Privacy

SiteCandor is responsible for the personal data this page describes, and the contact form is how to reach us about any of it.

What Data We Store About You

• Your email address, and your agreement — given with the box on the audit form — to receive your report, follow-up emails about it, and SiteCandor’s newsletter with news and offers, with the version of the words you agreed to.
• The date, time, and IP address at the moment you answered that box. We keep this only as the record of what you chose.
• The web address you asked us to check, and the report we produced.
• If you answer “How did you hear about SiteCandor?” on the audit form — it is optional, and skipping it changes nothing — the answer you picked, and anything you type in the box beside “somewhere else”. We keep it with your email address to learn which places bring people here, and nothing else.
• Where your first visit came from, when your browser kept it (see Cookies and Tracking): the campaign tags in the link you followed, the website you came from and the page you landed on. We keep it with your email address, and with your subscription if you subscribe, to learn which places bring people here.
• For each free audit, the site, your email address as you typed it, and a normalised form of the address — with any tag, and for Gmail the dots, removed. We use them to apply the limits on how often a free audit can be run, and to send your report again if you ask for the same site.
• If you buy something: the purchase record and the domain you bought it for, with the record of what you agreed to at checkout — the checkout session, the versions of our terms and renewal terms you were shown, whether you ticked the renewal box, the time, the plan and the price. Your card details go to Stripe and never to us.
• If you subscribe: what you set up in your dashboard — the keywords you track, the questions you ask AI assistants, the addresses of pages you choose to compare your own against (kept inside your saved analyses), your key pages, your site’s name — and the measurements we take for you. If you tell us how you heard about us, we keep that answer with your subscription. If you asked us when you subscribed not to email you after your subscription ends, we keep that request with your email address.
• We note when you last signed in, so we can see which features are used, and keep that note for 400 days after your last sign-in.
• If you write to us through the contact form: your name, email, message and IP address arrive as an email to our inbox. From your dashboard — the Help page or Feedback — your message arrives with your email, your sites and your IP address, and from Feedback with the page you were on, your window’s width and your role on the site too. Either way, the message and your email are also kept with the rest of the feedback people give us — from the dashboard, with the site it was about. The IP address briefly counts toward the rate limits listed below.
• If you answer one of our questions — whether a report was useful, what kept you from subscribing, or your main reason for leaving when you cancel — your answer, anything you add, where we asked, and the email address and the report or subscription it was about. Whether a help article helped is only counted, with nothing that names you; words you add while signed in are kept with your email address and the article.
• If you tick “SiteCandor may quote this in its marketing”: the words you wrote may appear in our marketing — our website, social posts, ads, emails and the like — with your site’s name, never your email address. You can withdraw this permission at any time through the contact form.

We send your report because you asked for it. When you ask for an audit, you also agree to follow-up emails about it and to SiteCandor’s newsletter with news and offers, and you can unsubscribe from them at any time. If you asked for an audit before the box named news and offers, your agreement covers only the report and the follow-up emails about it, and you get no newsletter and no news or offers beyond those follow-ups.

If Someone Invites You to Their Team

A subscriber can give other people access to chosen sites in their dashboard. On Essentials that is 1 viewer; on Pro it is up to 3 viewers, plus an editor for each editor seat the subscriber has bought. If you were invited, here is what we hold and for how long.

• Your email address, who invited you, your role and your sites — and, once you accept, the version of our Terms you accepted and which of each site’s alert emails you get.
• An invite you do not accept expires after 7 days and is deleted automatically soon after. Ask us and we delete it at once.
• Your access is deleted when the site’s owner removes you, when the site itself is deleted, or when you ask us.
• We note that your address was invited, so the same account cannot keep inviting you. The note goes when that account’s subscription ends, or when you ask us.

What We Store About Your Website

An audit reads publicly reachable pages of the site you named — what any visitor’s browser would see. For every audit we keep a snapshot of the pages it read for 90 days, so we can answer “why did the audit say that?”, and then it is automatically deleted. If the site itself displays personal information — staff names, contact details — that information sits inside the snapshot for those 90 days. The reports we keep list each page we read with its address, title and main heading, and on a local business’s site the first phone number a page links to, so a name or number shown on a page can appear in a report. We do not contact anyone named on the pages we read.

How Long We Keep Your Data

• Your email — until you ask us to delete it, whether you have asked for free audits or subscribed. Unsubscribing stops our marketing email immediately, but it does not delete the address; deletion is its own request, below.
• What you tell us — your answers to our questions, your comments and your messages, with the email address they came from — until you ask us to delete them. We keep them so what people tell us can keep improving SiteCandor.
• Team members and invites — a member’s access until the site’s owner removes them or the site is deleted; an invite nobody accepts, 7 days, then deleted automatically; the note that an address was invited, until the inviting subscription ends. Any of them sooner if that person asks.
• Your report — indefinitely. The link in its email lasts seven days and can be renewed to the same address for as long as we keep your email. An older one-page check-up’s link keeps working. We delete a report when you ask.
• Recent readings of a site — 7 days. A free audit asked for within a week of another free audit of the same site is built from that reading instead of reading the site again, which is gentler on the site; the report says the date. The exception is an audit that read no page because the site’s server failed to send its robots.txt: the next request reads the site again.
• Free audit records — 90 days after each free audit: the site with your address as typed and in its normalised form, and the normalised address with that audit’s reference and date. We use them to apply the free audit’s limits and to send a report again.
• The follow-up schedule — about 100 days after an audit, then deleted.
• Rate-limit counters — a day at most; the ones counted per IP address, and the sign-in one, expire after two hours. An expired counter no longer counts, and it is deleted automatically, usually within a few days.
• Crawl snapshots — 90 days, so we can answer “why did the audit say that?”, then automatically deleted.
• Subscription measurements — kept for as long as you are subscribed, with no maximum age, so your whole trend stays on the chart. Three records are shorter: the daily page-check boards go after 120 days, our note of which keywords we emailed you about after 200, and each day’s list of your top keywords from Search Console after about nine days. When a subscription ends, its history is kept for 90 days in case you come back, and then deleted.
• Purchase records — seven years after the end of the tax year they belong to. They are tax and accounting records, and they include each checkout’s record of the terms and renewal terms you agreed to.
• Server logs — one month, and kept free of email addresses in normal operation. They can record an IP address. Each sign-in to the dashboard is logged under a scrambled code made from your address and a secret key, never under the address itself.
• Our record of who looked at a subscription — 400 days. Each time someone at SiteCandor opens a subscriber’s site in our own dashboard, the record notes who looked, when, which site, and any reason they gave. A deletion request does not remove it.
• Emails waiting to be sent — an email we could not send keeps your address and its content for up to 120 days, so it can be sent again. Once an email has gone, its entry keeps only a scrambled form of your address, for up to 120 days, so it is never sent twice.
• Our record of the emails we send you — 90 days. For each email, we note which email it was and its subject line, the address it went to, when we sent it, and whether it was delivered, bounced or marked as spam. For the emails described below that note opens and clicks, we also note whether each one was opened and whether a link in it was clicked. We never keep the message itself. A deletion request deletes this record.
• Suppression records — permanently, unless you ask us to lift one. If you unsubscribe, we keep just enough to guarantee we never send you marketing email again, including a normalised form of your address, so no other spelling of the same mailbox gets it either; if a message bounces, never to email you again at all; if you mark one as spam, to send you nothing but the sign-in links you ask for and the welcome email when you subscribe; and if you tell us you never asked for a free audit, to send you no more from the audit form. Deleting that record would be the one deletion that could hurt you.
• Payment disputes — permanently. If you dispute a charge with your bank, we keep your email address and Stripe customer ID so that no follow-up, reminder or win-back email from us reaches you again.

We may keep information longer when the law requires it or when we need it to establish, exercise or defend a legal claim.

One honest caveat: our database keeps rolling backups for disaster recovery, so a deleted item can persist in those backups for up to 35 days after we delete it, before it is gone from them too.

Who Else Touches Your Data

People at SiteCandor can see account data to run the service, support customers and keep it secure; your Google figures follow the stricter rule in the Google section below.

• Amazon Web Services — hosting, storage, and sending your report and any emails you opted into. Data stays in their US East region.
• Stripe — payments, if you buy something. We send Stripe your email address, the site you are subscribing for, the plan, our own reference for the subscription, the versions of our terms you were shown, and the answer you picked to “How did you hear about SiteCandor?” if you picked one. Your card details go to Stripe and never to us; what comes back to us is that the payment succeeded, the email and domain you gave Stripe, the country of your billing address and the country your card was issued in, and any refund or dispute that follows. If either country is in the UK, the EU, Norway, Iceland or Liechtenstein, the subscription ends at once, your payment is refunded in full, and we keep that country with the record of your checkout. Stripe also uses payment information for its own purposes, such as preventing fraud, under its own privacy policy.
• Cloudflare Turnstile — the bot check on our forms. It runs on pages with a form and reads your IP address and details of your browser and connection to tell a person from a script. When you send a form, our server sends Cloudflare the check’s token with your IP address to confirm it. Cloudflare also uses what it receives for its own purposes, under its own privacy policy.
• DataForSEO — the data vendor behind rank tracking, search-volume figures and AI-assistant measurement. For subscribers, the keywords you track, the locations you chose, your website’s address (to find the keywords it already comes up for), the keyword ideas you look up, and the questions you wrote for AI assistants are sent to them to run — the questions word for word, passed on to the AI providers they query with the country and town you set under Where We Search From on your Rankings screen, as far as each provider takes them. Your email, IP and payment details are never sent to them.
• Anthropic — the AI provider behind three things. For a full audit, free or paid, we send the audited website’s address and its homepage — the title, description, headings, the kinds of structured data it declares, and up to about 2,000 characters of its text — with the paths of the other pages we read, so the model can tell what kind of business it is and whether it serves a local area; that decides whether the report scores your local presence. When an audit could not read the homepage, we send the first page it read instead, and when it read no page, we send nothing. When a site joins a subscription, and whenever fresh keyword suggestions are made for it, we send the title, headings and opening text of its homepage, if we could read it, with the town or country it searches from, so the model can propose keywords your customers might type. And each week, for a subscription, we send each answer an AI assistant gave to your questions — up to about 4,000 characters of it — with your website’s address, your business name if you gave one, the country and town your questions are asked from, and the question that was asked, so the model can list which other businesses that answer named and check whether it named yours. That answer is the assistant’s own text, not yours. Nothing else is sent: not your email, not your IP, and not your payment details.
• Zoho Mail — our inbox. A message you send through the contact form is delivered there, with the name, email, message and IP address the contact-form section describes, and so is a message from your dashboard’s Help page or Feedback, with the details listed above.

We also use Google Analytics on our public pages and on free report pages to understand how people find and use the site — page views, where a visit came from, and whether a form was sent. Our site tells Google each page’s address without anything after the “?” except campaign tags (the utm_ part), and on a report page the report’s private address is replaced with a fixed placeholder, so the link itself never reaches Google. Analytics is switched off entirely inside the subscriber dashboard, on the sign-in pages, and on every page whose link carries a code naming you, such as an unsubscribe link, because those are somewhere you have already arrived rather than somewhere we are learning about. Visitors in the UK, the EU, Norway, Iceland or Liechtenstein get no analytics at all. The complete list of what gets set in your browser, and the switch for it, is on our cookies page.

Outside those places, Google Analytics sets its cookies unless you have said no, and where your browser’s time zone could be in Europe we also ask you. You can say no, or change your answer, on our cookies page at any time. A no means Google’s script sets no analytics cookies, and the ones it set before are removed. Google’s script still loads after a no, and it still sends Google a measurement ping without cookies each time a page is viewed or a form is sent. Each ping carries the page’s address, Google receives your IP address with it, and no cookie ties it to you. We use no session recording, and we sell no one’s data.

Google and Cloudflare receive information from your browser when you use our site. Google’s analytics script runs on the pages described above, and Cloudflare’s bot check runs on pages with a form and reads your IP address and details of your browser and connection. Both companies run these services on many other websites, and their own privacy policies govern how they use what they receive. We use no advertising networks, advertising pixels or remarketing, and Google Analytics’ advertising features are switched off for our site. Our site does not change what it does when your browser sends a Do Not Track or Global Privacy Control signal.

Our free audit emails — the one that brings your report and the follow-ups after it — note whether they were opened and whether a link in them was clicked. Amazon SES, which sends them, does this with an invisible image and by passing each link through an address on our own domain on its way to where it points, and tells us which email was opened or clicked. We count those per email to learn which emails are worth sending, and keep a note of each for up to 90 days so that an email opened twice counts once. Our record of the emails we send you, described above, also notes whether each one was opened or clicked. We do not use any of it to profile you or to decide what else to send you. Sign-in links, receipts, billing notices and the emails a subscriber gets about their own site record neither, and the unsubscribe link is never tracked. Blocking remote images in your email app stops the open count.

Your Own Google Search Console and Analytics

If you connect your own Google account, your dashboard shows Google’s own figures for your website beside the ones we measure. Connecting is entirely optional, nothing else changes if you never do it, and you choose which Google account and which property.

We ask Google for your Google account’s email address and account identifier, which we keep to show which account is connected, and for two permissions that are both read-only: Search Console and Analytics. We cannot change anything in your Google account, and we cannot read your email, your files or anything else Google holds. To let you choose, we ask Google which Search Console sites and Analytics properties your account can reach: we show you the Search Console properties for your own site and every Analytics property by name, and we read the website address of up to 50 Analytics properties to find yours. We keep only the properties you choose.

What we read is the figures themselves — clicks, how often you appeared, the keywords people used to find you, your average position, visits, where they came from, and the actions you marked as key events in Analytics, which your dashboard shows as goals completed. We never read anything about an individual visitor to your site, because those tools do not expose it.

We read it once a day while the connection is live, and we store the daily figures so your dashboard can show a trend. They are kept with the rest of your site’s history and are deleted on the same schedule, described above, except each day’s list of your top keywords, which is deleted after about nine days. Disconnecting stops the reading immediately; the figures already collected stay, so reconnecting later still shows your past.

If Google lists you as an owner or full user of your site’s Search Console property, connecting also proves the site is yours, and our crawler then reads pages your robots.txt closes to all robots, though never pages closed to SiteCandorBot. That covers your site’s own address, with or without www, and never its other subdomains or another site, as our crawler page explains. We ask Google about that permission again every day, and the proof ends when Google no longer lists you that way, when we cannot confirm it for about three days, or when you disconnect.

Everyone on your site’s team, including viewers, can see these figures in the dashboard. A person at SiteCandor sees your Google figures only to investigate a problem reported with your site, and each look is recorded. A keyword from Search Console that you choose to track becomes one of your tracked keywords, and like the others it is sent to DataForSEO to measure your ranking. Your Google data is never sold, never used for advertising and never used to train any AI model — ours or anybody else’s. Apart from that keyword, it passes to another company only in the cases the next section describes.

We keep the key that lets us read it encrypted. When you disconnect, the key is deleted at once. When your subscription ends, the key is kept only to withdraw our access at Google, which usually happens within a day, and it is deleted within about a week.

You can disconnect at any time from Settings in your dashboard, which also withdraws our access at Google unless another of your sites is connected through the same Google account and still uses it. You can do the same from your Google account directly, at myaccount.google.com/permissions.

SiteCandor’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Selling, a Sale of the Business, and the Law

We do not sell or rent personal data. The companies listed above receive the parts of it this page describes, and Stripe, Cloudflare and Google also use what they receive for purposes of their own, under their own privacy policies. If SiteCandor’s business is sold or reorganised, the data we hold passes to the new owner, and the promises this policy made when the data was collected still bind it. Data we received from Google passes to a new owner only with your explicit consent.

We may disclose information when the law requires it, for example in answer to a valid subpoena or court order, or when it is needed to protect SiteCandor or the people who use it from fraud or abuse. Our professional advisers, such as our accountant and lawyer, may see business records such as purchase records, and they are bound to keep them confidential.

Deleting Your Data

Every marketing email has an unsubscribe link, and we honour it immediately. To have everything deleted, use our contact form and tell us the address you used — no forms beyond that, no retention speech. Deletion is a person acting on your request rather than a button. We delete your lead record, your reports, your audit data, everything you told us through our questions and messages, any quote of it in the weekly summaries we send ourselves and the copies of your messages in our email inbox, and the reply to your request says when it is done. We keep the suppression record described above, and we create one if your address has none, so that no marketing email from us reaches your address. We also keep any purchase record, which is a tax record, any payment-dispute record, our record of who at SiteCandor looked at your subscription, which expires 400 days after each look, and the lines of our own daily summary that quote an AI question you set and a few words of an assistant’s answer, which expire within 120 days. If you still have a subscription, it is cancelled first; everything is then deleted at once rather than after the usual 90 days.

If You Are in the EU or UK

SiteCandor is not offered in the UK, the EU, Norway, Iceland or Liechtenstein at the moment, and our site loads no analytics for visitors there.

When you ask for a free website audit, the box on the form asks for your report, follow-up emails about it, and SiteCandor’s newsletter with news and offers. Your consent is our basis for sending them; we log when, from what IP address and with which words it was given, so that claim is checkable rather than asserted. You can withdraw consent to the follow-ups and the newsletter at any time with the unsubscribe link in any of them — one button, no login, honoured immediately — and withdrawing does not take your report away. You have the usual rights of access, correction, deletion, restriction, objection and portability; the contact form is how to use them, and we answer within a month. You can also complain to your data-protection authority, though we would rather you told us first so we can fix it.

Your data lives in the United States, so using the service from the EU or UK means it is transferred there. The providers above certify under the EU–US Data Privacy Framework or offer contractual safeguards for that transfer.

If You Are in California or Another US State With a Privacy Law

We do not sell personal information, and we do not share it for cross-context advertising — there is nothing here for a “Do Not Sell” link to switch off. The rights those laws give you — to know, delete and correct — are the same ones this page already offers everyone, through the contact form, and we do not treat anyone differently for using them.

Children

The service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If that has happened, tell us through the contact form and we delete it.

Changes to This Policy

If this policy changes materially we will say so on this page, with the date of the change, rather than quietly editing it.