Privacy policy
This policy explains what personal data we collect, why we collect it, who we share it with and what you can ask us to do about it. It covers this website, lavine.dev, and the work we do for clients.
Last updated 22 September 2026
Who we are
Lavine Web and AI Solutions Ltd is a company registered in England and Wales, company number 16897264. Our registered office is Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville, Hampshire PO8 0BT, and we work from Ashford, Kent.
We decide how and why we use your personal data, which makes us the controller of that data under UK data protection law. Steve Lavine, our founder, handles every privacy question and request. Email steve@lavine.dev.
What we collect and why
Here is each way we collect personal data, what we do with it and the lawful basis we rely on.
Our contact form
The form on our contact page asks for your name and email address. You can also give a phone number, pick an enquiry type and write a message. We store your submission in our website database and receive a copy by email, so we can reply.
We also add your name and email address to a list of enquiries in Resend, our email service, so we keep a record of who has contacted us. Your message stays out of it. We mark you as unsubscribed on that list, so you will not get our newsletter unless you sign up for it.
If you email us directly, the conversation stays in our Google Workspace email account.
We use these details to answer your enquiry and, if you ask, to quote for work. Our lawful basis is legitimate interests: you got in touch and expect an answer. If you ask about hiring us, we also rely on the steps you ask us to take before a contract, such as a quote.
Our newsletter
The sign-up form in our footer asks for your first name, last name and email address. We send them to Resend, the service that holds our mailing list and sends our emails.
Our lawful basis is your consent. Every newsletter has an unsubscribe link, or you can email us and we will take you off the list.
The AI Visibility Scan
To run a scan you give us a website address. Our server fetches that page, along with the site's robots.txt and llms.txt files. We then send the page title and up to 32,000 characters of the page text to Anthropic's Claude API, which writes the summary in your report. Anthropic receives the website's content only. We never send it your name, email address or IP address.
Each scan also stores a hashed copy of your IP address (scrambled so nobody can read it back) and your browser's user agent, a short line of text that names your browser and device. We use them to limit how many scans one connection can run in an hour, which stops people abusing the tool.
Your report link contains a private code. Anyone who has the link can open the report, so share it with care.
To unlock the full report, you give us your name and email address. We then email you a copy of the report through Resend. We also email ourselves a note with your name, email address, the site you scanned, its overall score and whether you ticked the marketing box.
The marketing box starts unticked, and you can unlock the report without it. If you tick it, we add your name and email address to our newsletter list in Resend.
Our lawful basis for running the scan and sending the report is legitimate interests: you asked for them. We keep the hashed IP address and user agent on the same basis, because we need to protect the tool. Marketing emails rely on your consent.
Blog comments
To comment on a blog post you give us your name and your comment. An email address is optional. We read every comment before it goes live. Once we approve it, your name and comment appear under the post for anyone to see. We never publish your email address.
Our lawful basis is legitimate interests: hosting a discussion under our posts. Ask us and we will remove your comment.
Likes
When you like a post or case study, your browser stores a note of it so the button stays lit. Our server adds one to the count and records nothing about who liked what.
Spam protection on our forms
The contact form, the comment form and the scan forms use Google reCAPTCHA Enterprise to keep out spam and bots. It looks at information about your browser and how you use the page to judge whether a person is filling in the form. Google's privacy policy and terms of service apply to it. Our lawful basis is legitimate interests: keeping our forms free of spam.
Analytics
If you accept analytics cookies, we load Google Tag Manager, which runs Google Analytics. It tells us which pages people visit, how they found us and roughly where they are. It also counts when someone sends the contact form or joins the newsletter. It never receives your name, your email address or anything you type into a form. If you decline, or never answer the cookie question, neither tool loads.
Our lawful basis is your consent. Our cookie policy lists the cookies involved and lets you change your choice.
Visiting the site
Vercel hosts our website. Like any web host, it processes your IP address and basic details of each request to deliver pages and keep the site secure. Our lawful basis is legitimate interests: running a working, secure website.
If you are a client
When you work with us, we keep your contact details, project records and invoices in our website's admin system. We email invoices through Resend and copy them to FreeAgent, our accounting software. Our lawful bases are the contract between us and our legal duty to keep financial records.
Data sent outside the UK
Vercel, Resend, Anthropic and Google are based in the United States and can process your data there. When they do, we rely on a safeguard UK law recognises, such as the UK-US data bridge or the International Data Transfer Addendum in a provider's terms.
How long we keep it
| Data | How long we keep it |
|---|---|
| Scans nobody unlocks, with the hashed IP address and user agent | Deleted automatically after 90 days |
| Unlocked scans, with your name and email address | Until you ask us to delete them, or until we no longer need them as a record of the report we sent and your marketing choice |
| Newsletter details | Until you unsubscribe or ask us to delete them |
| Contact form enquiries | As long as we need them to deal with your enquiry and any work that follows |
| Blog comments | While the post stays online, or until you ask us to remove them |
| Client records and invoices | As long as tax and company law requires |
| Analytics data | Google Analytics deletes it automatically at the end of the retention period set in our account |
Automated decisions
We do not make decisions about you by automated means alone that have legal or similarly significant effects. The AI Visibility Scan scores a website, not a person.
Your rights
UK data protection law gives you the right to:
- get a copy of the personal data we hold about you
- have it corrected if it is wrong or incomplete
- have it deleted
- ask us to limit how we use it
- object to how we use it, and stop direct marketing at any time
- receive data you gave us in a format you can move to another service
- withdraw your consent at any time, where we rely on consent
Some of these rights apply only in certain situations. If one does not apply, we will tell you why.
To use any of them, email steve@lavine.dev. We will reply within one month. There is no charge in most cases. If we need to, we will ask you to confirm who you are before we act.
Complaints
If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Keeping your data safe
The whole site runs over HTTPS. Only our own logged-in accounts can read form submissions, scans and comments waiting for approval.
Children
Our website and services are for businesses. We do not knowingly collect personal data from children.
Changes to this policy
When we change how we use personal data, we will update this page and the date at the top.