a yes: the random id it gave your browser and the current session id. We configure PostHog to keep this out of cookies, so saying yes still sets none.

mow_bucket

A random number, with nothing in it worked out from you, so that the headline you saw last time is the headline you see this time. It is set only while such a test is running, it expires after 90 days, it travels to our own server with each request for the home page as cookies do, and it goes nowhere else. It is not an advertising cookie and it does not follow you to another site.

How long we keep it

These are our retention periods. A scheduled job on our database runs these deletions every day:

Our cached reading of a website

30 days

A completed report request, including the salted IP hash, the user-agent and what happened to its emails

24 months

Rate-limit counters (salted hashes of IP and email)

7 days

A report that was never published, with its scan data, and the raw engine responses behind any report

90 days

Who else touches it

Named, not described in categories. Each one processes on our instructions only:

Anthropic

Reads the website extract and returns the category; reads each engine answer and returns the company names in it; drafts the commentary an operator then edits

United States

DataForSEO

Puts the questions to ChatGPT, Perplexity and Google AI Mode on our behalf and returns the answers and the pages they cite

United States

Resend

Sends your confirmation and your report, and tells us what happened to each

United States

Supabase

The database holding the request

European Union, Frankfurt

Vercel

Hosts and serves this website

European Union, with a US parent company

PostHog

Product analytics, after you say yes

European Union, with a US parent company

Transfers to the United States run on the European Commission’s Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the provider is certified under it. Ask at hello@getmow.ai and we will send you a copy of the safeguards: the clauses themselves, or the provider’s certification. PostHog stores our analytics in the European Union and its parent company is American, so the same safeguards cover it.

Getting it deleted

Your request is filed under an internal id you never see, so we cannot find you from nothing. Email hello@getmow.ai with your domain and we will delete everything we hold against it within 30 days and write back to confirm.

The same address gets you a copy of your data, a correction, or an objection under Art. 21 GDPR to the processing we base on legitimate interests. You can also complain to the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

hello@getmow.ai