What we keep,and why.What we keep,and why.

Who we are

Mendbird is run by Moonlathe Technologies Ltd, a company registered in England and Wales, company number 17493793, which is the data controller. We are registered with the Information Commissioner's Office (ICO), registration number ZC266615. You can reach us at hello@mendbird.com.

The free check

When you check a site, Mendbird visits it the way any visitor would: its public pages, its robots.txt file and the files any browser can fetch. It looks up the domain's public records (when it runs out, and how its email is set up) and compares the software it finds with public lists of known flaws. It never logs in, never tries a flaw, and never changes anything.

The report is kept for 15 minutes so a refresh or a shared link does not check the site again. We do not keep a list of the sites people check.

Helping the Mendbird learn

Under the address box there is a tick box, unticked to start with: "Keep this check private". While it is unticked, we keep what the check found (the grades, what kind of problem, and the software and versions) with the site's address and name taken out, so it cannot be traced back to the site. We use it only to make the checks better: spotting what is common, and finding where the check gets things wrong. We never share it.

Tick the box and nothing from that check is kept. The lawful basis is legitimate interests: improving a free tool, with an easy way to say no.

Counting visits

We count visits anonymously, so we know which parts of the site help people. Each day we add up how many visits reached each page and each step (such as finishing a check), which site sent them, the country Cloudflare says the request came from, phone or computer, how far down the page people scrolled, roughly how long the page was open, and which buttons were tapped and roughly where. These are daily totals. No IP address, visitor identifier or anything you type is stored, nothing is saved on your device for it, and no visit can be linked to another or to you.

You can still say no. Press "Don't count my visits" on the notice at the bottom of the page or on the cookies page, and your browser stops sending the counts. If your browser sends the Global Privacy Control signal, we treat that as a no without you doing anything. The lawful basis is legitimate interests.

Starting a plan

When you start watching, we keep your email address, the plan you chose and the sites you want watched, and use them to set up your plan, run the daily checks and send your alerts. We do not send newsletters. The lawful basis is contract: we need them to do what you signed up for.

While you have an account we also keep a record of each daily check, so you can see what changed. If you use the Mendbird helper, it sends us the names and versions of the software your site runs, never your content, your customers' details or passwords.

When you close your account we delete your sites and check history within 30 days. Records of what you paid are kept for six years, because HMRC requires it.

Signing in

There are no passwords. To sign in we email you a short code, which we store scrambled and which works once, for 10 minutes. If you add a passkey, your device keeps the private part and we only hold the public part, which is useless to anyone else. Staying signed in uses one strictly necessary cookie, explained on the cookies page.

Paying

Payments are taken by our payment provider. We never see or store your full card number. We keep what you paid, when, and for which plan.

Asking for a quote

When you ask for a fix quote, we keep your name, email address, phone number if you gave one, your website and what you told us, and a copy is emailed to our own inbox so a person can reply. We keep it for as long as we are talking and a reasonable time afterwards in case you come back. If we do the work, we keep the records any supplier keeps for six years. The lawful basis is legitimate interests: answering someone who asked us for something, and then contract if you go ahead.

Who else sees it

As few people as possible.

• Cloudflare hosts Mendbird, its database and its email forwarding, and sees the usual request data, including your IP address, as part of serving pages and blocking attacks.
• Looking up a domain sends its name to Cloudflare's DNS service and the domain registry. Checking for known flaws sends software names and versions to the public flaw lists (WPVulnerability, OSV, CISA and endoflife.date), never the site's address.
• Our email provider delivers sign-in codes and alerts, and holds our correspondence the way your own email provider does.
• Our payment provider handles payments, and our accountant sees invoices and payments, because they have to.

We do not sell data, we do not share it for marketing, and nothing here is used to build a profile of you.

Where it is kept

In the United Kingdom and the European Economic Area where we can choose, and in the United States where a provider we use is based there. Those transfers rely on the UK international data transfer addendum or the UK extension to the EU and US Data Privacy Framework.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it or delete it, object to us using it, or ask us to stop. Email hello@mendbird.com and we will do it, normally within a few days and always within a month. If you are unhappy with how we handled it, you can complain to the ICO at ico.org.uk.

Changes

If we change what we collect, this page changes first, with a new date at the top. If the change affects people with an account, we email them before it happens.