Privacy and cookie policy

1. Who is responsible and how to contact us

MyPageAudit is responsible for the account, website, support and service administration described here. Contact support@mypageaudit.com for privacy requests or use our support page. You do not need to sign in to email us. We verify requests proportionately; never send a password, full payment-card number or identity document unless we explain why it is needed and provide an appropriate channel.

When you submit a client's website or other people's information, you must have a lawful reason and any required authority. Publicly visible information can still be personal information. This policy does not give permission to collect or reuse information unlawfully. Where we process personal information solely on a business customer's instructions, the parties must agree any required data-processing terms.

2. Information, sources and purposes

You provide information when you register, submit a URL or file, save research, contact us, change preferences or pay. We also receive public website responses, results from requested data providers, Google sign-in details and payment events from Dodo. Our hosts and network services receive connection information when your browser uses the service.

Provide only information needed for the feature. Do not submit credentials, private URLs, sensitive personal information or confidential content. Account identity and a submitted URL are needed for their respective functions; optional reviews, analytics and marketing are not required to run a manual audit.

3. Reasons for processing and legal bases

Where EU or UK law applies, we use contract necessity for the account, audits, requested research, delivery and paid access you request; legitimate interests for proportionate security, troubleshooting, abuse prevention and handling enquiries; legal obligations for required financial or legal records; and consent for optional analytics and marketing. For business contacts who are not personally party to a contract, service administration may rely on legitimate interests instead. Our interests are operating a reliable service and responding to users without overriding their rights.

Cookie permission, email preferences and acceptance of terms are separate. Requested verification/recovery emails support the account service; they are not permission for advertising. Where another applicable law requires consent or another legal condition, we obtain or satisfy that condition. A statement about legitimate interests under EU/UK law is not a claim that every country recognizes that basis.

4. Google sign-in and research

If you choose Google sign-in, we receive the identity information Google returns, including your account identifier, name, email and verification state, and use it to authenticate or link your account. We do not receive your Google password. Sign-in does not authorize access to Gmail, Drive, your spreadsheets or your advertising account.

Keyword research uses the operator's separately authorized Google Ads integration, not an Ads account connected by each customer. Google receives the keyword/domain seeds and language/location choices needed for the request. Ads suggestions and search metrics are not measurements of organic rankings. You can remove MyPageAudit access in your Google Account connections; this does not by itself delete your MyPageAudit account.

We use Google user information for the disclosed service, not to sell it, target advertising or train general AI models. Any use and transfer of information obtained through Google APIs must follow the Google API Services User Data Policy, including Limited Use requirements where applicable.

• Google Account connections
• Google API Services User Data Policy

5. Providers, AI and disclosure

Netlify serves the public frontend. The API, mail service, MongoDB, Redis and any backup host process operational records in the deployment used for your request. Brevo delivers configured messages. A future move to Railway, GCP, AWS, SES or another host is not evidence that your data is already there; we update this notice and the relevant arrangements before a material change.

Crawly receives a queried domain for indexed backlink/referring-domain totals on paid accounts only. Ahrefs receives a domain if its Domain Rating lookup is configured and requested. DataForSEO is not selected for the current deployment. A provider's authority score is its own metric, not a universal DA/DR score or a Google ranking factor.

For requested paid AI insights, Google Gemini receives a bounded set of check names, statuses, detected findings and recommendations. We do not intentionally send your account identity, password, payment data or complete report. Findings can nevertheless contain text from the audited page. Do not request AI insights for confidential or personal material. Gemini produces suggestions that may be wrong; account access and billing eligibility are not decided by AI.

Google's treatment depends on the API tier: unpaid Gemini services may use inputs and outputs to improve products and may involve human review; Paid Services have different data-use and safety-retention terms. A paid MyPageAudit plan does not mean the operator's Gemini API is on Google's paid tier. Google's terms require Paid Services when serving users in the EEA, UK or Switzerland. If the configured service cannot meet applicable provider or privacy requirements, AI must remain unavailable for that use.

Reviews are stored in the application's database and a private local Excel workbook. If configured, a private operator-owned Google Sheet mirrors retained review references, dates, sources, ratings and comments; this does not access your Google Sheets. Review storage does not automatically authorize a public testimonial.

Dodo Payments processes hosted checkout as merchant of record, meaning it is the seller shown for the payment transaction and manages applicable transaction taxes and payment administration under its own terms. Authorized operators and service providers receive only data needed for their functions. We may disclose information for valid legal requirements, protection of rights or a business transfer subject to applicable safeguards and notice. We do not sell personal information or share it for cross-context behavioral advertising.

• Google privacy policy
• Gemini API terms and data use
• Brevo privacy policy
• Dodo Payments privacy policy

6. Cookies, browser storage and optional analytics

Cookies and local storage remember information in your browser. Necessary storage supports requested sign-in, secure authorization and guest-report access; rejecting optional analytics does not disable those functions. Appearance and prompt preferences are stored locally.

Where Google Analytics is configured, it stays off until you accept, worldwide. We do not send analytics requests or cookieless measurement before opt-in. Reject optional cookies and Accept analytics cookies have equal prominence. Use Cookie settings at any time to change or withdraw permission. We also disable optional analytics when your browser sends Global Privacy Control or Do Not Track.

Consented measurement uses fixed public page titles and canonical URLs. We exclude account IDs, email, audit targets, query strings, report text and form values, and do not measure private workspace routes. Google still receives the connection/browser information needed to handle analytics requests. We do not enable advertising personalization or Google signals. Withdrawal stops further collection, clears accessible analytics cookies and reloads the page; it does not automatically erase earlier provider records. Dodo/Google pages you deliberately open have their own storage notices.

7. Email choices and scheduled reports

Account/report delivery and offers/newsletters are separate choices and start unchecked. Email registration and password recovery require the account-email choice so the requested links can be delivered; Google sign-in can work without it. Disabling this choice can prevent verification, recovery, welcome and report messages. Marketing permission is optional and does not change audit or account access.

Change preferences in Account settings or use the relevant unsubscribe link in non-security mail. Verification and recovery messages do not contain a marketing unsubscribe link. Our mail service checks current permission before accepting and sending queued messages; a message already handed to the delivery provider may still arrive. Opting out of our marketing does not cancel a subscription. Dodo may send separate transaction receipts or billing notices under its own responsibilities.

Automatic daily monitoring and monthly audit digests are currently paused. No new scheduled collection or monthly delivery is enabled. Manual audits and requested report emails remain available. If scheduled reporting returns, we will explain its frequency, included data and project controls before enabling it; this notice does not enroll you in a future feature.

8. Retention and deletion

We retain information for the feature and purpose described below. Expiry is processed asynchronously, so it is not an exact deletion-time guarantee.

Operational logs, backup copies and correspondence have separate lifecycles based on troubleshooting, recovery and legal needs. We restrict access and do not use a retained backup to restart marketing. Where an erasure request applies, we remove active records and address residual copies through the applicable deletion/rotation process; if a backup is restored, relevant deletion decisions must be reapplied. Contact us for the actual deployment's retention details.

Account settings provides export and confirmed deletion. Recurring billing and unresolved checkout must be cancelled or reconciled as part of deletion. Cleanup can take longer if a provider or database is unavailable; we explain the issue rather than promise immediate erasure. Feedback has no account-ID field, so identify its reference or comment if you want us to locate it. We may retain limited records where legally required or necessary for a dispute; deletion does not erase records another controller must keep.

9. International processing and security

Our providers may process information outside your country. Where transfer rules apply, we must use the applicable lawful mechanism, such as an adequacy decision or appropriate contractual safeguards, and supplementary measures where needed. We do not promise that all data remains in one country or claim every provider has already signed a particular safeguard. You can request the arrangements applicable to your data.

We use account access controls, password hashing, bounded requests and HTTPS on the public service. Access is limited to authorized people and providers. No system is completely secure. If an incident requires notification, we notify affected people and authorities as applicable law requires.

10. Your rights, complaints and children

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction, objection or withdrawal of consent. Withdrawing consent does not change the lawfulness of earlier processing. We do not make solely automated decisions with legal or similarly significant effects about you. We do not discriminate against people for exercising privacy rights.

Email support@mypageaudit.com with the request and enough information to locate the relevant records. We respond within applicable statutory periods and explain any lawful exception or extension. For EU/UK requests the usual period is one month, extendable where permitted; where the CCPA applies the usual substantive response period is 45 days, extendable as permitted. These rights are conditional on the relevant law applying, not a claim that every statute covers this business.

You may complain to the data-protection or consumer authority competent for your location and use applicable appeal rights. The service is for adults aged 18 or over and is not directed at children. If you believe a child supplied personal information, contact us so we can investigate and address it.

11. Changes to this notice

We date updates here and give additional notice of material changes where required. We obtain fresh permission where needed before a new optional purpose or expanded Google-data use. A planned feature or new provider is not permission to collect additional information now.