To run the check, the website address you type is sent to my server, which reads that site's public login page. The result is kept for 30 minutes so a reload doesn't check again, and isn't stored after that.
Asking for the emails sends me your email address, the website's address and what the check found: its Statamic and PHP versions, its addons, how many updates behind it is and whether that version has known security vulnerabilities. I also record your IP address and the time you signed up, so there's a record that you asked for the emails.
I use an email service called MailerLite, which sends the emails.
I use your email only to send you what the check means for your website and a few emails about Statamic and my maintenance service. I don't share your email with anyone else.
Every email has an unsubscribe link.
To see what I hold or have it deleted, email hello@d3creative.uk.