Last updated 28 August 2026
Curbcut scans public websites and reports accessibility, SEO, security and performance problems. This page sets out exactly what that involves, what we collect, why we are allowed to, and how long we keep it.
Curbcut is operated by Brae Campbell in San Rafael, California, United States. Where the UK or EU General Data Protection Regulations apply, he is the data controller. Contact: curbcuthq@yahoo.com.
The website address you submit. We fetch that page and other pages on the same domain, and analyse the HTML. Results are returned to you and not stored afterwards.
Legal basis: legitimate interest — you asked us to perform the scan, and we cannot perform it without the address.
Your email address, if you give us one. Only when you ask us to send you a report or tell you when paid reports are available. We use it for that, and for occasional messages about Curbcut. We do not sell it or share it for anyone else’s marketing.
Legal basis: consent, which you may withdraw at any time by replying to any message or emailing us.
Order details, if you buy something. Your email address, what you bought, the amount, and the site the order relates to. Card details are handled by our payment provider and never reach us.
Legal basis: performance of a contract.
Request logs, including IP addresses. Our host records ordinary request metadata. We use IP addresses to enforce the rate limits that stop the scanner being used to attack other people’s websites.
Legal basis: legitimate interest in keeping the service secure and available.
Aggregate usage statistics. We use Vercel Web Analytics, which is cookieless. It does not set cookies or use a persistent identifier; visitors are counted using a hash derived from the request, which is discarded after 24 hours. For each page view it records the time, the page URL and referrer, approximate location (country, region, city), and device, browser and operating system type. It cannot follow you to other websites and we cannot use it to identify you.
Legal basis: legitimate interest in understanding whether the service is used and working.
We set no advertising or tracking cookies, and we do not build a profile of you or follow you across other websites. We do not log in to the sites you scan and cannot see anything on them that a member of the public could not. We do not make any automated decision that produces a legal or similarly significant effect about you. Curbcut is not intended for children.
We use a small number of providers, each only where it is needed to run the service:
We will update this list when it changes.
Curbcut is operated from the United States, and our providers are based in or store data in the United States. If you are in the UK or European Economic Area, using Curbcut therefore involves transferring your personal data to the US. Where that happens, it is done under the safeguards our providers have in place — such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the EU-US Data Privacy Framework.
Under the California Consumer Privacy Act you have the right to know what personal information we collect and why, to request a copy of it, to have it corrected or deleted, and not to be treated differently for exercising any of those rights. The categories we collect are listed above; we collect them for the purposes stated there and keep them for the periods stated there.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have. There is therefore nothing to opt out of, but if that ever changes we will say so here first and offer the opt-out before it takes effect. We also do not collect sensitive personal information as that term is defined in the Act.
To exercise any of these rights, email curbcuthq@yahoo.com. We will verify your request by replying to the address we hold and respond within 45 days.
If you are in the UK, the EU, or another region with equivalent law, you have the right to: get a copy of the personal data we hold about you; have it corrected; have it deleted; restrict how we use it; object to our using it, including for direct marketing; receive it in a portable format; and withdraw consent at any time where consent is the basis we rely on. Withdrawing consent does not affect anything done before you withdrew it.
Email curbcuthq@yahoo.com and we will act on it within one month.
You also have the right to complain to a data protection supervisory authority — the one in the country where you live or work. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EU, your national authority. We would rather you raised it with us first, but you do not have to.
Curbcut obeys robots.txt and any crawl delay a site declares, caps how often the same site can be scanned, and only reads what is publicly served. You should still only scan sites you own or have permission to test.
If we change how we handle personal data we will update this page and change the date at the top. Where a change is significant and we hold your email address, we will tell you directly.