What we collect, and why
This is the privacy policy for readinessindex.io, the AI Readiness Index scanning tool built and run by Ten 7 Interactive, LLC ("TEN7," "we," "us"). It covers this scanning service and its browser extension specifically — not ten7.com, our main agency site, which has its own policy.
We built this tool to be free to use without an account, so most of what follows describes the minimum we collect to run a scan and show you the result — plus the smaller amount we collect if you ask for more: a full report, or an account to save your scans to.
Running a Reach scan
When you type a URL into the box on the home page, we record that URL, the IP address and browser the request came from, and the time it happened. We use this to run the scan, to show you the result, and to keep the free tool from being abused — for example, capping how many scans one IP address or one domain can run per hour. We do not require a name, an email address, or an account for a Reach scan.
From the browser extension. If you use the Readiness Index browser extension, clicking its icon sends the hostname of the page you are on (for example, www.example.com) to us, and we run the same Reach scan and show you the result in a new tab. We record the hostname, the IP address and browser the request came from, the time, and a short label saying the scan came from the extension and which browser it was (for example, “extension, Chrome”). We use these for the same reasons as above, and to count how the extension is used. The extension does nothing until you click its icon. It never sends the path, query string or content of the page, your browsing history, or anything about your other tabs. It asks your browser for one permission, access to the current tab when you click, and it stores nothing on your device and sets no cookies.
Asking for the full report
The full report crawls more of your site and covers every test in the Index. To send it to you, we ask for your name, company, and email address, and optionally a page on your site you’d like us to weight more heavily. We use this to run the scan, email you the report, and — since you’ve told us you’re interested — to follow up with you once about what we found. We don’t add you to a mailing list, and we don’t sell or rent this information to anyone.
Signing in
Signing in is optional, and its only purpose is letting you save a scan and come back to it later at /dashboard. There’s no password to create and no third-party account required: you give us your email address, we send a unique six-digit code to it, and typing that code back in signs you in. We use WorkOS to generate and check that code and to pass us your email address and a stable account identifier. A signed-in session is kept in one cookie on your own browser; signing out clears it.
Writing to us
The contact form on the About page asks for your name, your email address and a message. We use them to answer you. The message is emailed to our team and kept in our database, so a mail outage cannot lose it, until we have answered and for as long after as the conversation is useful. To tell people from bots, the form uses Cloudflare Turnstile, which sees your browser and your address when you open the page. We send Cloudflare nothing you typed. We don’t add you to a mailing list for writing to us.
Cookies and analytics
We use one cookie to keep you signed in, if you’ve signed in. We also run
Google Tag Manager and Google Analytics to understand which pages get used and
where scans come from — this can set its own cookies, governed by
Google’s own privacy policy. Nothing here is used to build an
advertising profile of you, and we don’t run any ad-retargeting scripts. A scan started
from the browser extension arrives with a source label and campaign parameters
(src, utm_source, utm_medium,
utm_campaign, utm_content and utm_term), so we can
see how people found the tool; they say nothing about you or the page you were on, and
they are the only parts of a page’s address, apart from the page itself, that Google is
sent. The result page is the same page for everyone, so the visitor-recognition described
next applies to people who arrive from the extension too.
On the page that shows the result of a scan, we also use a visitor-recognition service, RB2B. For some visitors it can tell us who they are: a name, a work email address, an employer and a LinkedIn profile. We use that to follow up with people who ran a scan and to see which organizations are using the tool, and for nothing else. If you’d rather we didn’t hold it, email us and we’ll delete what we have.
Who else sees this information
We don’t sell personal information, to anyone, ever. A short list of services we rely on to run this tool, each of which only sees what it needs to do its job:
| Service | What it sees |
|---|---|
| WorkOS | Sends the sign-in code and confirms it. |
| SendGrid | Delivers the mail we send you: a report you asked for, a notice that a scan finished, an invitation to an agency, and — if you are watching a site — the weekly summary and an alert when a score falls. Named because it is the only service that carries our mail. |
| Cloudflare | Answers the Turnstile check on the contact form. It sees your browser and your address, and nothing you type. |
| Slack | A short notification in our internal team channel when a scan finishes, someone asks for a report, or RB2B recognizes who is looking at a result, so a real person notices. TEN7’s own internal tool, not a public or third-party audience. |
| RB2B | Recognizes some visitors on the page that shows a scan’s result and tells us who they are: name, work email, employer, LinkedIn profile. It sees the page you visit and your browser; we send it nothing about you. |
| Fly.io | Hosts the application and the data it stores. |
The browser stores that distribute the extension (Google, Microsoft, Mozilla, Opera and Apple) see who installs it under their own privacy policies; we receive none of that.
We may also disclose information if the law requires it, or to protect the security of this tool or the people using it.
How long we keep it
We keep scan history and contact details for as long as they’re useful to the purpose you gave them for — running the scan, answering your question, or keeping a saved account’s history intact. If you’d like something deleted sooner, email us and we will.
What can you do about it
Email hello@readinessindex.io to ask what we have on file about you, to correct it, or to have it deleted. There’s no separate account to disconnect anywhere else — signing in only ever creates the email code, nothing tied to a third-party account.
You can stop the mail that repeats. The weekly summary and the score-drop alert carry an unsubscribe link, and if you have an account they are a single switch on your profile. The rest — a report you asked for, a notice that your scan finished, an invitation somebody sent you — is not marketing and carries no such link, because switching it off would mean asking for something and never being told it arrived.
Children
This tool isn’t directed at children, and we don’t knowingly collect information from anyone under 13.
Changes to this policy
If this changes in a way that matters, we’ll update the date at the top of this page. We won’t quietly narrow your rights or widen what we collect without saying so here.
The methodology is a separate matter
None of the above applies to the AI Readiness Index methodology itself — the scoring model and the tests are published openly; see licensing. This policy is about the data the running service collects, not about the rubric it’s built on.