Privacy Policy

Last updated: October 17, 2026

SEO Score API ("we", "us", "our") respects your privacy. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding that data.

1. Data We Collect

Data	Purpose	Retention
Email address	Account creation, API key delivery, service communications	Until account deletion
API key (hashed)	Authentication — we store only a SHA-256 hash, not the raw key	Until account deletion
URLs audited	Usage tracking and rate limiting	90 days
Request timestamps	Usage tracking and rate limiting	90 days
API request metadata (which endpoint, when, response status, response time and size)	Understanding how the API is used, via Ripen and our own logs. Never the URLs you audit, request or response contents, or your API key	Request metadata: 13 months. Daily summaries: 25 months. Account details held by Ripen: until we ask Ripen to remove them, which we do on request
IP address (website and server logs)	Rate limiting and abuse prevention (via nginx logs)	14 days
IP address and page origin of each API call	Abuse prevention, spotting an API key used from somewhere unexpected (for example exposed in a web page), and seeing where an account's calls come from (office, cloud or home network). The network's owner is looked up offline against a public table; the IP is never sent to anyone. The origin is the website a browser call was made from (scheme and host only), when a browser sends one	90 days
Payment information	Subscription billing — processed and stored exclusively by Stripe	Per Stripe's policy
Website usage (pages visited, referring site, browser and device type)	Understanding which pages and features people use, via Google Analytics and our own first-party logs	Google Analytics: 14 months; our logs: 180 days
Free tool use (which tool, the site you checked as a host name only, a short summary of the result, how long it took, which buttons on the result you clicked, the referring site, device type, the country and network your IP address belongs to, looked up offline, and a one-way hash of the IP, never the address itself)	Understanding which free tools are used and what they find, and fixing ones that fail	180 days

Cookies and analytics

Our website uses Google Analytics 4, which sets first-party cookies and sends Google your IP address and browser details so we can count visits and see which pages and sign-up steps are used. We do not use it for advertising, and it is switched off when your browser sends a Global Privacy Control signal. We also set one first-party cookie on your first visit recording how you first found us (the first page you opened and, where there is one, the referring site or campaign tag), used only to attribute sign-ups. We do not use advertising pixels (no Facebook Pixel).

2. Data We Do NOT Collect

We do not collect personal data from the websites you audit.
We do not store the content of audited pages — only the URL and the generated score.
We do not store payment card numbers or bank details (Stripe handles all payment data).

3. How We Use Your Data

To provide the Service: Your email identifies your account. Your API key authenticates requests. URLs are logged for usage tracking.
To enforce limits: Usage data ensures fair access per your subscription tier.
To protect your account: The IP address and page origin of each API call let us spot a key used from somewhere unexpected and see where an account's calls come from.
To communicate: We may email you about service changes, security issues, or billing. We will never send marketing emails without consent.
To improve the Service: Aggregate, anonymized usage patterns may inform product decisions.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process personal data under the following legal bases:

Contract performance: Processing your email and usage data is necessary to provide the Service you signed up for (Article 6(1)(b) GDPR).
Legitimate interest: Rate limiting, abuse prevention, and service security (Article 6(1)(f) GDPR).
Consent: Where required by law, such as for optional marketing communications (Article 6(1)(a) GDPR).

5. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with:

Stripe: Payment processing. Stripe's privacy policy: stripe.com/privacy
Google Analytics: Website usage measurement. Google's privacy policy: policies.google.com/privacy
Ripen: API usage analytics. Ripen receives metadata about API requests (endpoint, time, response status, response time and size) with a one-way hash of the API key that made them, and, to tell accounts apart, the account's plan, signup date, Stripe customer ID and a one-way hash of its email address. It does not receive your email address itself, the URLs you audit, audit results, or your API key, and it does not email you. getripen.com
Law enforcement: Only when required by valid legal process (subpoena, court order).

We do not use sub-processors for advertising or marketing; Google Analytics and Ripen (above) are our only analytics providers: Google Analytics for the website, Ripen for API usage.

6. International Data Transfers

Our servers are located in the United States (AWS). If you are accessing the Service from the EEA, UK, or other regions with data transfer restrictions:

Your data is transferred to the US under Standard Contractual Clauses (SCCs) as recognized by the European Commission.
We apply equivalent safeguards regardless of where your data originates.

7. Your Rights

All Users

Access: Request a copy of all data we hold about you.
Deletion: Request deletion of your account and associated data.
Correction: Request correction of inaccurate data.

EEA/UK Users (GDPR)

Portability: Receive your data in a machine-readable format.
Restriction: Request restriction of processing.
Objection: Object to processing based on legitimate interest.
Withdraw consent: Where processing is based on consent, withdraw it at any time.
Lodge a complaint: File a complaint with your local data protection authority.

California Residents (CCPA/CPRA)

Right to know: What personal information we collect and how we use it.
Right to delete: Request deletion of your personal information.
Right to opt-out: We do not sell personal information. No opt-out is necessary.
Non-discrimination: We will not discriminate against you for exercising your rights.

To exercise any of these rights, email: privacy@seoscoreapi.com. We will respond within 30 days (or sooner as required by applicable law).

8. Data Security

API keys are stored as SHA-256 hashes — even we cannot see your raw key.
All traffic is encrypted via TLS 1.2+ (HTTPS).
Server access is restricted to SSH key authentication only.
We follow the principle of minimal data collection.

9. Data Retention

Account data (email, key hash): Retained until you request deletion.
Usage logs (URLs, timestamps): Retained for 90 days, then automatically purged.
Server logs (IP addresses): Retained for 14 days.
Free tool use: Retained for 180 days, then automatically deleted.
API call origins (IP address and page origin of each API call): Retained for 90 days, then automatically cleared.
Payment data: Managed by Stripe per their retention policy.

10. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top indicates the latest revision.

12. Contact

For privacy-related inquiries:

Email: privacy@seoscoreapi.com
For GDPR inquiries, our data controller is the operator of SEO Score API.