Privacy notice

Who we are

MEO Advisors ("MEO", "we", "us") runs the free instant CX audit. We are based in New York, NY, USA, and work remotely. Questions about this notice go to hello@meoadvisors.com.

This notice covers the instant audit at /audit and its pages. MEO's main website, including the request form at meoadvisors.com/schedule/, has its own privacy notice.

What the instant audit does

You give us a business website or a business name. We read that business's public web pages, check its public Google listing and measure its site speed. We show you what we found, with the source and date of each finding. The website check does not submit a form, start a chat conversation, send a message or place a call. An optional phone test requires a separate agreement.

What we collect

• What you enter. The website address or business name you type. If you search by name, we also keep the business you pick from the list.
• Name-search candidates. A name search returns up to five possible matches, each with a display name, address, website and listing ID. We keep these for at most 15 minutes, then delete them. Once you pick one, we keep that listing’s ID and permitted match facts. The business name you submitted remains part of the website-check record; candidate expiry does not delete it.
• Public business evidence. Facts about the audited business's public website: whether it publishes a phone number, email address, hours, contact form, chat, booking link or text option; how many clicks it takes to reach them; required form fields; whether a CAPTCHA is present; automated accessibility results; and screenshots of the pages we checked, at desktop and mobile sizes. We retain normalized phone numbers found on public website pages and can show them in the public report. Website number-comparison facts also use one-way hashes. Public page text and structure may also be processed while finding and checking pages; screenshots and structured findings are stored. This is different from an optional phone test, which stores the number you enter in readable form as well as its comparison hash.
• Listing and speed facts. Whether the business's Google listing was found, and whether its phone number, website and hours match the website. We compare the listing's details and then discard them, keeping only the match results. We also keep site-speed scores from Google PageSpeed Insights.
• Security records. To enforce usage limits and stop abuse, we turn your IP address and its network block into salted, one-way hashes. We store only the hashes, never the address itself. We also log refused requests as a reason code, the two hashes and a time. The human check (ALTCHA) runs on our own servers. It stores only a hash of each challenge, so each one works only once. The hashes expire after 10 minutes and are cleared soon after.
• Cookies. See "Cookies" below.
• If you ask us to discuss your audit. Your name, work email, optional note, the exact requested audit and your required Terms/Privacy acknowledgement, including its wording, version and submission time. Each visitor uses their own details and sees only their own receipt through a separate private browser capability. The current contact form collects no company, referral source, mobile number or SMS consent. Historical contact records and optional SMS consent proof remain separate and unchanged.
• If you use our full-audit request form. The legacy contact-snapshot form at /audit/full remains separate from the free audit and its contact request. It asks for the business name and phone number, your name, your work email, state, city and business type, plus a separate contact-snapshot agreement for one AI call and one contact-form inquiry. This legacy route does not commission a paid full audit.

What we don't collect

An ordinary website check does not require your name, email or phone number. The optional phone test collects your name, business email, state, authorized phone number, agreement version and time, and records of the request, call and service emails. It does not use analytics, advertising or tracking scripts. Our pages do not embed third-party advertising or analytics. Separate server-side providers can process public website content and phone-test data as described below. It does not ask for health information. Please don't enter patient details or other personal health information anywhere on the service.

Cookies

We use only cookies the service needs to work:

• A session cookie that connects your browser to its unfinished audit and existing owner-only actions. Completed retained reports and PDFs do not require this cookie to read. We store only a hash of its value. It expires within 30 days at most.
• A separate contact cookie identifies your own contact submissions and receipts. It lasts no more than 24 hours or the remaining report lifetime, whichever is shorter. We store only a hash of its secret. Reading a public report does not create contact authority or reveal another visitor’s receipt.
• A scope-review cookie binds the reviewed website and optional matching domain to this browser. It lasts 10 minutes and is replaced when you review changes. The optional domain email is used only to check the match; the part before @ is discarded, with no verification email. Matching does not prove ownership or authorize contact.
• A short-lived security cookie that protects our forms against cross-site request forgery. It lasts 10 minutes.

These cookies are first-party and HTTP-only, and they are sent only to this site. We set no advertising, analytics or cross-site cookies. Because these cookies are strictly necessary, we don't show a cookie banner.

Why we use information

• To run the audit you asked for and show you the results.
• To publish completed retained reports and PDFs at their report URLs and validate any legacy share tokens.
• To reuse a recent result. If anyone audits the same site within 24 hours of a finished audit, they see that result with its original dates instead of a new crawl.
• To protect the service: rate limits, the human check, blocking misuse and keeping costs under control.
• To notify Josh and Hunter about each audit outcome and any optional contact request, and to answer the follow-up you request. The contact form starts no additional audit, call, inquiry or customer confirmation email. Legacy contact-snapshot requests follow their separate agreement.
• To run and improve the service, using counts and timings that don't identify anyone.

We don't use the instant audit to build profiles of visitors, and we don't use it for automated decisions about people.

Service providers

We use these providers for the purposes below. Some features are conditional; not every provider is used on every run:

• Railway hosts the service, database and evidence storage. Evidence is stored in private object storage. Railway's network carries your connection to us and may process connection data, such as IP addresses, under its own terms. Our own application doesn't keep a request log of visitor IP addresses.
• Google PageSpeed Insights receives the audited website's address. Google then loads that website to measure its speed. Google receives no information about you.
• DataForSEO receives the business name you typed (for a name search) or the audited business's listing ID or domain (for the listing check). It receives no information about you.
• Anthropic may help navigate public pages and prepare a phone-test brief. Navigation can receive public page text, structure and screenshots with input areas masked; the brief generator receives de-identified page extracts. It may also interpret phone menus using de-identified text. When model analysis is enabled, Anthropic and xAI analyze de-identified phone-test transcript, question and reference information to assess the answer.
• Telnyx, LiveKit and Deepgram support call routing, live voice, speech recognition and synthesis, and recording. When enabled, xAI/Grok processes audio and call context for the AI conversation. Live audio reaches these voice services before any later stored-transcript de-identification.
• Telnyx and the US Census geocoder may receive the number or listed business address for line-type and business-location safety checks.
• Resend delivers phone-test confirmation and result or failure emails, including a private recording link when available. It also delivers contact-snapshot verification and delivery emails. These service emails do not sign you up for general marketing. It sends each terminal audit outcome to jgold@meoadvisors.com and hmefford@meoadvisors.com, including the requested business, outcome and retained original website-only result when available. An optional contact request sends those same recipients your own name, work email, optional note and Terms/Privacy acknowledgement linked to that exact audit. Historical contact notices retain their original acknowledgement and optional SMS evidence. It does not email a confirmation to you or send a text. Legacy contact-snapshot requests retain their separate verification email.

The human check is self-hosted, so no human-check data goes to a third party.

Sharing

We do not sell personal information. We do not share it for cross-context behavioral advertising. We don't let third parties collect information about your activity on this service across other websites.

We publish the limited public report described below. We share private visitor information only with the service providers above, when the law requires it, to protect the service or other people from harm, or as part of a merger or sale of MEO's business, under this notice.

Results and share links

Completed retained reports and their PDFs are public at the report URL. Anyone with that URL can read them without a browser session or a separate share link. Unfinished and failed audit pages remain private to the requesting browser; missing or expired reports are unavailable. The public report includes website findings, published business phone numbers and any safe summary and masked number from a phone test requested for that report. It excludes visitor contact details, private notes and receipts, consent records, full phone-test numbers, recordings and recording links. Reading a report grants no authority to act for another visitor. Public report pages are marked so search engines don't index them; this does not make them private.

Legacy share tokens still work only while active and retained. We store only their hashes and cannot recover a lost token. Revoking or expiring a legacy share token stops only that token; it does not remove access through the public report URL or other active tokens, and does not recall downloaded reports or a recording link already emailed. The public report's copy control copies its canonical URL and does not create or revoke a token. You can contact us about a legacy token or report access.

Optional phone-test records and recording links

The recording link is sent to the email entered for the phone test. Anyone holding that private link can use it until it expires after 15 minutes. A recording may be unavailable; link expiry does not delete a recording.

We keep the phone recording with no time limit. Its separate request record, including your details, consent, call brief and result, has no automatic deletion date in the current service and can remain after the website result is deleted. The website periods below do not apply to these phone-test records.

How long we keep website information

• Screenshots and other raw evidence: set by configuration.
• Audit results and share links: 548 days (about 18 months).
• Hashed IP addresses and abuse records: set by configuration.
• Name-search candidates: 15 minutes at most.
• Human-check challenge hashes: expire after 10 minutes and are cleared soon after.
• Contact requests and consent proof: retained for requested follow-up and business records, separately from website-result expiry; no fixed deletion period is promised. The contact and immutable acknowledgement/SMS proof can remain after the report is deleted. Staff notice audit context, original website-only result and prepared message content expire with either the requested or source run. Content-free delivery evidence can remain. Legacy lead and contact-snapshot records retain their separate rules. You can ask about deletion.
• Crawler opt-outs: the blocked domain stays blocked until the site owner asks us to remove it. The hashed address of the person who opted out follows the configured-day window.

Most windows start when the audit finishes. The hashed-IP window starts when the audit starts. Scheduled deletion runs: every 15 minutes for records, and daily for stored evidence. Deletion retains content-free counts and receipts. Separate lead records, spend records and crawler opt-outs can remain; these windows are not an all-records deletion promise.

Security

We keep the service's data in private storage with restricted access. Connections use HTTPS. The service uses narrow database functions: completed retained reports have a public, limited projection; unfinished audits and private actions require their own session or capability. Public report access does not expose another visitor’s contact details, consent or audio. For ordinary website checks, session tokens, share tokens, visitor-address security records and challenge values are stored as hashes. A contact snapshot separately retains its agreement evidence, which can include the requester’s client address. No system is perfectly secure, so please contact us if you think something is wrong.

Your choices and rights

You can withdraw a pending phone test before the call starts using the confirmation email’s link. Once the call starts, that link cannot stop it. Withdrawal does not delete the consent record or an already completed recording. For questions about retained information or a deletion request, email hello@meoadvisors.com. Do not send a recording link or health information.

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising. Wherever you live, you can ask us to:

• ask about deleting or correcting a contact request or legacy request;
• ask about revoking a legacy share token or removing a public report; token revocation alone does not remove the public report;
• tell you what we hold about you.

Email hello@meoadvisors.com with the subject "Instant audit privacy". Tell us the email address you used, or the audited website and the approximate date. Please don't send a share link or health information in your request.

We'll confirm your request and may ask for details that show the request is yours. For example, we may send a confirmation to the email address on the request. We respond within 45 days. If we need more time, we'll tell you why. For anonymous audits we hold only hashed addresses and no name or email, so we usually can't link an audit to a person. In that case we'll tell you so. You can name an authorized agent to act for you, and we may ask for proof that you authorized them. We won't treat you differently for using any of these rights. If we decline a request, we'll tell you why and how to appeal by replying to our decision.

Site owners: opting out of the crawler

Our crawler identifies itself as MEOAuditBot. Ordinary checks follow robots.txt, including rules for all crawlers. A matching business-email domain can allow an override for that run and domain only. Matching is not ownership verification and never removes a crawler opt-out. The website crawler never logs in, changes identity to evade a block, solves a CAPTCHA or bot challenge, or submits a form. To stop future instant audits of your domain, use the opt-out form at /audit/crawler or use robots.txt to restrict ordinary crawls. A robots override does not remove a crawler opt-out. To ask us to delete existing results about your business, or to correct one, email hello@meoadvisors.com.

Children

The instant audit is a business tool. It is not directed at children under 13, and we don't knowingly collect personal information from them. If you think a child has given us personal information, email us and we'll delete it.

Visitors outside the United States

The service is operated from the United States and is designed to audit US businesses. Name search covers US listings only. If you use it from elsewhere, your information is processed in the United States. Where the EU or UK GDPR applies, we rely on our legitimate interests to provide the tool you asked for and to keep it secure. For contact requests, we rely on taking the follow-up steps you asked for. The current contact form collects no SMS consent. Historical optional SMS consent remains separate and does not enable delivery in this service. You can object, or ask about your rights, at hello@meoadvisors.com. You may also complain to your local data protection authority.

Do Not Track and Global Privacy Control

We don't track visitors across websites, and we don't sell or share personal information for advertising. A Do Not Track or Global Privacy Control signal therefore changes nothing here. The service works the same way with or without one.

Changes to this notice

If we change this notice, we'll update the effective date at the top. If a change materially affects how we use information we already hold, we'll say so on this page before the change takes effect.

Contact

MEO Advisors, New York, NY, USA
hello@meoadvisors.com