This policy explains what LFW collects when you visit LFW.com or use our tools, why we collect it, who we share it with, and the choices you have. We keep this deliberately plain.
LFW is operated by LFW.com LLC, a Virginia limited liability company doing business as LFW (“LFW,” “we,” “us”). This policy covers our public website, the free audit, the reports we send, and the client portal (together, the “Services”).
It does not cover the separate written agreement we sign with retainer clients, which governs how we handle a client’s own systems and data.
What we collect
Information you give us
- The free audit. The domain you enter, and, if you ask for the full report, your email address, so we can run the audit and send you the results.
- Contact and booking. Your name, email, and anything you write when you contact us or book a call. We use these to reply to you and to hold the call, and for nothing else: a contact message does not put you on any mailing list.
- The client portal. If you’re a client, your name and email, the requests and messages you submit, and any files you attach.
Information we collect automatically
- Report and invitation visits. When you open a report or an invitation we’ve sent (a link like LFW.com/r/… or LFW.com/i/…), we log the time, your IP address, your browser and device type, and the page that referred you. We use this to understand whether and when something we sent has been seen.
- Page views. We count visits to our public pages using our own first-party analytics: the page you viewed, the site that referred you, an approximate location (country, and where available region or city, computed by our security provider from your IP address, which we do not store), and a one-way hashed identifier derived from your IP address and browser (used to estimate unique visitors). The raw IP address and browser details are not stored, and the identifier is salted with the date, so it cannot be linked across days or reversed. This is cookieless and stays on our servers; we don’t use Google Analytics, and we don’t track you across other sites.
- Security and delivery logs. Our servers and our security provider record IP addresses and basic request details to keep the Services running, prevent abuse, and rate-limit automated traffic.
- Cookies. We use a small number of first-party cookies, all functional: the signed cookie that keeps you logged in to the portal or admin, a token that protects forms against cross-site abuse, and two cookies that keep you on one version of a homepage A/B test we run (comparing which call-to-action works better) and count you once rather than repeatedly. We do not use advertising cookies or any cross-site tracking.
The free audit itself looks only at information that is already public about a domain: the same things any visitor or standard tool can see. It does not attempt to access private systems, and it does not require you to give us access to yours.
Why we use it
- To run the free audit and send you the report you asked for.
- To respond to you, schedule calls, and provide the Services.
- To operate and secure the site: preventing abuse, debugging, and rate-limiting.
- To understand whether a report or an invitation we sent has been opened.
- To send you service messages and, only if you subscribe to it, the newsletter. You can unsubscribe at any time.
- To meet our legal obligations.
We do not sell your personal information, and we do not use it for targeted advertising or to build profiles about you.
Who we share it with
We share information only with the service providers that help us run LFW, and only as needed. Today those are:
- Hetzner: hosting for our servers and database.
- Cloudflare: content delivery, security, and Web Analytics. It processes IP addresses and request data to protect the site. Its browser beacon also collects page-view and performance measurements; see Cloudflare’s Web Analytics documentation.
- Google Workspace: our email and calendar. Contact messages and booking requests land in our Google mailbox, replies go out through it, and calendar invitations for booked calls are created there.
- Resend: sending some of our email, such as audit reports and receipts; it receives the email address and the contents of messages we send you.
We may also disclose information if the law requires it, to protect our rights or safety, or in connection with a sale or transfer of the business. We’ll update this list as our providers change.
How long we keep it
We keep information for as long as we need it for the purpose it was collected, and then delete or de-identify it.
Scan results and report-visit logs are kept while they’re useful for the outreach or engagement they relate to; contact messages and portal records are kept for the life of the relationship and a reasonable period after.
We keep our own aggregate website analytics (page-view and visitor counts) indefinitely, to understand long-term trends. You can ask us to delete your information sooner (see below).
Your choices and rights
If you are a Virginia resident, the Virginia Consumer Data Protection Act gives you the right to confirm whether we process your personal data, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of the sale of your data or targeted advertising (we do neither). We extend these same choices to everyone, wherever you live.
To exercise any of these, email hello@lfw.com. We’ll respond within 45 days. If we decline a request, you may appeal by replying to our response, and we’ll reconsider and explain our decision.
To stop non-essential email from us, use the opt-out in the message or email us. We can’t remove the essential cookies without breaking login, but you can clear or block cookies in your browser.
Security
We take reasonable measures to protect the information we hold: encrypted connections, access controls, and login by one-time link rather than stored passwords. No method of transmission or storage is perfectly secure, so we can’t guarantee absolute security.
Children
The Services are for businesses and organizations and are not directed to children. We don’t knowingly collect personal information from anyone under 13. If you believe a child has given us information, email us and we’ll delete it.
Where your information is handled
LFW is based in the United States, and we process information in the United States and in the facilities of the providers listed above. If you contact us from outside the U.S., you’re sending your information to the U.S.
Changes to this policy
We may update this policy as the Services change. When we do, we’ll revise the “last updated” date above, and for significant changes we’ll do more to let you know.
Questions, or want to exercise a right? Email hello@lfw.com. See also our Terms & Conditions.