Privacy Policy

1. Who we are

12D provides the free 12D Score tool and the 12D Blueprint, Pulse and Radar products. Contact: reach@12dimensions.co.

2. What personal data we collect

Website visitors

• Aggregate, anonymised traffic data via Cloudflare Web Analytics (no cookies, no personal identification)
• Your cookie-consent choice, stored in a single first-party cookie

People who use the 12D Score tool

• The URL you submit, and the resulting score, findings and fixes, stored so the result page keeps working
• A one-way, salted hash of your IP address, used only to enforce fair-use rate limits — the IP address itself is never stored
• To see the full breakdown behind your score, you verify an email address with a one-time code sent to it. We store: the email address; a one-way hash of the code (never the code itself); a one-way, salted hash of your IP address; and a record of your consent — the exact wording shown and when you agreed, both for agreeing to these Terms and our Privacy Policy (required to unlock the report) and, separately, for the optional tick to receive occasional updates from 12D (never required). Only an address that ticked that optional box is ever sent a marketing email. Verifying sets a cookie that keeps your browser unlocked for that site for 30 days — see our Cookie Policy
• To compute a score, the public content of the URL you submit is read (never anything behind a login) and sent to our AI provider for the rubric assessment, and to Google PageSpeed for a technical performance check — see section 4

People who buy 12D Blueprint, 12D Pulse or 12D Radar

• Checkout is by Razorpay only — Indian cards, UPI and netbanking; international cards are not accepted. Payment itself is handled entirely by Razorpay — your card/UPI details are never seen or stored by us
• Once Razorpay confirms a completed purchase, your email address, the amount and currency charged, and a transaction reference are received and stored, so what you bought can be delivered and any refund handled
• Before paying, you're asked whether you're buying as an individual or a business, and for the details your GST invoice needs for that case: your name (or legal/trade name), state, and — for a GST-registered business — your GSTIN, or — for an individual or an unregistered business — optionally or as required, your PAN. Crown Ventures is the seller of record, so that invoice is generated and stored automatically. You confirm these details, and the declaration shown at the time, before paying; once an invoice is issued it can't be edited
• A PAN is stored encrypted; nowhere in our admin tools or logs is it ever shown in full — only masked (e.g. "AKNPD****F"). It's never printed on any invoice, and never shared with anyone except where tax law requires it

3. Why we collect it and our legal basis

• Legitimate interests: to run the 12D Score tool and improve it, including sending the one-time verification code and the unlocked report, and other service messages about them, when you ask to see a score's full breakdown
• Contract performance: to deliver a product you have purchased
• Legal obligation: to meet UK GDPR, ICO registration and tax requirements, and Indian law where applicable
• Consent: the optional "occasional updates" tick is the only thing on this list that's marketing by consent — never required, and withdrawable at any time via the unsubscribe link or by emailing us; doing so only stops those marketing emails and never removes access to a report you've already unlocked

4. Who we share data with

We use the following subprocessors, each under GDPR-compliant terms:

• Google Workspace — email, calendar and document storage
• Cloudflare — DNS, web analytics, security, bot-check (Turnstile — see our Cookie Policy), and encrypted database backups (R2)
• Railway — website and database hosting
• Anthropic — AI used in judging a submitted URL against the 12D rubric and in generating Blueprint content; your customers' personal data is never pasted into it
• Perplexity, OpenAI, and Google (Gemini) — the "What AI says about you" / Recall check: each is asked whether it already knows the business by name and would recommend it for its trade in its city. Only the business's name, trade, city and domain are sent to any of them — never the site's own page content
• Google PageSpeed Insights — automated technical performance check as part of a 12D Score
• Resend — sends the free-score unlock-code and unlocked-report emails (the report email carries a working unsubscribe link), purchase receipts/invoices, the overnight-queue "your score is ready" email, and 12D Blueprint/Pulse/Radar service emails (plan setup, login links, monitoring alerts, monthly reports, cancellation)
• Paddle — merchant of record and payment processor for a purchase checked out through Paddle; handles your card/payment details directly, and passes your email and purchase details on once payment completes — see our Refund Policy
• Razorpay — payment processor (not merchant of record) for a purchase checked out through Razorpay; handles your card/UPI payment details directly, and passes your email and purchase details on once payment completes — see our Refund Policy

Your personal data is never sold, rented or shared with third parties for marketing.

5. Data retention

• Purchases of 12D Blueprint, 12D Pulse or 12D Radar, including the GSTIN/PAN/address details for your invoice: kept for the period Indian tax law requires us to keep records: currently 84 months after the end of the financial year (April to March) in which the invoice was issued, and longer while a tax proceeding, appeal or reassessment about it is still open (CGST Act 2017, section 36; Income-tax Rules 2026, rule 46).
• 12D Score results and email subscriptions: 12 months from creation, then deleted; if you unsubscribe, your subscription record is deleted after 30 days rather than waiting out the 12 months. Deleted automatically, every night
• Email-verified unlock records (your email address, the consent record described in section 2, and the hashed IP): deleted along with the score they belong to — 12 months from that score's own date, same as above — or earlier if you ask us to (see section 7). The one exception is a record of the optional "occasional updates" tick, kept separately: while it's active, and afterwards as proof of what you agreed to (or later withdrew), for as long as we might reasonably need to show that
• Website analytics: anonymised, retained indefinitely

6. International transfers

We operate from India. Data belonging to UK residents that is transferred to India is protected by our contractual terms with subprocessors and our ICO registration. Where subprocessors are in the United States, we rely on Standard Contractual Clauses or equivalent mechanisms under UK GDPR.

7. Your rights under UK GDPR

You may ask to access, correct or delete your personal data, object to processing based on legitimate interests, withdraw consent, or complain to the ICO at ico.org.uk. Email reach@12dimensions.co; we respond within 30 days.

8. Cookies

See our Cookie Policy.

9. Changes and contact

We may update this policy; the date at the top shows the current version. Questions to reach@12dimensions.co.