What we collect, and what we don’t

Partsgraph provides the agent-ready parts data layer described elsewhere on this site. For anything on this page, including a request to access or delete your data, write to privacy@partsgraph.ai. We are the data controller for the personal data described here.

If you are in the UK or the EU and you are not satisfied with how we have handled a request, you have the right to complain to your data protection regulator — in the UK, the Information Commissioner’s Office.

The grader takes a website address and reports what AI assistants can retrieve from it. It requires no account, no email address and no sign-up, and it does not store the report it produces. When you close the page, the result is gone.

Running a grade causes our servers to request pages from the address you entered, in the same way any visitor or search crawler would. Only publicly reachable pages are requested; we do not log in, do not attempt authentication and do not try to reach anything behind one.

Grade a site you own or have permission to test. The address you enter is processed to produce your report and is not retained afterwards.

The enquiry form collects what you choose to type into it — typically your name, work email, company and a message. We use it to reply to you and, if a conversation follows, to manage that conversation. The lawful basis is our legitimate interest in responding to a business enquiry you initiated.

Submitting the form sends two emails: a notification to us, and a confirmation to the address you gave, so you have a record that it arrived. Both are sent through our email provider (see processors below). We keep enquiry correspondence for as long as the commercial relationship or conversation is live, and then for a reasonable period afterwards for our own records. Ask us to delete it and we will.

By default, no cookies are set. Page-view and performance analytics are served first-party from this domain, set no cookies and do not identify you. They tell us which pages are read and how quickly they load.

Anything that does set a cookie loads only after you accept it in the consent banner. Decline, or ignore the banner, and none of it loads. There is no “essential-only” tracking hiding behind the choice.

Two things sit behind that choice. Google Analytics, which counts page views. And a website-visitor identification tag supplied by Instantly, which does more than count, so it is worth being exact about what it is.

If you accept, that tag attempts to work out which organisation you are visiting from — and in some cases which individual — so that we can follow up a visit we would otherwise never know about. To do that it looks up your IP address for approximate location and checks it against third-party identity networks. It sets its own cookies (_reb2buid, _reb2bsessionID) to recognise you across pages and visits.

The companies involved, named so you can look them up rather than take our word for it: Instantly (the tag), RB2B (the identification), LiveIntent and usbrowserspeed (identity matching), and ip-api (IP geolocation). They act as our processors.

Withdraw consent at any time from the link in the footer — one click, and the tag stops loading on your next page view. To have what was already collected deleted, email hello@partsgraph.ai and we will, without asking why.

Our host records standard request logs, which include IP addresses, for security and reliability. Separately, the grader and the contact form are rate-limited by IP address to stop one caller flooding them. That counter is held in memory for a short window — minutes, not days — and is not written to a database, joined to anything else, or used to identify anyone.

We keep this list short on purpose. Each of these is a processor acting on our instructions, not a party we sell data to.

• Hosting and first-party analyticsServes this site and records standard request logs and cookie-free usage metrics.
• Transactional emailDelivers the enquiry notification and your confirmation email.
• Inbound email forwardingForwards mail sent to any address at this domain to our working inbox.
• Google AnalyticsOnly if you accept it in the consent banner. Otherwise never loaded.
• Demo-catalogue telemetry database (Neon)Stores anonymised agent activity against the demo catalogue and its MCP endpoint — the tool called, the query, a salted hash of the network address (never the address itself), and the client’s stated name. It powers the public demo dashboard and holds no account or contact data.

Some of these providers operate outside the UK and EEA. Where personal data is transferred, it is covered by the safeguards those providers offer — standard contractual clauses or an equivalent adequacy mechanism.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to our processing it. Write to privacy@partsgraph.ai and we will respond within one month. There is nothing to pay, and you do not need to give a reason.

In practice, for most visitors there is nothing to hand over: if you have only read the site or run the grader, we hold no personal data about you at all.

If what the site does changes, this page changes with it and the date at the top moves. We will not quietly broaden what we collect and leave this page describing the old behaviour.