Privacy policy

Effective 3 September 2026 · Last updated 3 September 2026

1. Who we are

Pryor is a product of Cruza Technologies LLC (“Pryor”, “we”, “us”), the controller of the personal data described in this policy.

Privacy questions and requests: privacy@pryorai.com.

2. What this policy covers

This policy covers pryorai.com and the free website scan at pryorai.com/scan.

It does not cover the Pryor product once it is installed on a customer’s own website. In that arrangement the customer decides what is collected from their visitors and is the controller of it; we act on their instructions as a processor under our agreement with them.

3. What we collect when you run a free scan

• The website address you enter. The scan then fetches that site’s public pages, the same pages any visitor or search engine can read. It does not read your analytics, your CRM, or anything about your own visitors.
• Your email address, only if you give it to us to receive the report or to be contacted.
• Campaign parameters present in the URL you arrived on (for example utm_source, gclid), so we can tell which channel a scan came from.
• Request metadata written to our server logs: your IP address, your browser’s user agent, the page requested, and the time. The IP address is stored as a salted hash, used to keep the free scan within fair limits and to block abuse.

4. What we collect on this website

We use two measurement tools. What they may do depends on where you are, because the law does.

• Google Analytics 4 — page views, referring site, approximate location derived from IP, device and browser type. Advertising features and data sharing are off.
• Microsoft Clarity — anonymised session replays and heatmaps showing how pages are used. Text you type into form fields is masked before it leaves your browser.

Both also record which things you click: a call to action, a scan started, a form sent, and the website address you entered for a scan. We record that a form was sent and whether it was accepted — never what you typed into it. Your name, your email address and anything you write in the note reach us and the founder, and go to neither of these vendors.

If you are in the EU, the UK or Switzerland, nothing identifies you until you accept in the cookie notice. Until then Google Analytics runs in what Google calls consent mode: it sets no cookie, keeps no identifier, and receives only anonymous signals — that a page was viewed, on what kind of device — which it uses to estimate overall traffic. Clarity does not run at all. If you accept, both work in full. If you decline, that is how it stays.

Everywhere else, both tools work in full from your first page view, and the cookie notice is where you opt out. If you decline, Google Analytics drops back to the anonymous mode above, Clarity erases its cookies and stops, and we delete the cookies either of them set.

We tell the two apart by your browser’s timezone; nothing is looked up and no request is made for it. If we cannot tell, you are treated as being in the EU. If your browser sends a Global Privacy Control signal, we treat it as a decline and do not ask. There are no advertising cookies on this site and we do not run retargeting on our own visitors.

You can change your choice at any time with Cookie settings in the footer.

5. Cookies and similar technologies

Only the first row exists before you accept.

6. How we use it

• To run the scan you asked for and produce your report.
• To send you the report and reply when you contact us.
• To understand how this website is used and improve it.
• To keep the free scan available and fairly shared, and to prevent abuse.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

7. Legal bases (visitors in the EU and UK)

• Consent for analytics and session replay. You may withdraw it at any time.
• Performance of a contract, or steps taken at your request, for running a scan you started and sending its report.
• Legitimate interests for security, rate limiting and abuse prevention, balanced against your rights.

8. Who else processes it

We use a small number of service providers, each bound to process data only on our instructions:

• Railway — hosting and server logs.
• Google — Google Analytics, after consent.
• Microsoft — Clarity, after consent.
• Resend — sending report and notification emails.
• ScreenshotOne — capturing an image of the public website being scanned.
• OpenRouter, Exa and the AI model providers reached through them — answering the market questions a scan asks. They receive the public query text and public page content. They do not receive your email address.
• Firecrawl, Brandfetch and Logo.dev — retrieving public pages, logos and brand assets for the site being scanned.

We disclose personal data otherwise only where the law requires it, or to protect our rights.

9. How long we keep it

• Scans and reports: kept while we need them to provide the service, and deleted whenever you ask. Email us and we remove yours.
• Server logs: as long as our hosting provider retains them, normally no more than 30 days.
• Email correspondence and enquiries: up to 24 months.
• Analytics: the retention set at each vendor, as listed in section 5.

10. Your rights

Wherever you are, you can ask us to give you a copy of your data, correct it, or delete it, and you can withdraw consent. If you are in the EU or UK you also have the right to object to processing, to restrict it, to data portability, and to complain to your data protection authority. If you are a California resident you have the rights to know, delete, correct and opt out under the CCPA as amended; we do not sell or share personal information as those terms are defined there, and we will not treat you differently for exercising a right.

Email privacy@pryorai.com. We reply within 30 days.

11. Where it is processed

We are based in the United States and your data is processed there. Where a provider handles data from the EEA or UK, transfers rely on the European Commission’s standard contractual clauses or on the provider’s certification under the EU-US Data Privacy Framework.

12. Children

This is a business product. It is not directed at children and we do not knowingly collect data from anyone under 16.

13. Security

The site is served over HTTPS. IP addresses in our records are salted and hashed rather than stored in the clear. Access to scan records is limited to the people who need it to run the service.

14. Changes

If this policy changes, the effective date above changes with it, and a material change will be described on this page.

15. Contact

privacy@pryorai.com