Privacy Policy

Last updated: January 2025

1. Data Controller

Better Search Console is operated from the European Union. We act as the data controller for the personal data processed through this service.

2. Data We Collect

Account Data

• Google account email address
• Display name / nickname
• OAuth access and refresh tokens (encrypted at rest)

Search Console Data

• Website URLs registered in your Google Search Console
• Search performance metrics (clicks, impressions, CTR, position)
• URL indexation status and coverage states
• Sitemap data

Service Usage Data

• Prompt analyses you create (prompts, model responses)
• Custom dashboards and saved filters
• Blog posts you author
• API request logs (timestamp, endpoint, response code)

3. Purpose and Legal Basis

We process your data for:

• Contract performance (Art. 6(1)(b) GDPR): providing the Service features you signed up for
• Legitimate interest (Art. 6(1)(f) GDPR): service improvement, abuse prevention, and analytics
• Consent (Art. 6(1)(a) GDPR): optional newsletter emails

4. Third-Party Processors

• Google: OAuth authentication, Search Console API, Indexing API
• Stripe: payment processing for subscriptions
• Hosting provider: server infrastructure within the EU

All processors are bound by data processing agreements and process data in compliance with GDPR.

5. Data Retention

• Account data: retained while your account is active, deleted within 30 days of account closure
• Search Console metrics: cached temporarily for performance, refreshed on access
• Prompt analyses: retained until you delete them or close your account
• Payment records: retained as required by tax law (typically 7-10 years)

6. Cookies

We use the following cookies:

• Session cookie: authenticates your login session (essential, httpOnly)
• Locale cookie: remembers your language preference (essential)
• Selected website cookie: remembers your last-selected website (functional)

We do not use advertising or tracking cookies.

7. Your GDPR Rights

You have the right to:

• Access: request a copy of all personal data we hold about you
• Rectification: correct inaccurate data
• Erasure: request deletion of your data ("right to be forgotten")
• Portability: receive your data in a structured, machine-readable format
• Restriction: limit how we process your data
• Object: object to processing based on legitimate interest
• Withdraw consent: for newsletter or other consent-based processing

To exercise these rights, contact us via the email address on our website. We will respond within 30 days as required by GDPR.

8. International Transfers

Data may be transferred to Google (US) under their Standard Contractual Clauses and to Stripe (US) under their GDPR compliance framework. No other international transfers occur.

9. Security

We implement appropriate technical and organizational measures including encryption in transit (TLS), encrypted storage of OAuth tokens, access controls, and regular security reviews.

10. Changes

We may update this policy. Material changes will be communicated via email at least 14 days before taking effect.

11. Contact & Supervisory Authority

For privacy inquiries, contact us at the email address listed on our website. You also have the right to lodge a complaint with your local data protection supervisory authority.