Privacy policy

Second Site is used by Compound Partners' clients, by invitation. An organisation's users sign in with an email address and password. We store each user's name, email address and organisation membership to run their account.

Second Site crawls the public pages of each client organisation's website and stores their text, metadata and technical details to audit them. It only crawls websites its client organisations have asked it to.

An administrator can connect their organisation's Google Analytics 4 property and Google Search Console property. Second Site then reads, read-only:

• Google Analytics (analytics.readonly): page views, engagement and key events for each page of the organisation's website.
• Google Search Console (webmasters.readonly): the search queries each page appears for, with impressions, clicks, click-through rate and average position.

We use this data only to provide Second Site's features to the organisation that connected it: showing page and search performance, prioritising content work, and recommending content to create, update or consolidate. We never change Google settings or data.

We do not sell Google data, use it for advertising, share it with other organisations using Second Site, or use it to train artificial intelligence models.

Second Site's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use these providers to run Second Site. Each processes data only on our instructions:

• Supabase: database and sign-in, hosted in the EU (Frankfurt).
• Render and Vercel: application hosting.
• Anthropic (Claude API): analyses page content and, for some features, a page's top Search Console queries, to match pages to the questions an organisation's audiences ask and to suggest such questions. Anthropic does not use data sent through its API to train its models.
• Sentry: error monitoring, configured not to collect personal data.
• Google BigQuery: stores website server logs for clients who use AI bot reporting.

Google access tokens are encrypted at rest. Data is held for as long as the organisation uses Second Site. Weekly snapshots of Search Console queries are kept for 26 weeks. When an organisation leaves, we delete its data on request.

An administrator can disconnect Google Analytics or Search Console at any time in Settings → Connections; Second Site then stops reading that data and deletes its stored access. You can also remove Second Site's access to your Google account at myaccount.google.com/permissions.

To ask for a copy of your data, its correction or its deletion, contact us at privacy@compoundpartners.co.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

We will update this page if anything here changes, and update the date at the top. See also the Second Site homepage.