Privacy Policy

• Google account basics when you sign in with Google: your name, email address and profile picture. We use them to identify you, decide whether your account has beta access, and show who is signed in.
• Beta requests: your verified name and email plus anything you type in the request form (agency name, website, number of client sites, a note).
• Client sites you add: domain, business name, location, industry, the buyer questions and competitors you choose to track, and buyer-profile answers you or your client provide.
• Google Search Console data, only if you click “Connect Search Console” (see section 3).
• White-label settings: agency name, logo and colors used on client reports.
• Basic technical data: server logs (IP address, browser, pages requested, errors) kept by our hosting provider for security and debugging.

We do not collect payment card numbers. If paid plans launch, payments will be handled by a payment processor and this policy will be updated first.

Our crawler visits the publicly accessible pages of the sites you add, the same pages any visitor or search engine can see. We do not log in, submit forms or access anything behind a password. We also fetch pages the way known AI crawlers (for example GPTBot or ClaudeBot) would, to check whether they are blocked.

To measure AI recommendations, we send buyer-style questions (which never include personal data) to AI assistants such as ChatGPT, Claude and Gemini through third-party APIs, and store their answers and cited sources.

Search Console access is separate from sign-in and optional. It is requested only when you click “Connect Search Console” for a client site, and it asks for one permission: read-only access to Search Console (webmasters.readonly). We cannot change anything in your Search Console account.

What we access: the list of Search Console properties your Google account can see, and search performance data (clicks, impressions, click-through rate, average position, by search query and by page) for the property that matches the client site.

How we use it: only to show you that client site's search performance inside AuditCrawl and in the reports you choose to send that client, for example which searches bring visits and which pages sit on Google's second page.

How we store it: the access token Google issues is encrypted (AES-256-GCM) and stored in a secure, httpOnly cookie in your browser. When we add server-side storage it will be encrypted at rest the same way. Search performance numbers are fetched when you view them.

Sharing: we do not sell Google user data, use it for advertising, or share it with anyone except the service providers needed to run AuditCrawl (section 5), when you direct us to (a report you send to your client), or when the law requires it. Humans at AuditCrawl do not read it unless you ask us to for support, it is needed for security, or the law requires it.

AI models: we do not use Google user data to develop, improve or train generalized AI or machine-learning models.

Limited Use: AuditCrawl's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting: click “Disconnect” in AuditCrawl, which revokes our access at Google immediately, or remove AuditCrawl at myaccount.google.com/permissions.

• To run the service: crawls, AI checks, scores, suggestions and reports.
• To send email you asked for: beta-request confirmations, alerts and scheduled reports.
• To keep the service secure and fix problems.
• To improve the product using aggregate, non-identifying usage patterns.

We do not sell or rent personal data, and we do not use it for advertising.

These companies process data on our behalf, only to provide their part of the service:

• Vercel: hosting and server logs.
• Google: sign-in, and Search Console data if you connect it.
• Resend: sending email.
• DataForSEO: search rankings and AI-assistant answers to buyer questions.
• AI providers (such as Groq, OpenAI, Anthropic and Google, directly or through an API aggregator): analyzing public page content and answering buyer questions. They receive public website content and buyer questions, not your Google data.

We use only the cookies the service needs: a sign-in session cookie, a short-lived cookie that protects the Google connection step, the encrypted Search Console cookie described above, and one that remembers you already requested beta access. Some screens save your progress (onboarding checklist, action-plan status) in your browser's local storage. No advertising or cross-site tracking cookies.

We keep account and client-site data while your account is active, and delete it within 30 days of your request or of account closure, except where we must keep records for legal or accounting reasons. Search Console data is not stored by us beyond what is shown to you and included in reports you send. Server logs are kept by our host for a limited period.

You can ask us to access, correct, export or delete your personal data, or object to how we use it. Depending on where you live (for example the EU, UK or California) you may have additional rights; we honor these requests for everyone. Email us and we'll respond within 30 days.

Traffic is encrypted with HTTPS, Google tokens are encrypted, and access to production systems is limited. No system is perfectly secure; if a breach affects your data we will tell you promptly.

AuditCrawl is a business tool and isn't meant for anyone under 16. We don't knowingly collect their data.

If we change this policy we'll update the date above, and for material changes we'll email account holders before they take effect.

Questions or requests: privacy@auditcrawl.com.