Privacy Policy

Last updated: 2026-09-15

Draft — not yet finalized. This document is a starting point adapted to this platform's actual behavior (credits, refunds, data handling), not a template pasted in unedited. It still needs the operator's finalized business/registration details filled in and a legal review before this is relied on as a binding agreement.

This Privacy Policy explains what personal data SEO Analyzer (operated by ITTechLux — see the Legal Notice for the operator's current legal status) collects, why, and how you can exercise your rights under the GDPR. This is a draft adapted to what the platform actually does — it still needs legal review before going live.

1. What we collect

  • Account data: email address, hashed password, name you provide.
  • Analysis inputs: the URL, keywords, and competitor URLs you submit for analysis, and the crawl/report data generated from them.
  • Third-party account credentials you connect (Google Search Console, Bing Webmaster, CMS publishing targets, chat webhook URLs) — stored encrypted at rest.
  • Billing data: handled by Stripe (see Sub-processors) — we store a Stripe customer reference, not your card details.
  • Usage/security data: login timestamps, IP address, and user-agent for security events (failed logins, password changes) and abuse prevention.

2. Why we process it (legal basis)

  • Contract (Art. 6(1)(b) GDPR): account data and analysis inputs, to provide the service you signed up for.
  • Legitimate interest (Art. 6(1)(f)): security/abuse-prevention logging, product improvement.
  • Consent (Art. 6(1)(a)): optional integrations you explicitly connect (Search Console, chat destinations, CMS publishing).
  • Legal obligation (Art. 6(1)(c)): invoicing/tax records.

3. Sub-processors

Data is shared with the following categories of processor, only as needed to run the service:

  • Payments: Stripe (billing, subscriptions, tax calculation).
  • LLM provider(s): analysis text (page content, keywords) is sent to the configured LLM provider to generate report content. [PLACEHOLDER: name the specific provider(s) in production use — this varies by deployment configuration.]
  • Email delivery: our SMTP provider, for verification and transactional email. [PLACEHOLDER: name the specific provider.]
  • Hosting/infrastructure: [PLACEHOLDER: name the VPS/hosting provider].

4. Retention

Account and report data is kept for as long as your account is active. Reports and their underlying crawl data are retained [PLACEHOLDER: confirm actual retention period/policy]. Security event logs are retained for [PLACEHOLDER: confirm retention period]. Deleting your account (see below) purges your data.

5. Your rights

Under GDPR you can access, export, correct, or delete your personal data, and object to or restrict certain processing. You can do this yourself, without contacting us, from your account:

  • Export — Account settings → Privacy → Export my data (a downloadable zip of your account data).
  • Delete — Account settings → Privacy → Delete my account (permanently removes your data; requires password/2FA confirmation).

You can also contact hello@seoanalyzer.app for any request, or to lodge a question before filing a complaint with a supervisory authority (in Luxembourg: the CNPD).

6. Cookies

This site uses only strictly-necessary cookies (session/authentication) — no analytics or advertising cookies, so no cookie consent banner is shown. [PLACEHOLDER: update this section and add a consent banner if non-essential cookies/analytics are added later.]