Privacy Policy

Last updated 2026-09-12

SeoScore (seoscore.lt) audits websites for SEO, GEO, AEO, speed and security. This policy explains what data we process, why, and for how long. Every statement below matches what the software actually does.

1. Data controller

SeoScore (seoscore.lt); the controller is a natural person carrying out business activity in Lithuania, email info@seoscore.lt. There is no legal entity yet, so the identification required by Article 13 GDPR is currently incomplete, and for the same reason public payments are not enabled. The full name, registration number and address will appear here before we take a first payment.

Any question about your data can go to the same address.

When the controller is not us. If you use the service for your client's website (an agency checking client domains, say), you are the controller and we act as a processor on your instructions. The processor terms — the contract required by Article 28 GDPR — are clause 14 of the Terms of Service.

2. What we process

2.1. Data about the scanned website

When you enter a domain, our crawler fetches its public pages the same way a search engine bot does. We store URLs, response codes, headers, textual signals (title, description, heading structure), the issues found and the resulting scores.

2.2. The IP address a scan was started from

Along with each scan we store the IP address it was started from. There is one specific purpose: a scanner is an amplifier — one click here turns into roughly 35 requests to someone else's server, so we have to be able to see whether hundreds of scans are coming from a single address. Without this record the protection would only work in real time: a rate limiter answers “allow this now?”, not “who was here yesterday?”.

We do not use the IP for advertising, profiling or locating you, and we pass it to no one. It is deleted after 30 days — automatically, by a command that runs daily; the scan itself and its scores remain. Nightly scans started by our own scheduler have no IP at all.

2.3. Team data

When you give someone else access to your domain (in your account — Team), we store their email address and which domain the access covers. You type the address in yourself, and it is the only thing we hold about that person — we ask for no name, no phone number, nothing else.

Who sees what. The invited person sees that domain's scan data and your email address (so they know whose domain it is). You see their address and whether they already have an account. You do not see their other domains, and they do not see your other domains, your subscription or your account settings.

The legal basis is your consent and the performance of the contract: you grant the access yourself, and withdrawing it takes effect the same second. The record lives as long as the access does; withdraw it and the row is deleted, delete the domain and it goes with it.

When you use the service for a client's website (an agency whose team includes the client's own people) you are the controller and we act as a processor — the terms are clause 14 of the Terms of Service.

2.4. Account data

On registration: email address and a password hash (we never store the password itself and cannot recover it). We do not ask for a name — it is needed only for a purchase. We also record when, and which version of the Terms of Service you accepted — that is the evidence the contract was concluded.

This policy is not something you accept, and we do not record any acceptance of it: a privacy policy is information under Article 13 GDPR, not consent under Article 7. We process data on the basis of contract performance, legal obligation and legitimate interest (clause 8); where the basis genuinely is consent — connecting Search Console — we ask for it separately and record it separately.

2.5. Cookies

There are three cookies, all our own, and each has a technical purpose:

There is not a single advertising, tracking or third-party cookie. All three carry the __Host- prefix: a browser accepts such a cookie only over HTTPS and only from this exact domain, so no subdomain or outside script can overwrite it. The names shown here are the ones actually sent — they come from the same source as the cookie itself rather than being retyped.

Why there is no consent banner. Consent is required for cookies that are not necessary for the service — advertising, tracking, analytics that identifies you. These three are necessary or technical, and Article 5(3) of Directive 2002/58/EC exempts them. If a single non-essential cookie ever appears, we will ask for consent before setting it, and rejecting will be exactly as easy as accepting.

2.6. Signing in with Google

If you choose “Continue with Google”, we receive three things from Google: the account identifier (sub), the email address and the name. The scopes are openid, email and profile; we request nothing else (no contacts, Drive or calendar) and have no access to it.

We use them for one purpose — recognising your account. We store the identifier because the email address on a Google account can change while the identifier cannot: without it, changing your address would lose your scan history. If an account with the same email already exists, we link Google sign-in to it instead of creating a second one.

We do not request long-lived access for sign-in: once you are signed in, we hold no further access to your Google account.

2.7. Google Search Console data

If you connect your own Google account, we request a single scope — webmasters.readonly. It is read-only: we cannot change anything in your Search Console account.

From it we retrieve and use:

• the list of your verified properties, so you can choose which one to connect;
• search performance data (queries, impressions, clicks, CTR, average position) for a 28-day window.

We use it for exactly three things:

• Ordering findings: an issue on a page thousands of people see ranks above an issue nobody sees.
• The “Real traffic” report section: your queries, positions, and the pages that are shown but not clicked.
• Copy suggestions: if you request AI insights, we pass the queries a page already appears for to the model, so a new title speaks the language people actually search with.

We do not sell this data, do not share it for advertising, and do not use it for any other purpose. It belongs to your scan.

Only the signed-in owner can open a report. Until 2026-09-07 the tokenised link alone was enough, and that was too little: a link gets forwarded, never expires, and clicking an external link inside a report puts the whole address into a third party's Referer log. The link on its own no longer grants access. For a scan started without an account, the report is shown in trimmed form and only within the same browser session.

To hand a report to a client, use the export — PDF, XLSX or the developer handoff document. The file goes to you, and you decide who receives it.

2.8. Service performance records

So that we can confirm a paid service was supplied, and handle payment disputes, we record:

• the start and end time of an audit;
• delivery of the report, its views and exports;
• use of AI features;
• the related technical data — time, IP address and browser name.

These records are not about how you use the tool. We do not use them for advertising, profiling or behavioural analytics, and we do not share them with anyone except in a specific payment dispute or legal claim.

We keep them for 3 years — longer than scan IP addresses (2.2), because a payment dispute can be opened eighteen months after the charge. The legal basis is the legitimate interest in establishing and defending legal claims (GDPR Art. 6(1)(f)), and they survive account deletion as far as needed for that same purpose (Art. 17(3)(e)).

3. Google API Services Limited Use

SeoScore’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Search Console data is used only to provide and improve your audit report;
• it is not transferred to third parties except as necessary to provide this service (see section 5), and only at your request;
• it is never used for advertising and never sold to data brokers;
• humans do not read it, except with your consent for support, or where required by law, for a security investigation, or to restore service.

4. How we protect it

• The refresh token is encrypted in the database and never appears in reports or logs.
• All traffic is HTTPS with HSTS.
• Servers are in the European Union — Oracle Cloud, Frankfurt, Germany (eu-frankfurt-1).
• Database access is limited to the application and its administrator.

Who can actually see the data. The service administrator has technical access to all reports and to the database. This is needed to operate the service and to verify audit quality: the free view hides precisely the critical findings, so errors in them would otherwise be invisible. Search Console data is not read by a human except in the cases listed in section 3. Nobody knows your password — we store only a hash.

5. Who else receives data

Three services the audit depends on, and precisely what reaches them:

• Google PageSpeed Insights — the URL of the scanned page, to obtain a speed measurement.
• Google Sign-In — the Google account you choose confirms your identity (data flows from Google to us).
• Google Search Console — a request on behalf of the account you connected (data flows from Google to us, not back).
• OpenAI — only if you press “AI insights”: the analysed page’s text, the issues found and the Search Console queries, to obtain rewrite suggestions. Without that click, nothing leaves for OpenAI.
• Cloudflare — all traffic to this site passes through it, so it sees your IP address and browser. That is what protects the site from attacks and delivers the pages. The same Cloudflare also collects visit statistics: the page address, an approximate country, the device type and how fast the page loaded.
• Cloudflare Turnstile — the scan form is protected by an invisible check that the request comes from a human. It shows nothing on screen and asks you to click nothing, but Cloudflare receives your IP address, browser User-Agent, TLS fingerprint and this site's identifier. Scanning would not work without it: one click here turns into dozens of requests to somebody else's server, so we have to know a human made it. What Cloudflare does with those signals is described in their Turnstile Privacy Addendum.

Those statistics use no cookies and no device fingerprinting: they say a page was opened in Lithuania on a phone, not that it was you, and not that the same person came back tomorrow. Why that means no consent banner is needed is covered in section 2.3.

We do not share data with ad networks or data brokers, and we never sell it.

5.1. Transfers outside the European Union

The server and database are in the European Union — Oracle Cloud, Frankfurt, Germany. Some of the services listed are US companies, so a transfer outside the EU happens in these cases:

• Google (PageSpeed Insights, sign-in, Search Console) — we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, to which Google is certified, and on Standard Contractual Clauses.
• Cloudflare (traffic, protection, analytics, Turnstile) — Standard Contractual Clauses and Cloudflare's data processing addendum.
• OpenAI — AI features only and only on your click; Standard Contractual Clauses.
• Oracle Cloud (Frankfurt, Germany) — hosting provider for the server and database. Data does not leave the EU.
• Stripe — payment service provider. It comes into use together with public payments; until then we send it nothing. We will pass what a payment requires: email address, amount and order details. Card details go straight to Stripe and never reach us.

Copies of those clauses or confirmation of certification can be requested at the email address above.

To the people on your team. Once you grant access to a domain, the invited person sees that domain's scan data. This is not a vendor and not a third party on our initiative — you start the sharing, and withdrawing the access ends it. See section 2.3.

6. Retention

• Scores, domain and findings — until you delete them; history is what answers “did it improve”.
• Detailed scan data (page lists, link graph, signals, Search Console figures) — purged once a scan is 60 days old. The purge is run manually, so actual deletion may happen later; ask us and we will delete it sooner.
• The record of your acceptance of the Terms of Service (date and version) — for as long as you have an account, plus 3 years after deletion. The basis is the Article 7(1) GDPR duty to demonstrate consent and the general limitation period.
• A team access record (the invited person's email and the domain) — as long as the access exists. Withdraw it and the row is deleted at once.
• The IP address a scan was started from — 30 days. Deleted automatically, with no request needed.
• Usage records (2.8: report opens and downloads, with time and IP) — 3 years, including after account deletion. Basis: the legitimate interest in defending legal claims; a payment dispute can be opened eighteen months after the charge.
• Purchase consent records (date, version, the exact text you were shown, and IP) — 3 years after account deletion, for the same reason.
• Search Console access token — until you disconnect.
• Account — until you delete it.

7. Your rights, and how to use them

• Revoke Google sign-in: in your Google account third-party access settings (myaccount.google.com/permissions). Your account here remains; you can reach it via “forgot password”.
• Disconnect Search Console: the workspace → the domain's “Search Console” part → “Disconnect”. We delete the token and revoke it on Google’s side in the same request. You can also revoke access in your third-party access settings.
• Delete scan history: in your account, next to each domain — “Delete”. Every scan of that domain goes with it.
• Portability: you can download your reports as XLSX and PDF at any time — a machine-readable copy of your data (Article 20 GDPR).
• Get a copy of your data: write to info@seoscore.lt — we answer within 30 days (GDPR Art. 15 and 20). You can also download the reports yourself: XLSX and PDF on each one.
• Delete your account: account settings → “Delete account”. We delete the account, its domains, the subscription and every scan with its findings and report links; the Search Console token is revoked on the Google side too. This cannot be undone, so we offer the data copy first.
• Change your password: in account settings. Changing it signs out your other devices. If you signed in with Google, we email you a link to set one.
• Restrict processing or object to it: write to info@seoscore.lt — we answer within 30 days. These two deliberately have no button: they are a decision about a specific situation, not an action we can carry out on someone's behalf.
• You may lodge a complaint with the Lithuanian State Data Protection Inspectorate (ada.lt).

8. Legal basis

Account and audit data are processed to perform our contract with you (GDPR 6(1)(b)); Search Console data is processed on the basis of your consent (GDPR 6(1)(a)), which you can withdraw at any time using the button described in section 7.

Usage records (2.8) and purchase consents are processed on the basis of legitimate interest (GDPR 6(1)(f)) — they are needed to prove that a paid service was delivered. That basis is also why they survive account deletion: GDPR Art. 17(3)(e) provides exactly this exception to the right to erasure where data is needed to establish or defend legal claims.

9. Changes

If this policy changes, the date at the top changes with it. For material changes we email you, where we have your address.

This policy and the terms of use form one set of documents: the policy answers what we do with data, the terms answer the conditions we provide the service under.