Privacy Policy

The data controller is SeoCheckPilot ([FILL IN: legal form, e.g. sole proprietorship / GmbH / Ltd]), [FILL IN: street and number, postcode and city], [FILL IN: country]. Contact: [email protected]. Full operator details are in the Impressum.

When you use tools without an account

• URLs you submit — processed to run the requested audit or scan.
• Client identifier — a random ID stored in your browser (after cookie consent) and sent as X-Client-Id to enforce fair-use quotas and prevent abuse.
• Server logs — IP address, timestamp, request path, and user agent (up to 14 days).

When you create an account

• Account data — name, email address, password (stored hashed), email verification status, and session tokens.
• Projects & scans — domains, scan results, monitors, and alert settings you save to your workspace.
• Billing data — subscription plan and status. Payment card details are processed by Stripe; we do not store full card numbers.

When you use the Chrome extension (once available)

• Page data — the extension reads the page you open it on in your browser. Only Performance-tab checks send that page's URL to our servers, linked to your account.

• Contract — providing the service you request, including account features and paid plans.
• Legitimate interests — security, fraud prevention, quota enforcement, improving reliability, and usage statistics without an identifier (Nordtally).
• Consent — optional functional storage (theme, local history, service worker), Google Analytics, the Nordtally visitor cookie, and the support chat widget. You can withdraw consent anytime via Cookie preferences in the footer.
• Legal obligation — where required for tax, accounting, or lawful requests.

• Run website and AI visibility analyses you request
• Authenticate users and manage subscriptions
• Send transactional email (verification, password reset, billing notices)
• Briefly cache AI-generated answers and suggestions (up to one hour) so repeated requests don't trigger new paid AI calls; SEO audits themselves are not cached and always fetch the page live
• Detect abuse and protect our infrastructure

We do not sell your personal data and we do not use it for third-party advertising.

We use the providers below. The sub-processors page lists each one with its purpose, the data it receives, its location and when it is used.

• AI providers — Perplexity, Tavily, OpenAI, Google (Gemini) and Anthropic receive prompts containing your brand, domain and keywords during AI visibility scans. DeepSeek receives extracted page content or keywords for AI fix suggestions, keyword tools and mention sentiment.
• Stripe — payment processing and subscription management (Stripe Privacy Policy).
• Resend — transactional email (verification, password reset, billing notices).
• Google — optional Sign in with Google, and Google Analytics if you consent to analytics.
• Nordtally — usage statistics, hosted in the EU (Hetzner, Helsinki). It records pages viewed, referrer, browser, device and country; the features you use (tool runs, sign-ups, checkouts, plan changes, with timings and success or failure); how you interact with pages (buttons and links clicked, forms submitted, scroll depth, time on page, text copied, page performance and script errors); and payment amounts for completed purchases. It never receives what you type into forms, the text you copy, or your name or email. Your IP address and browser are used briefly to derive country and device and are not stored. Without analytics consent you are counted with no identifier; with it, Nordtally sets one first-party cookie with a random ID so return visits can be recognised.
• Vanoy (support chat) — loaded only if you accept the Support chat category. May set cookies on their domain.
• Infrastructure — our hosting provider and Cloudflare (CDN and DDoS protection).

We use no advertising trackers. On your first visit you will see a consent banner with Accept all, Necessary only, or Customize options. Nothing optional loads until you choose. Nordtally counts visits and feature use for everyone, but stores nothing on your device unless you allow Analytics.

• Strictly necessary — consent record, authentication session, client ID for quotas, and security-related data.
• Functional (optional) — theme preference, local scan history, onboarding state, and service worker offline cache.
• Support chat (optional) — third-party chat widget scripts and any cookies they set.
• Analytics (optional) — Google Analytics and its cookies (_ga), and Nordtally's first-party visitor cookie, to see which pages and features are used and recognise return visits. Withdrawing consent stops Google Analytics and removes both sets of cookies.

Use the Cookie preferences link in the site footer to change your choices at any time. Withdrawing functional consent clears optional local data on your device.

• Account data — until you delete your account
• Scan history — kept until you clear it from the History page or delete your account
• AI answer cache — up to one hour
• Server logs — up to 14 days
• Stripe records — retained per Stripe and legal requirements

Connections use HTTPS. Passwords are hashed. Our analysis pipeline includes SSRF protections. No system is 100% secure; please use a strong unique password and keep your session token private. See the Security & Data Handling page for a detailed breakdown of what a scan collects and how it's protected.

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Rectify inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability
• Withdraw consent for optional processing
• Lodge a complaint with your supervisory authority

Signed-in users can delete their account from the Account page (cancel any active subscription first). For other requests, email [email protected].

Our processors may process data in countries outside your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

If SEOCheckPilot or its business is sold or merged, personal data may be transferred to the new owner so they can keep providing the Service under this policy. We will tell you before that happens, and you can delete your account at any time.

SEOCheckPilot is not directed at children under 16. We do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data and we will delete it.

We may update this policy. The "Last updated" date reflects the current version. Material changes will be highlighted on this page.

Questions about privacy or data protection: [email protected]