SEO Auditor privacy notice
SEO Auditor crawls the public pages of a website you name, audits them and gives you a scored report. This document sets out what it fetches, what it keeps, who can see it, where it is held, how long it stays, and what you can require us to do about it.
If a sentence here is vague, email seo-privacy@muslimspot.com and we will correct it.
- In effect from
- Last reviewed
- Questions to
- seo-privacy@muslimspot.com
Who is responsible for your data
MuslimSpot is the data controller for everything described here. We decide what SEO Auditor collects and why, and we are the people you hold responsible for it.
We do not have a statutory Data Protection Officer, because we are not of a size or type that requires one. Privacy questions go to a person, not a department: seo-privacy@muslimspot.com.
What it fetches from websites, first, because that is what it does
SEO Auditor fetches the public pages of whichever website you ask it to audit. That is the main thing the product does, and it is the part that reaches beyond your own account.
What is fetched
The pages of the website you named, together with its robots.txt and sitemap, and the images and scripts those pages load, as a browser would. If you approve a list of competing websites for comparison, their public pages can be fetched too.
What happens to it
The pages are checked and the findings are turned into scores, a list of suggested fixes and a report. The findings and the reports are stored in your workspace. If a page contains personal data, such as a name and e-mail address on a contact page, that can appear in the findings in the same way it appears on the public page.
Who can see the results
- You, and the people in your workspace.
- Nobody outside that workspace. Not other customers, not other workspaces, and not any third party in the list below beyond what that row says they receive.
- Us, only when it is necessary to operate the service or fix it, for example when an audit has failed and we need to see why. Our staff administer workspaces and plans through a separate back office that only they can sign in to.
If the website is not yours
Audit websites you are responsible for, or have been asked to audit. The owner of the audited website is not our customer and has not agreed to anything here, which is one reason we keep what is fetched to public pages.
Everything SEO Auditor collects, and why
That is the complete list. Nothing is collected “for product improvement” beyond what is here.
| What | Why | Lawful basis |
|---|---|---|
| Your name and e-mail address, what is needed to sign you in, and your workspace membership and role. If you use Sign in with Google, the name and e-mail address Google returns to us. | To give you an account, let you sign in, and decide what you are allowed to see. | Performance of our contract with you. |
| The websites you audit, the competing websites you approve, your audit settings and schedule, and every audit’s findings, scores and reports. | This is the product. It is the record you came for. | Performance of our contract with you. |
| Your plan, and a reference to your customer record at Stripe. Card details are held by Stripe, not by us. | To bill you for the plan you chose and to let you change or cancel it. | Performance of our contract with you. |
| A count of what each workspace has used this month. | To apply the limits of the plan you are on. | Performance of our contract with you. |
| E-mail we send you: invitations to a workspace and notices that a report is ready. | To tell you about things you or your workspace started. | Performance of our contract with you. |
| Request logs: your IP address, the time, what was requested, and your browser version. | Security, and finding the cause of a fault. | Our legitimate interest in keeping the service secure and available. |
What SEO Auditor does not do
- It does not change or publish anything on the websites it audits. It suggests what to change, and making the change is up to you.
- It makes no automated decision about you with a legal or significant effect. The scores are about websites, not people.
Where your data is stored
On a single server that we own and administer, in a data centre in Lauterbourg, France, inside the European Union. The database and the report files are both on that machine. There is no second region, no content delivery network in front of your data and no cloud provider holding it.
Connections to it are encrypted in transit with TLS. The database is not reachable from the internet. Application mail, such as an invitation or a report notice, is sent by our own mail server on the same machine.
We take a backup every night to a private object storage bucket so that a disk failure is recoverable. That copy is one of the places your data leaves our machine, and it is why Cloudflare appears in the list below. The others are the services an audit stage asks, each listed with what it receives.
The third parties involved, all of them
Six, and these are the only ones. If we add another, this table changes before it happens.
| Who | What they do for us | What they can see | Where |
|---|---|---|---|
| Contabo GmbH | Owns the data centre and the physical machine our server runs on. They have physical custody of the disks. They are not given access to the application or the database. | Everything on the machine, in the sense that whoever holds the hardware could in principle reach it. Nothing is handed to them. | Lauterbourg, France (European Union) |
| Cloudflare, Inc. (R2 object storage) | Holds the nightly off-box backup, so that a failure of our machine is recoverable. The bucket is private and is not readable without our keys. | A copy of each product's database and stored files, including TimeTracer screenshots, SEO Auditor reports and the CRM's database, uploaded files and document search index, as they exist at the time of the nightly run. | Cloudflare's own network. The bucket is created with Cloudflare's automatic region selection, so we cannot state that every copy stays inside the EEA. Outside the EEA. |
| Stripe (Stripe, Inc. and its affiliates) | Takes payment: the checkout page, the billing portal where you change or cancel a plan, and the card details. Card numbers are entered on Stripe's pages and do not pass through our server. In CRM, Stripe also carries the payments your own customers make on your quotes, invoices and website, either through a Stripe account you connect or through ours. Card payments in CRM are not yet switched on in production. | Your name, e-mail address, billing address and payment details, and which plan you are paying for. In CRM, your customers' names, e-mail addresses and what they paid for. | United States and other locations in Stripe's network. Outside the EEA. |
| Google (Google LLC and Google Ireland Limited) | In SEO Auditor, four services. Sign in with Google, if you choose it. PageSpeed Insights, which measures how fast an audited page loads. Programmable Search, used to look up search results during an audit. Gemini, which turns an audit's findings into recommended fixes. In CRM, Gmail and Google Calendar when you connect them with the permission you grant, and Gemini, which turns the documents you upload to a knowledge base into the numbers the AI assistants search by. | For sign-in and connected accounts, the fact that you are connecting, and Google returns your name and e-mail address to us and, for a connected mailbox or calendar, its contents. For the audit services, the addresses of the pages being audited, search terms, and the audit's findings about the website. For Gemini in CRM, the text of the documents you upload. | United States and other locations in Google's network. Outside the EEA. |
| SE Ranking | Supplies backlink and keyword data about the website being audited. | The domain being audited, the competitor domains you approve, and the keywords being researched. No account details. | Not yet confirmed, so treated here as outside the EEA. Outside the EEA. |
| Cloro | Checks whether AI assistants mention the website being audited. | The website's name and domain, and the questions put to the assistants about it. No account details. | Not yet confirmed, so treated here as outside the EEA. Outside the EEA. |
Data leaving the European Economic Area
Five of the six may process data outside the EEA. Where that happens we rely on the European Commission’s Standard Contractual Clauses as incorporated into each provider’s data processing terms.
What we do not use
- No analytics on this website.
- No advertising network, advertising pixel or conversion tracking.
- No third-party fonts. Both typefaces are served from our own server.
- No session recording, heatmaps or chat widget.
- No cookies, which is why there is no cookie banner.
- No selling or sharing of personal data.
How long we keep it
Two clocks run on everything, the live system and the backups. A deletion is immediate on the live system and takes a known number of weeks to clear the backups. Both are set out below.
In the live system
- Reports: twelve months from when they were made, unless you or your workspace delete them sooner.
- The audit engine’s run records: the step-by-step record of how each audit ran is purged after thirty days. The findings and scores it produced stay with the audit.
- Websites, audits, scores and settings: kept while the account exists, because they are the record the product is for.
- Account details: kept while the account exists.
- Request logs: kept on the server only as long as they are useful for security review, and rotated off. They are not copied into the off-box backup.
In the backups
The off-box backup keeps fourteen daily copies and eight weekly copies. Anything removed by a nightly sync is also parked in a separate area for fourteen days, so that a mistaken deletion on our side is recoverable.
In practice something you delete today stops being visible in the product immediately, and the last backup copy of it ages out in about ten weeks.
When you close your account
Tell us and we delete your account, your audits and your reports from the live system within thirty days. Backup copies then age out on the schedule above.
Your rights under the GDPR
Because our server is in France and we are offering a service to people in the European Union, the General Data Protection Regulation applies. You have these rights, and exercising them is free and does not require a reason:
- Access. Ask what we hold about you and get a copy.
- Rectification. Have anything inaccurate corrected.
- Erasure. Have it deleted, subject to the backup schedule described above and to anything we are legally required to keep.
- Restriction. Ask us to stop processing it while a dispute about it is resolved.
- Portability. Get your data in a machine-readable form, or have it sent to somebody else.
- Objection. Object to processing we are doing on the basis of a legitimate interest.
A note if your workspace belongs to someone else
Where an employer or an agency set up the workspace, they decide which websites are audited and who can see the results. You can still ask us directly and we will help, and we will also tell them you asked.
If your website was audited by someone else
You can ask us what we hold about you from that audit, and to delete it, in the same way.
How to ask
E-mail seo-privacy@muslimspot.com. We will acknowledge it and answer within the month the Regulation allows, and sooner if it is a simple request.
If we get it wrong
You can complain to a supervisory authority. Because our processing happens in France, that is the Commission Nationale de l’Informatique et des Libertés (CNIL), and you may also complain to the authority in the country where you live or work. You do not have to come to us first.
Security, and what we would do if it went wrong
The machine runs a firewall that denies inbound traffic by default. The database is not exposed to the internet. The back office our staff use needs its own sign-in, with a code from an authenticator. The credentials SEO Auditor uses to reach the services in the table above are stored encrypted. Operating system security updates are applied automatically. Access to the server is limited to the people who administer it.
We are a small team running one machine. A very small number of people and systems can reach anything, and there is no separate security department.
If there were a breach affecting your data, we would notify the supervisory authority within the seventy-two hours the Regulation requires, and we would tell you directly: what happened, what was reached, what we have done, and what you should do. We would not wait for certainty about the details before telling you that it happened.
If you have found a vulnerability, please tell us at security@muslimspot.com. We will not threaten you for it.
Children
SEO Auditor is a tool for working adults and is not intended for anyone under sixteen. We do not knowingly create accounts for children. If you believe a child has an account, tell us and we will delete it.
Changes to this notice
When we change something that matters, such as a new processor, a new category of data or a change in retention, we will update this page, change the dates at the top, and tell account holders by email before the change takes effect.
Small corrections, such as fixing a typo or clarifying a sentence, get the reviewed date updated and nothing more.
The company-wide policy, which covers this website and anything not specific to SEO Auditor, is at the MuslimSpot privacy policy.