Privacy Policy

Last updated: 11 September 2026. This replaces the version of 27 November 2020.

In short

Crescat Digital Ltd is the data controller. Our Data Protection Officer is Lee Thomas, lee@crescatdigital.com.
We collect the details you give us when you enquire, become a client, sign up for our content, or use our free Client Acquisition Map tool at tools.crescatdigital.com.
The Client Acquisition Map reads your Google Search Console, Google Ads and Google Analytics data only when you connect them, only to build your own report, and only in read-only mode. We revoke our access to your Google account as soon as your report is built.
We never sell your data, never use it for advertising, and never use it to train AI models.
Report data is deleted 90 days after your report is delivered, or 90 days after your last activity if you did not finish. Client data is kept while you are a client. Purchase records are kept for six years for tax.
You can ask us to delete your data at any time, and you can complain to the ICO.

Contents: 1. Who we are · 2. What this notice covers · 3. The Client Acquisition Map and your Google data · 4. The data we collect · 5. How we collect it · 6. How we use it · 7. Marketing · 8. Cookies · 9. Who we share it with · 10. International transfers · 11. Security · 12. How long we keep it · 13. Your rights · 14. Glossary

1. Who we are and how to contact us

Crescat Digital Ltd ("Crescat Digital", "we", "us") is the controller of your personal data. Company number [company number]. ICO registration number [ICO registration number].

Our Data Protection Officer is Lee Thomas. Contact him with any question about this notice or to exercise your rights:

Email: lee@crescatdigital.com (or hello@crescatdigital.com)
Post: Ravendene House, Brighton Road, Crawley, West Sussex, RH10 6AE

You have the right to complain at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection: www.ico.org.uk. We would like the chance to resolve your concern first, so please contact us before you approach the ICO.

2. What this notice covers

This notice explains how we collect and use personal data when you:

ask us for a quote or proposal, or become a client;
use this website, sign up to our newsletter, download a guide or take part in a promotion;
use the Client Acquisition Map at tools.crescatdigital.com, including buying the 90-day plan.

Our website and tools are for businesses. They are not intended for children and we do not knowingly collect data about children.

We may give you a separate notice when we collect data for a specific purpose. That notice adds to this one; it does not replace it.

Our site links to other websites and services. We do not control them and are not responsible for their privacy practices. Read their notices before you share data with them.

3. The Client Acquisition Map and your Google data

The Client Acquisition Map is a free report on how your law firm's website wins clients from Google. To build it, we ask for read-only access to Google services you already use. This section explains exactly what we access, why, who sees it, how we protect it and when we delete it.

3.1 What we ask Google for, and when

We only ask for access when you click a connect button, and Google shows you a consent screen each time. You choose which property or account we may read. Two of the three connections are optional, and your report is built either way.

Connection	Google permission (scope)	What it lets us do
Google Search Console (required for the report)	`https://www.googleapis.com/auth/webmasters.readonly`	Read the search performance of the website you choose. Read-only.
Google Ads (optional)	`https://www.googleapis.com/auth/adwords`	Read the Google Ads account you choose. Google offers one scope for Ads that technically allows changes. We only read. We never change anything in your account unless you are a client and have instructed us in writing.
Google Analytics (optional)	`https://www.googleapis.com/auth/analytics.readonly`	Read reporting data from the Google Analytics 4 property you choose. Read-only.

3.2 What data we read

Search Console: the last 90 days of search queries, page addresses, clicks, impressions and average positions for your site.
Google Ads: the last 90 days of search terms, costs, clicks and conversions, plus the account's structure: campaigns, ad groups, keywords, negative keywords, conversion tracking settings, landing pages and change history.
Google Analytics: the last 90 days of sessions, engaged sessions, key events and users, grouped by landing page and by traffic channel. These are totals. We do not read data about individual visitors to your site.
Your website: we also crawl the public pages of your site, as a search engine would, to read titles, headings, links, forms and contact details.

3.3 What we do with it

We use this data for one purpose: to build your report and, if you buy it, your 90-day plan. That means:

mapping the searches your site can win to the pages that should own them;
showing which pages win visits but record no enquiry, and which paid search spend overlaps with your organic rankings;
scoring your site and comparing it with anonymous averages from other reports;
writing the plain-English summary and the metadata rewrites in your plan.

We keep anonymous aggregate statistics from all reports, such as the range of scores, so we can show you how your site compares. These statistics cannot identify you or your firm.

By requesting a report you agree that a member of our team may look at your report before it is sent, to check it is correct, and may discuss it with you if you book a call. Our team does not browse your Google accounts.

Our use of Google data follows Google's rules. The Client Acquisition Map's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use your Google data only to provide the report and plan you asked for. We do not sell it, do not use it for advertising, do not use it to decide creditworthiness, and do not use it to train AI or machine-learning models.

3.4 Who else processes it

These providers process data on our behalf, under contracts that stop them using it for their own purposes:

Google (Search Console, Google Ads and Google Analytics APIs; PageSpeed Insights receives the addresses of a few of your pages to measure speed).
OpenAI writes the summary sentences in your report and the metadata rewrites in the 90-day plan. It receives search phrases, page addresses, page titles and aggregate counts from your report. It does not receive your name, email or Google account details.
OpenAI, Google Gemini, Perplexity and Anthropic answer test questions for the "AI answers" section, such as whether an assistant names your firm for a search like "employment solicitor Leeds". They receive only the search phrases and locations from your report. Our contracts with these providers do not allow them to train their models on this data.
Resend sends our emails. It receives your name, your email address and the link to your report.
Stripe takes payment if you buy the 90-day plan. Your card details go directly to Stripe; we never see your card number.
DigitalOcean hosts the tool and its database, in London.
Cloudflare protects our websites and sees the technical data of every request, such as your IP address.
Monday.com, for client firms only: we copy findings and scores into your project boards.

3.5 How we protect it

Your Google access tokens are encrypted at rest. The keys are held separately from the database.
All connections use HTTPS.
Your report is served on a private link that cannot be guessed. The link expires after 30 days (365 days for the 90-day plan). You can ask for a fresh one.
Only staff who need access have it, and they are bound by confidentiality.

3.6 When we let go of your Google account

We revoke our access to your Google account automatically, at Google, as soon as your report has been built. We hold the access for minutes, not months. You can also remove it yourself at any time at myaccount.google.com/permissions. Removing access does not delete the report we have already built; see section 3.7 for that.

If you buy the 90-day plan we ask you to reconnect Search Console once, about 80 days later, so we can measure what moved. That access is revoked in the same way once the re-run is complete.

3.7 How long we keep report data, and how to delete it sooner

Free report: your details, the data we read and the report itself are deleted 90 days after the report is delivered. If you started but did not finish, they are deleted 90 days after your last activity, and any Google access is revoked at the same time.
90-day plan: kept for 365 days from purchase, then deleted. Your purchase record is kept for six years for tax, with your email address removed at deletion.
Client firms: kept for as long as you are a client, then deleted under section 12.
On request: email us and we will delete your report, the data behind it and your details. We do this within 30 days and usually within a few working days.

4. The data we collect about you

Personal data means information that can identify you. It does not include anonymous data. We collect these kinds:

Identity data: your name, job title and the firm you work for.
Contact data: email address, telephone number and invoicing address.
Financial data: payment card details, handled by Stripe, and bank details for invoiced work.
Transaction data: details of payments and services you have bought from us.
Technical data: IP address, browser type and version, device and operating system, and how you reached our site.
Google account data: the Search Console, Google Ads and Google Analytics data described in section 3, and the email address of the Google account you connected.
Website performance data: what we read when we crawl your firm's public website.
Usage data: how you use our website, tools and services.
Marketing and communications data: your marketing preferences and how you have responded to our emails.

We also use aggregated data, such as statistics across all reports. It is derived from personal data but cannot identify you, so it is not personal data in law. If we ever combine it with personal data, we treat the result as personal data.

We do not collect special categories of personal data (such as health, religion, politics or sexuality) or data about criminal convictions.

Where we need data to perform a contract with you and you do not provide it, we may not be able to provide the service. We will tell you if that is the case.

5. How we collect your data

Directly from you: when you enquire, sign a contract, fill in a form, use the Client Acquisition Map, subscribe, enter a promotion or give feedback, by any channel.
From your Google accounts: only when you connect them in the Client Acquisition Map, as set out in section 3.
Automatically: technical and usage data through cookies, server logs and similar technologies when you use our website and tools. See section 8.
From third parties: analytics providers, advertising networks and search providers (technical data); payment providers (contact and transaction data); publicly available sources such as your firm's website and professional directories (identity and contact data).

6. How we use your personal data

We only use your data when the law allows it. Most often that is because:

you have asked us to do something, or we are performing a contract with you;
it is in our legitimate interests, and your interests and rights do not override them;
we must comply with a legal obligation.

We rely on consent for two things only: sending you marketing emails, and reading your Google account data in the Client Acquisition Map. You can withdraw either at any time.

Purposes and lawful bases

Purpose	Type of data	Lawful basis
Build your free Client Acquisition Map report and send it to you	Identity, Contact, Google account, Website performance, Technical	Steps taken at your request before a contract. Consent, for reading your Google accounts
Follow up on your report by email, and invite you to a walkthrough call	Identity, Contact, Usage	Legitimate interests (helping you act on the report; winning your business). You can opt out in any email
Sell and deliver the 90-day plan, including the day-90 re-run	Identity, Contact, Financial, Transaction, Google account, Website performance	Performance of a contract with you
Register you as a client and deliver our services	Identity, Contact, Google account, Website performance	Performance of a contract with you
Manage payments, fees and money owed to us	Identity, Contact, Financial, Transaction	Performance of a contract; legitimate interests (recovering debts)
Manage our relationship, including notices about changes to our terms or this notice, and asking for reviews or feedback	Identity, Contact, Marketing and communications	Performance of a contract; legal obligation; legitimate interests (keeping records up to date)
Run promotions, competitions and surveys	Identity, Contact, Usage, Marketing and communications	Performance of a contract; legitimate interests (understanding what clients want)
Run and protect our business, websites and tools: troubleshooting, testing, security, hosting and reporting	Identity, Contact, Technical	Legitimate interests (running the business, security, preventing fraud); legal obligation
Suggest services that may interest you	Identity, Contact, Technical, Usage	Legitimate interests (developing our services and growing our business)

Marketing and measurement tools

Purpose	Type of data	Lawful basis	Providers
Measure how our website is used and improve it	Technical, Usage	Legitimate interests (keeping the site relevant and working)	Google Analytics
Send email marketing about our services and content	Identity, Contact, Marketing and communications	Consent only. You opt in on our forms and can opt out with the unsubscribe link in any email or by contacting us. We keep records of consent in our CRM	[Mailchimp, HubSpot]
Show our adverts to people who have visited our website	Technical, Usage	Legitimate interests. No identity or contact data is used. Opt out by refusing cookies	[Google Ads, Microsoft Advertising]
Record how visitors use our website pages to find problems and improve them	Technical, Usage	Legitimate interests. No identity or contact data is recorded. Opt out by refusing cookies	[Hotjar]
Track which marketing brought in each phone call	Contact, Technical, Usage	Legitimate interests. Your number is recorded when you call and is not used for anything else without your permission. Opt out by refusing cookies	[CallTrackingMetrics]
Let you share, like and follow our content on social networks	Technical, Usage	Legitimate interests. The networks collect data when you use their buttons; manage it in your account settings with them	LinkedIn, Facebook, Instagram, X

Change of purpose

We only use your data for the purpose we collected it for, or for a compatible purpose. If we need it for something unrelated, we will tell you and explain the lawful basis. We may process your data without your knowledge where the law requires or allows it.

7. Marketing

You will only receive marketing emails from us if you opted in, or if you asked us for information or bought a service from us and have not opted out. Every email has an unsubscribe link, and you can contact us at any time to stop.

We do not share your data with anyone outside Crescat Digital for their marketing without your express consent.

Opting out of marketing does not stop emails that are part of a service you asked for, such as your report link, your plan and your purchase receipts.

8. Cookies

You can set your browser to refuse cookies or to alert you when a site sets one. Some parts of our website may not work if you do. Our cookies page lists the cookies this website uses.

The Client Acquisition Map sets only essential cookies, and only when needed: one so your report page can open the plan checkout without a password, and one that keeps client firms signed in to their console. Neither is used for tracking or advertising, and neither needs your consent.

We share personal data with the providers named in sections 3 and 6, and with:

service providers who host our systems, send our emails, take payments and support our services;
professional advisers, such as lawyers, bankers, auditors and insurers;
HM Revenue & Customs, regulators and other authorities where the law requires it;
a buyer or merger partner if we sell or restructure our business. They may use your data only as set out in this notice.

We require every provider to keep your data secure and to process it only on our instructions. We do not allow them to use it for their own purposes.

10. International transfers

Some of our providers are outside the UK, mainly in the United States. Whenever we transfer your data out of the UK we make sure it has protection equivalent to UK law, by one of these routes:

the country has UK adequacy regulations, such as the European Economic Area;
the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US "data bridge");
we use the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

11. Security

We use appropriate technical and organisational measures to stop your data being lost, misused, accessed without authority, altered or disclosed. Access is limited to people who need it for their work, and they must keep it confidential.

We have procedures for suspected data breaches and will tell you and the regulator where the law requires it.

12. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, including legal, accounting and reporting requirements. When deciding how long, we consider how sensitive the data is, the risk of harm if it were misused, and whether we can achieve the purpose another way.

Client Acquisition Map data: the periods in section 3.7.
Clients: by law we keep basic information about clients (identity, contact, financial and transaction data) for six years after the relationship ends, for tax purposes.
Marketing: until you opt out, and a record of your opt-out afterwards so we respect it.

In some cases we anonymise data for research or statistics, so it can no longer be linked to you. We may keep anonymised data indefinitely.

13. Your legal rights

Under UK data protection law you have the right to:

Access the personal data we hold about you (a "subject access request").
Correct data that is inaccurate or incomplete.
Erase your data where there is no good reason for us to keep it. We may have to keep some data for legal reasons and will tell you if so.
Object to processing based on legitimate interests, and to direct marketing at any time.
Restrict processing while a question about accuracy, lawfulness or a legal claim is resolved.
Transfer data you gave us to you or another provider, in a machine-readable format, where we process it by automated means under consent or a contract.
Withdraw consent at any time, without affecting what was done before. For Google data, you can also revoke our access at myaccount.google.com/permissions.

We do not make decisions about you by automated means that have legal or similarly significant effects.

To exercise any right, email lee@crescatdigital.com. There is no fee, unless a request is clearly unfounded, repetitive or excessive. We may ask for information to confirm your identity. We respond within one month; if a request is complex we will tell you and keep you updated.

14. Glossary

Legitimate interests means our interest in running our business well and giving you a good, secure service. We weigh any impact on you and your rights before relying on it, and do not use it where the impact on you would outweigh our interest.
Performance of a contract means processing needed to deliver a contract with you, or to take steps you ask for before entering one.
Legal obligation means processing needed to comply with a law or regulation we are subject to.
Processor means a provider that handles data on our behalf and on our instructions.
Google user data means the data we read from your Google accounts through Google's APIs, as described in section 3.