Privacy Policy
Last updated: 14 September 2026
1. Who we are
Foresight is a product of William James Creative Digital, a sole trader based in Ipswich, Suffolk, UK.
- Trading name: William James Creative Digital
- Email: hello@williamjamescreative.co.uk
- Location: Ipswich, Suffolk, UK
We are the data controller for personal data collected through Foresight. This means we decide how and why your data is used, and we're responsible for keeping it safe.
As a small sole trader, we are not legally required to register with the Information Commissioner's Office (ICO) if we process data only for our own business purposes. If that changes, we will update this policy accordingly. You can find out more at ico.org.uk.
2. What data we collect and why
2.1 Account and domain data
When you sign up, we collect your name, email address and a hashed password (we never store your password in plain text), along with the domain name(s) you add and the DNS verification record used to confirm you own them.
Why: To create and secure your account, and to know which domain(s) our checks should run against. The legal basis is contract performance, this is the core service you're signing up for.
2.2 Technical health & AI-readiness checks
We check your site's HTTPS setup (whether it's securely served), mobile-friendliness, structured data (background information for search engines and AI), robots.txt/sitemap (the files that tell search engines what they can crawl and find), broken links, and Core Web Vitals (Google's own name for how fast and smooth your site feels to a visitor). The Core Web Vitals check sends your site's URL to Google's PageSpeed Insights API, a free Google tool, to get a real performance measurement, this is the only data leaving Foresight for this particular check, and it's just the public URL of the page being tested.
Why: This is the core Foresight service. Legal basis: contract performance.
2.3 Espresso: Google Search Console
If you connect Google Search Console (Espresso plan only), we store an OAuth refresh token so we can retrieve your site's real search performance data, clicks, impressions, queries and pages, on your behalf. We only request read-only access, and only for the domain you explicitly connect.
Why: To show you your actual search performance rather than an estimate. Legal basis: consent (given via Google's own OAuth screen when you connect) and contract performance. You can disconnect this at any time from your dashboard settings.
2.4 Espresso: real AI search visibility
For Espresso domains, we periodically ask Perplexity's AI a small number of realistic customer questions about your business and check whether it mentions you, so we can tell you whether AI answer engines actually recommend you. This means your business name and domain, along with the generated question, are sent to Perplexity as part of that check.
Why: To measure something a simple crawl can't, whether real AI tools mention your business. Legal basis: contract performance (this is a feature of the Espresso plan you've subscribed to).
2.5 Espresso: competitor tracking
If you add a competitor to track (Espresso plan only), we send the competitor's domain and your tracked keywords to SerpApi to check real search rankings. We don't send any of your own personal data as part of this, just the search terms and domains involved.
Why: To show you where you rank against a named competitor. Legal basis: contract performance.
2.6 Fix requests and human reviews
If you ask us to fix something or request a human review, we store whatever notes or context you provide, along with the finding it relates to, so WJCD can act on it and so you can track its status.
Why: To deliver the service you've asked for. Legal basis: contract performance.
2.7 Payments
Subscription and one-off fix payments are handled entirely by Stripe. We never see or store your card details, we only keep a record of your subscription status, payment history and the identifiers Stripe gives us for it.
Why: To bill you correctly and keep a record for accounting purposes. Legal basis: contract performance and legal obligation (accounting/tax records).
2.8 Referrals
If someone signs up using your referral link, we record that link between accounts so we can apply the referral reward to your account.
2.9 Transactional emails
We send emails that are a direct, necessary part of the service, quote-ready notifications, password resets and similar. These aren't marketing and you can't opt out of them while you have an active account, since they relate directly to actions you've taken.
5. How long we keep your data
We keep your account and domain data for as long as your account is active. If you cancel, we retain it for a reasonable period afterwards in case you resubscribe or need support relating to past work, then delete it. Financial records relating to payments are kept for as long as required by UK tax law (currently 6 years). You can ask us to delete your data sooner, see your rights below.
6. Your rights under UK GDPR
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights regarding your personal data:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate or incomplete data.
- Right to erasure — you can ask us to delete your data in certain circumstances (the "right to be forgotten").
- Right to restrict processing — you can ask us to limit how we use your data.
- Right to data portability — you can ask us to provide your data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent (e.g. Search Console), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at hello@williamjamescreative.co.uk. We will respond within one month.
You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), if you believe your data is being handled incorrectly:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
We would always appreciate the opportunity to address any concern directly before you contact the ICO.
7. How we keep your data secure
- All data transmitted to and from Foresight is encrypted via HTTPS/TLS.
- Passwords are hashed, never stored in plain text.
- Card payments are handled entirely by Stripe, a PCI-compliant payment processor, we never see or store your card details.
- Our hosting infrastructure (20i Ltd) is based in the UK.
- OAuth tokens (e.g. for Search Console) are stored securely and only used for the specific, read-only purpose you connected them for.
No method of transmission over the internet is 100% secure. While we do our best to protect your data, we cannot guarantee its absolute security.
8. Children's privacy
Foresight is a business tool and is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
9. Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices, technology or legal requirements. The date at the top of this page shows when it was last updated. If we make significant changes that affect how we use your data, we'll take reasonable steps to bring them to your attention.
10. Contact us
If you have any questions about this policy or how we handle your personal data, get in touch: