Privacy policy

Who we are

[To be completed: the legal entity that controls your data, its address, and a contact for privacy questions.]

What we collect

• Your account: your email address, how you sign in (password or Google), your display name if you set one, your language choices and your email preferences.
• Your website: its address, its language, a short description of your business (suggested from your home page, and you can edit it) and the settings you choose.
• Search Console data for your property: the search queries, clicks, impressions and positions that Google reports. Our access is read-only.
• Your public pages: the titles, text and other page data our crawler reads during a scan.
• Public pages of other websites (backlink monitoring, Pro and Extra): the address of a page on another site that links to your website, the link text and whether the link is followed. We keep only the links to tracked websites, not the content of those pages.
• WordPress access: your WordPress user name and the Application Password, which we keep encrypted and bound to your website.
• What we do for you: scan results, every change with its before and after, post suggestions and your decisions about them.
• Records: your consent to these documents and to automatic fixes (with the version of the text and the time), sign-in times, a log of actions in your account (without email addresses) and email delivery records.
• Abuse prevention: a one-way hash of your IP address, used to limit repeated sign-up and password-reset requests.

Why we use it

To run the service you asked for (scans, fixes, posts and reports), to send you service, security and report emails, to keep the service and your account secure, to prevent abuse and repeated free trials, and to meet legal obligations. We do not sell your data and do not use it for advertising. [To be completed: the legal basis for each purpose.]

Who else handles it

These providers help us run the service. Each receives only what its part of the work needs.

• Google Cloud and Firebase: hosting, database, sign-in, processing, file storage and secret storage.
• Google Search Console API: your search data, read-only.
• Google Gemini: reviews proposed fixes, drafts posts and content ideas, and writes image descriptions. It can receive your Search Console queries, page titles, short excerpts of your pages and post drafts. For backlink monitoring it also searches the web for pages that may link to your website, and then receives your website’s address, your brand name and the competitor sites you name. [To be confirmed by the owner: the paid service tier and its terms on how Google may use this content.]
• Anthropic (Claude): analyzes scans and proposes fixes, only when it is enabled. It can receive page titles, descriptions and short excerpts.
• Atlas Cloud: creates post images. It receives only the written description of the image.
• An email provider, to be named before launch: your email address and the messages we send you.
• Google reCAPTCHA: protects the sign-up form from automated abuse.
• SerpApi and DataForSEO: off by default, and used only if our team switches them on for your website.

[To be completed with the owner’s lawyer: the statement required by the Google API Services User Data Policy (Limited Use), and whether it limits sending Search Console data to AI providers.]

Where it is processed

Our providers process data in several countries, which may include countries outside Israel and the European Economic Area. [To be completed: the safeguards for these transfers.]

How long we keep it

• Your account and website data: for as long as your account exists.
• When a trial ends without a plan, or an account is suspended: automation stops, the encrypted Application Password is deleted after 30 days, and the rest is kept for 12 months. [To be completed by the owner: what happens after those 12 months.]
• Weekly report files: 60 days. Data export files: 30 days.
• Sign-up requests that were never completed: 1 hour.
• Email delivery records: 30 days; the recipient address is removed from them after 7 days.
• The log of actions in your account: 400 days, without email addresses.
• Records of your consent: 7 years. [To be confirmed by the owner’s lawyer.]
• A one-way fingerprint of your domain and of your email address: 24 months after your trial, so that free trials cannot be repeated. It cannot be turned back into the address, and it is not removed when you delete your account.
• Backups, and the providers listed above, keep copies under their own retention rules. We cannot delete those copies directly. If a backup is ever restored, we delete again any account that had been deleted.

Your choices and rights

• Export your data from the app. The export does not include passwords or credentials.
• Delete your account from the app. Before you delete it, you can choose to return the pages we published to draft and to undo all automatic changes. Deleting your account does not take any page of your website down by itself.
• We delete our encrypted copy of your Application Password, but only you can revoke it in WordPress, and only you can remove our service address from your Search Console property.
• Turn the Monday report and the suggestion emails off in Settings. Security and service messages are always sent.

[To be completed: your other rights under the applicable law and how to exercise them.]

Cookies and storage

We use no analytics or advertising cookies. See cookies and storage.

Security

Application Passwords are encrypted and bound to your website, each account’s data is kept apart from every other account, our Search Console access is read-only, and every change to your website is recorded. No system is perfectly secure. [To be completed: how and when we notify you of a security incident.]

Children

The service is meant for businesses and adults, not for children. [To be completed: the minimum age.]

Changes to this policy

We will tell you in the app or by email before a significant change applies to you.

Contact

Use the contact page.