Comic pages on a wooden desk. Cheeky works late at a laptop, Peeky studies a website through a brass magnifying glass, the Officer strolls by with a coffee and a doughnut, and Peeky and Cheeky talk it through at a whiteboard.

See what a regulator would see. Before they do.

Peeky reads your public pages the way an auditor would: trackers and cookies, privacy policies, reviews, pricing, accessibility and more. 10+ checks per jurisdiction, with a fix for every finding.

Join now See how it works

What is website compliance? A short story.

Cheeky was building the most modern shop the town had ever seen, and had not yet found the time to walk in through the front door.
Peeky was tagged the moment they stepped inside.Peeky does not like being touched.
There was a hatch marked ‘opt-out’. It had been placed, with great care, where nobody could reach it.
Peeky had said no quite clearly, yet one tag was somehow still on.An eye kept watching.Peeky tried to talk to the store manager, but Cheeky had boxes to carry.
Across town, the Officer was reading his old cases.He remembered every shop, and what each of them had paid.
The next name on his list was Hollowbrook.
It was the torn coat that finally made Cheeky stop.Cheeky: “Show me everything.”The shop looked splendid from the front. Behind every machine, it was another matter.
So Peeky showed Cheeky around Cheeky’s own shop.
This time a small button rose to ask him first. He pressed ‘no’.He waited for something to happen. Nothing did. This made him suspicious.
The eye in the corner was fast asleep.Somebody who could not get in last week was now browsing the shop happily.There was one box left to tick.
He read the whole policy, twice.Everything was in order. The Officer was not used to this.
A month later, Peeky came back with something for the wall.The other shopkeepers saw it, and every one of them wanted the same.The Officer found he had very little left to do in this town.

What Peeky looks at

Every scan is a round of questions about your public pages. Here are eight of them, answered for hollowbrook.app, a site we made up.

hollowbrook.appFirst scan, 3 June 2026. Score 54 of 100.

Of these eight

passed: 3
worth a look: 3
critical: 1
couldn’t be observed: 1

EU-01Cookies and consent
Does anything load before the visitor says yes?
Critical
_ga set 1.25 s after load. Banner not answered yet.
EU-04Privacy policies and notices
Does the privacy policy name who the site talks to?
High
Intercom gets data from /pricing. The policy says “trusted service providers”.
EU-07Data rights
Can a visitor find out how to ask for their data?
Passed
The policy gives privacy@hollowbrook.app and links a request form.
EU-12Reviews, pricing and subscriptions
Does the countdown start again on every visit?
Medium
“Offer ends in 09:59” on three loads, an hour apart.
EU-13Reviews, pricing and subscriptions
Can people see the renewal price before they pay?
Passed
Renewal price and how to cancel sit next to Subscribe.
EU-10Accessibility
Can you get around with a keyboard and a screen reader?
Low
3 icon buttons on /pricing have no name.
US-14Marketing messages
Do the marketing emails say who sent them and how to unsubscribe?
Not observed
No newsletter archive is linked. Peeky doesn’t sign up to find out.
EU-15Connection basics
Is the connection encrypted, with the usual browser protections?
Passed
http redirects to https. Strict-Transport-Security is set.

For information only. Not legal advice.

That’s eight of them. See every check, by jurisdiction.

One finding, three ways to read it

This card is from a sample report on hollowbrook.app. This one’s a cookie. Every other check writes its findings the same three ways.

Critical

ePrivacy · GDPRCookies

Google Analytics sets a cookie before consent

Google Analytics set _ga on https://hollowbrook.app/ 1.25 seconds after the page loaded, before anyone answered the cookie banner. Non-essential cookies need a visitor’s agreement first, and this is one of the first things regulators have checked, because it shows in the network log.

What Peeky saw

GET https://www.google-analytics.com/g/collect?v=2&tid=G-7K2XQ4 204 t+1.25s

Set-Cookie: _ga=GA1.1.6604.1727; Max-Age=63072000; SameSite=Lax

Consent state: banner visible, no interaction

After Reject all: GET https://www.google-analytics.com/g/collect 204

In plain words

In plain words

Google Analytics puts a cookie on your visitors’ browsers before they click “accept cookies”. It’s like a shop signing you up for its loyalty card the moment you walk in, before you’ve said whether you want one. Cookies should load only after a visitor agrees to them. This is usually a setting in your cookie banner.

The fix

Load Google Analytics from your consent tool’s accept callback instead of on page load.
If you use Google tags, set consent mode to “denied” by default.
Re-scan to confirm no request fires before the click.

Ready prompt for your AI coding tool

PeekWell EU-01 (Non-essential trackers firing before consent) observed on hollowbrook.app: Google Analytics sets a cookie before consent.

Find where Google Analytics is loaded (look for _ga-setting scripts in the layout template or tag manager). Move the loader behind the consent tool's accept event, so nothing from Google Analytics runs until the visitor accepts. Keep the session cookie as is. Then test: open hollowbrook.app in a private window, do not touch the banner, and confirm in the network tab that no request goes to Google Analytics; accept, and confirm it loads.

Do not change unrelated behaviour. Summarise the change and how you tested it.

Peeky, magnifying glass in one hand, explaining with the other. — That’s me, Peeky. I read websites for a living.

Small things are found first

Most of what I find is small. An analytics tag that fires too early. A countdown that resets every time you reload. A privacy policy that no longer accounts for your chat widget.

Small things are easy to miss, and websites change constantly. So I look at your site the way a visitor would. I open your public pages, access your members area if you provide a sign-in, interact with your cookie banner, read your linked policies, and check your reviews, prices, sign-up forms and footer.

Then I document what I find, where I found it, and how to fix it. Each finding comes with a practical fix you can hand to your developer or paste into your AI coding tool. What the law makes of it isn’t my call. Your lawyer gets that one.

I only inspect pages and functionality I’m authorised to access. No port scanning, no breaking in, no security testing. PeekWell identifies potential compliance issues; it isn’t a security testing service.

For information only. Not legal advice.

Why it matters at your size

A team of five

For founders and small teams.

You ship most weeks, and a release can bring a new script with it.
The cookie banner, the reviews widget and the countdown were each set up once, on somebody’s free afternoon.
The privacy page was written before the chat widget arrived.
An investor or a big customer may ask about it before you’ve looked.

You get: a fix and a ready prompt for each finding, so the next free afternoon is enough.

A portfolio to watch

For investors, accelerators, grant programmes and public bodies.

You wouldn’t back a company that trips over the first simple check a regulator runs.
With PeekWell you don’t need an audit team of your own to screen every application, deal or grant.
A questionnaire tells you what a founder believes. A scan shows what the website did.
Peeky checks again every month, so you can stop wondering what changed since you signed.

You get: the same checks on every company, written down the same way, and run again every month.

Ask us about Organizations

Compliance monitoring for small and medium companies

PeekWell is for teams that ship fast and want to know what’s wrong on their site and how to fix it before an audit arrives. Then, keep an eye on it periodically to keep making sure they are compliant, without much hassle.

Here’s how different kinds of people use PeekWell

A solo founder
Launching a SaaS in the EU and US without a compliance team or time to read the ePrivacy Directive. The first scan flags two issues: analytics running before users accept cookies, and a payment provider missing from the privacy policy. The founder pastes the fix prompts from PeekWell and implements the suggested fixes that same afternoon. A month later, the next scan confirms the fixes are still holding.
A vibe-coded shop
A family business selling online through its own Shopify shop. The younger sibling built the pages with an AI assistant, pasting in code without knowing the rules. The report tells them in plain words what needs fixing: a countdown that restarts on every visit, reviews no customer wrote, and a cookie banner with no Reject button. Most fixes are a setting in Shopify or a few lines of code to change.
A website agency
They build websites and web services for clients, scanning each one before handover to catch compliance issues before launch. Every site ships clean with a compliance badge in the footer. Monthly monitoring becomes part of the agency’s maintenance plan, while the badge signals to prospective clients that compliance is built into every project.
An investment firm
Dozens of portfolio companies, all shipping fast. A one-off review at signing said they were fine. Six months later, under the pressure of sales and advertisement, two had added trackers that ignore consent and one had created a manipulative checkout process. With Organizations, every company is scanned each month and the firm sees who slipped without chasing anyone.

Questions about your own kind of team? Who it’s for, on the FAQ page.

Five months of Hollowbrook

With Accreditation, Peeky runs every check again each month, and new ones join as the rules change. Your badge shows what the latest scan saw, so customers and investors see this month, not launch day. Step through the months. When the score drops under 70, the badge goes back to “not active” by itself.

PeekWell score One scan a month on hollowbrook.app. The badge is on from 70 up.