Privacy policy
Effective 10 September 2026
Sixvitals is operated by ZetaFusion LLC (zetafusion.ai), the data controller for everything described here. This page lists what we collect, why, who else touches it, how long we keep it, and how to get it deleted. It is written to match what the product actually does; when the product changes, this page changes with it.
1.What we collect
Three kinds of data, from three sources.
| Data | Where it comes from | Why |
|---|---|---|
| Email address | You, at sign-in (magic link) or from Google | Your account identity and the sign-in link. It is the only required personal detail. |
| Name and profile picture | Google sign-in (if you use it), or the name you type in Settings | Shown to you in the app. Optional; you can clear the name at any time. |
| Google account id | Google sign-in | Links your Google account to your Sixvitals account so you can sign in again. We never receive your Google password. |
| Sites you add | You | The domain and an optional display name. This is what we audit. |
| Audit data | Our crawler, reading the public pages of your sites | Fetched pages, response headers, timings, screenshots, the scores, findings and rendered reports. Kept per run so week-over-week change is visible. |
| IP address and browser user agent | Your browser | Stored with each sign-in session for security (you can see and revoke sessions by signing out everywhere), and used to rate-limit the anonymous quick scan. |
| Usage analytics | Your browser, via Google Analytics | Page views and product events (a scan was run, a site was added, a link was copied). No email, name or token is ever sent to analytics. |
The quick scan on the home page stores nothing: the domain you type is fetched once, scored, shown to you, and discarded. The audit engine reads only public pages: it never logs in, never submits forms and never solves captchas. See SixvitalsBot for what it fetches and how to block it.
2.Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
sv_session | Keeps you signed in. Encrypted; readable only by our server; never contains your password (there is none). | 30 days, or until you sign out |
sv_login_method | Remembers whether a sign-in started with Google or an email link, so analytics can count sign-ins by method. | 15 minutes |
_ga, _ga_* | Google Analytics: tells returning visits from new ones. Set only on the production site. | Up to 2 years |
No advertising cookies, no cross-site tracking. Blocking the analytics cookies in your browser does not affect the product.
3.Who else processes it
We use a small number of providers to run the service. Each one receives only what its job needs.
| Provider | What they do | What they see |
|---|---|---|
| Google Cloud | Hosts the audit engine and the database (United States, us-central1). | Everything in section 1, encrypted in transit and at rest. |
| Vercel | Hosts the website and the app you are using. | Requests to the site, including your IP address. Holds no database. |
| Resend | Sends the sign-in email. | Your email address and the one-time link. |
| Sign-in with Google; Google Analytics. | Sign-in: your Google identity, by your choice. Analytics: page views and events, with no personal identifiers from us. | |
| Anthropic | Model-assisted part of the audit: classifies what kind of business a site is and describes what is visible in screenshots. | Public page text and screenshots of the audited site. Never your account details. |
We do not sell personal data, and we do not share it with anyone else except when the law requires it.
4.Public scorecards
Every verified site has a share link (sixvitals.com/s/…) that shows the latest overall score and pillar scores, without findings. Anyone with the link can open it; search engines are told not to index it. You create that exposure only by sharing the link; deleting the site makes the link stop working.
5.How long we keep it
- Account, sites, audits: until you delete them. Deleting a site removes its runs, findings and reports; deleting your account (Settings → Delete account) removes everything in it, including sign-in sessions, immediately.
- Sign-in links: 15 minutes, single use. Sessions: 30 days from the last refresh, or until you sign out.
- Kept after deletion: a record that a domain was verified for an email address on a date, and by which method. We keep it so a claim of ownership can be audited later; it holds no other account data. The engine also keeps an accounting record of its model calls with the account link removed.
- Server logs at our hosting providers are kept for a limited period for security and debugging, then deleted.
6.Your choices and rights
You can view and change your name, and delete your account with everything in it, from Settings. For a copy of your data, a correction we cannot make in the app, or to object to any processing, write to hello@sixvitals.com. We answer within 30 days. Where the GDPR, the UK GDPR or the CCPA applies to you, these are the rights those laws give you, and you may also complain to your local supervisory authority.
If Sixvitals is auditing a domain you control and you would rather it did not, add the robots.txt rule on the crawler page or write to bot@sixvitals.com; we stop within one business day.
7.Security
There are no passwords to leak: sign-in is by email link or Google. Session and sign-in tokens are stored only as hashes; the session cookie is encrypted and unreadable by scripts. All traffic is encrypted in transit. Access to production systems is limited to ZetaFusion LLC staff who need it to run the service.
8.Children
Sixvitals is a tool for people who run websites and is not directed at anyone under 16. We do not knowingly collect data from children; if you believe we have, tell us and we will delete it.
9.Changes and contact
When this policy changes in a way that matters, the effective date at the top moves and signed-in users see a notice on their next visit. Questions go to hello@sixvitals.com, or by post to ZetaFusion LLC at the address published on zetafusion.ai.