Privacy

This notice describes what SEOtto (registered entity name) collects when you use SEOtto, why, and what you can do about it. It is written to be read rather than to be defensible.

Who is responsible

SEOtto (registered entity name), Registered address, city, country (Company number) is the data controller. Write to [email protected] about anything on this page.

What we collect

• Account details. Your name, email address, hashed password, time zone and organisation name. Needed to have an account at all. If you sign in with Google, also the ID Google gives your account, so we recognise it next time — and nothing else from Google: no contacts, no calendar, no profile beyond your name.
• Billing, if you pay for a plan. Which Whop membership pays for it, its status and its renewal date. Whop holds your card details and invoices; we never see either.
• The sites you monitor. Their addresses and crawl settings, and the content we fetch from them — titles, descriptions, headings, canonicals, robots directives, link counts and so on. All of it is content you publish publicly.
• Alert destinations. Email addresses, Slack webhook URLs and webhook endpoints, stored encrypted at rest. Slack and webhook URLs are credentials, so they are never shown back in full. An email address added for alerts is sent one message asking whether it wants them, and receives nothing else until it says yes.
• Operational logs. Request metadata, kept briefly, to run the service and to investigate abuse.

What we deliberately do not collect

• No credentials for your site. There is no plugin, no script tag and no analytics connection. Everything we read is what any visitor can read.
• No advertising or analytics trackers. There is no third-party tracking script on this site.
• No identifiable record of free-checker use. The public checker stores the URL and the result. The caller's IP address is stored only as a keyed hash, which is enough to count distinct callers for abuse prevention and useless for identifying one.

Why we are allowed to

Account details and monitoring data: performance of the contract you entered into by signing up. Operational logs and abuse prevention: our legitimate interest in running a service that is not abused. Nothing here relies on consent, because nothing here is optional to the product working.

Who else sees it

Our hosting provider, our email provider (for alerts you asked for), and our error monitoring provider — which is configured not to send personal data or request bodies. Whop processes payments for paid plans, and is told which of our accounts a purchase is for. Google, if you choose to sign in with it, learns that you signed in to SEOtto. We do not sell anything to anyone, and there is no advertising network involved.

How long we keep it

Page snapshots — the bulky per-crawl detail — are pruned on your plan's retention window. The change history and issue records are kept for the life of the account, because they are the product: a monitor that forgets what a page used to say is not a monitor. Free-checker results are deleted after 30 days. Everything goes when you close the account.

What you can ask for

Access, correction, export, erasure, restriction, objection, and a complaint to your supervisory authority. Write to [email protected] and we will answer within 30 days.

Cookies and local storage

There are no advertising or analytics cookies. Signing in stores an API token in your browser's local storage under seotto.token, which is how the console knows it is you; signing out removes it. Hiding the dashboard's getting-started list remembers that choice under seotto.setup-hidden. Signing in with Google sets one cookie, seotto_google, for at most ten minutes while Google confirms who you are, and deletes it when you come back. While you sign in or sign up, this tab's session storage holds where you were going (seotto.next), the plan you picked (seotto.plan-intent) and the site you checked on the free checker (seotto.site-intent), so they survive the trip; each is removed once used. Nothing else is written.

Security

Passwords are hashed. Alert destinations are encrypted at rest. Traffic is TLS-only. Vulnerability reports go to [email protected], and are also published at /.well-known/security.txt.