Privacy policy

1.Controller

• Phone: +43 664 514 50 57
• Email: info[at]simplewebdesign.at

SEO Cockpit is a product by SimpleWebDesign.

2.Overview

SEO Cockpit is a web application that shows data from Google Search Console and Google Analytics 4 for websites of an organization. Personal data is processed in particular:

• when you visit this website (connection data),
• when you sign in and use your account (email address, sessions),
• for organizations, websites and settings you manage in SEO Cockpit,
• when you connect a Google account and import Search Console and Analytics data,
• for alerts, reports and emails,
• for the optional access via MCP (e.g. from ChatGPT).

3.Visiting the website

To deliver the pages, the server necessarily processes connection data, in particular your IP address, the time of access, the requested address and technical information about your browser. SEO Cockpit does not store access logs with IP addresses in its database. Logs of the hosting environment are used only to operate the service and to detect and fix errors and attacks.

The public website loads no marketing services and no externally loaded fonts. Images, fonts and the consent tool Klaro are delivered from our own server. Google Tag Manager and Google Analytics are only loaded on the public pages and only after your consent (see “Consent and statistics”). The link to simplewebdesign.at only leads to that website when you click it.

Legal basis: our legitimate interest in the secure and reliable operation of the website (Art. 6 (1) (f) GDPR).

4.Consent and statistics (Google Analytics)

On the public pages (home page and legal pages) we ask for your consent with the consent tool Klaro. Klaro is open-source software that we run on our own server; no data is sent to its developer. Klaro stores your choice in the cookie “klaro” in your browser so that we can respect it on your next visit and demonstrate your consent. Legal basis: our obligation to be able to demonstrate consent and our legitimate interest in remembering your choice (Art. 6 (1) (c) and (f) GDPR in conjunction with Art. 7 (1) GDPR).

Before you consent, all storage and measurement signals of Google Consent Mode (v2) are set to “denied”: Google Tag Manager is not loaded and your browser makes no connection to Google. The advertising signals (ad_storage, ad_user_data, ad_personalization) remain denied after your consent as well; we do not use any advertising services.

Only if you consent to the category “Statistics” does your browser load Google Tag Manager, which in turn loads Google Analytics 4. Google Tag Manager is a tool for managing website tags; according to Google, it does not itself collect IP addresses or identifiers relating to individual visitors. When it is loaded, your IP address is necessarily transmitted to Google.

Google Analytics 4 helps us understand how the website is used. It processes in particular the pages visited (address and title), the referring page, the time of the visit, technical information about your device and browser and your approximate region, linked to a pseudonymous identifier stored in the cookies “_ga” and “_ga_<ID>”. According to Google, Google Analytics 4 does not log or store IP addresses. We use Google Analytics only for statistics about the use of the website, not for advertising. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data as our processor; processing by Google LLC in the USA cannot be ruled out (see “Transfers to third countries”).

Legal basis: your consent (Art. 6 (1) (a) GDPR; for storing and reading information on your device § 165 (3) of the Austrian Telecommunications Act 2021, TKG 2021).

You can withdraw your consent at any time with effect for the future via “Cookie settings” at the bottom of every public page. When you withdraw, analytics is set to “denied” again and the Google Analytics cookies in your browser are deleted. The lawfulness of the processing carried out until the withdrawal remains unaffected. Google Analytics deletes the collected event data automatically after the retention period set in our Google Analytics property; the cookies and their lifetime are listed under “Cookies and local storage”.

5.Account and sign-in

Access to SEO Cockpit is currently by invitation. Sign-in usually works without a password via a sign-in link sent by email (magic link). We process:

• your email address and the time of your most recent sign-in via sign-in link,
• your memberships in organizations and your role (owner, admin, member, client),
• sign-in sessions (a random session identifier and its expiry date),
• one-time sign-in links: valid for 15 minutes and deleted once used,
• only for individual accounts set up by the operator (e.g. demo or review access): a password, stored solely as a salted hash (scrypt), plus the number of failed sign-in attempts, a temporary lock after repeated failures and the time of the last password sign-in.

The sign-in email is sent via an email delivery provider (SMTP). Legal basis: performance of the contract and steps prior to entering into it (Art. 6 (1) (b) GDPR).

6.Organizations, websites and settings

For each organization we store its name, the websites (name, domain, time zone, language) and the settings made by its members, for example brand terms, content groups, topic clusters, URL targets, annotations (with a reference to the member who created them) and the recipients of the weekly report (email addresses).

Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).

7.Google connections

To import data, an owner or admin of an organization connects a Google account. The connection uses Google's OAuth procedure: you sign in at Google and grant SEO Cockpit access there. SEO Cockpit only requests read-only access:

• openid and email – identification of the connected Google account (Google account ID and email address),
• webmasters.readonly – read access to Google Search Console,
• analytics.readonly – read access to Google Analytics 4 (optional).

We store the Google account ID and email address as well as the access and refresh tokens issued by Google. The tokens are stored encrypted (AES-GCM) and are used only to call the following Google interfaces: Google Search Console API (search performance, sitemaps, URL inspection), Google Analytics Admin API (list of accessible properties) and Google Analytics Data API (reports).

When calling these interfaces, SEO Cockpit's server transmits the tokens and the requested property and report parameters to Google. Google processes this data under its own responsibility; see Google's privacy policy (opens in a new tab). SEO Cockpit uses data received from Google APIs only to provide its functions; it does not use it for advertising and does not sell it. The use complies with the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

When a connection is disconnected, the stored tokens are deleted and, unless the same Google account is still connected in another organization, the access is also revoked at Google. You can remove SEO Cockpit's access at any time in your Google account under Third-party connections (opens in a new tab).

Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).

8.Search Console and Analytics data

For the websites of an organization, SEO Cockpit imports and stores:

• Search Console performance data: search queries, pages, countries, devices and search appearance with clicks, impressions, CTR and position (Google itself withholds rare, anonymized search queries),
• URL inspection results and sitemaps as reported by Google,
• Google Analytics 4 reports in aggregated form: sessions, users (as daily totals), engagement, landing pages, channels, sources and key events. No data about individual visitors is imported.

This data belongs to the respective customer. It usually contains no personal data; search queries or addresses can contain personal data in individual cases. Insofar as that is the case, SimpleWebDesign processes this data on behalf of the customer (Art. 28 GDPR).

9.Analyses, alerts and reports

Analyses, rule-based alerts and reports are calculated from the stored data. PDF reports are generated on SEO Cockpit's server; no external PDF service is used. The weekly report is sent by email to the recipients entered by the organization; for each delivery we store the time, status and number of recipients.

10.Access via MCP (optional)

An organization can create access tokens for the Model Context Protocol (MCP), for example to query its SEO data from ChatGPT or another MCP client. MCP access is read-only and limited to the data of this organization.

Of each token we store only a SHA-256 hash and a short prefix, the name, the creator, the scope and the times of creation, last use, revocation and expiry. Errors during an MCP request are logged with the organization and token identifier, without the content of the request.

Data retrieved via MCP is sent to the client the customer has connected. Its further processing is the responsibility of the customer and the provider of that client.

Connection from ChatGPT (OAuth): an owner or admin can connect SEO Cockpit as an app in ChatGPT (OpenAI). To do so, they sign in to SEO Cockpit, choose exactly one organization and expressly allow read-only access (permission “seo:read”). We store the connection (user, organization, app, permission, and the times of creation, last use and disconnection), the public details of the app (name, address, redirect addresses) and authorization codes, access tokens and refresh tokens, all of them only as SHA-256 hashes. Access tokens are valid for one hour, refresh tokens for 30 days; a refresh token is replaced on every use.

ChatGPT then retrieves the SEO data of this organization (e.g. search queries, URLs, clicks, impressions, indexing and analytics figures) read-only; SEO Cockpit sends it to OpenAI so that ChatGPT can answer the request. Google credentials are never transmitted. The further processing at OpenAI is governed by the OpenAI privacy policy (opens in a new tab). Under “Connected apps” in the organization settings, an owner or admin can disconnect at any time; all tokens of the connection become invalid immediately. Access also ends when the user is no longer owner or admin of the organization. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

11.Recipients and processors

Personal data is only disclosed as far as necessary to provide SEO Cockpit or as far as you have consented:

• a hosting provider that operates the servers and the database (processor),
• an email delivery provider for sign-in links and weekly reports (processor),
• Google, when the Google interfaces are called (see “Google connections”),
• Google Ireland Limited for Google Tag Manager and Google Analytics 4 as our processor, only on the public pages and only after your consent (see “Consent and statistics”),
• Paddle.com, the seller (merchant of record) of paid subscriptions: Paddle processes the data required for ordering, payment processing, invoicing, tax handling and, where applicable, refunds as an independent controller, not as our processor. When a trial or subscription is started, SEO Cockpit transmits the email address of the member starting it, the language, the country, an internal reference to the organization and the number of active websites. Payment details such as card or bank data are entered only at Paddle; SEO Cockpit does not receive them. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). Further information can be found in Paddle's privacy notice,
• OpenAI (ChatGPT), once an owner or admin has allowed the connection (see “Access via MCP”), as well as other MCP clients and report recipients chosen by the customer.

We do not sell personal data and do not pass it on for advertising purposes.

12.Transfers to third countries

When the Google interfaces are used, processing by Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework. The same applies to Google Tag Manager and Google Analytics after your consent; according to Google, transfers to the USA are based on the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR), and additionally on standard contractual clauses. If an organization connects SEO Cockpit with ChatGPT, the retrieved data is sent to OpenAI; processing in the USA cannot be ruled out. Beyond that, data is only transferred to countries outside the EU/EEA if the requirements of Art. 44 et seq. GDPR are met.

13.Cookies and local storage

The SEO Cockpit app (dashboard, sign-in, connection with ChatGPT) only uses cookies and browser storage that are technically necessary to provide the service you requested; no consent is required for this and there is no tracking. On the public pages, Klaro additionally stores your consent choice. Statistics cookies of Google Analytics are only set on the public pages and only after your consent (see “Consent and statistics”). There are no marketing or advertising cookies.

14.Retention

• Sign-in sessions end after 30 days without use or on sign-out.
• Sign-in links are valid for 15 minutes and are deleted once used.
• Google access tokens are deleted when the connection is disconnected.
• Account, organization, website and settings data as well as the imported Google data, alerts and reports are stored while the organization uses SEO Cockpit; the history of the imported data is part of the service. When a trial or subscription ends, this data is not deleted automatically, so that the organization can continue with SEO Cockpit under a new subscription later. The customer can request its deletion at any time, subject to statutory retention obligations and other mandatory storage obligations.
• MCP tokens remain recorded after revocation (only hash and metadata) so that past access remains traceable, until the organization is deleted.
• Connections to apps such as ChatGPT remain recorded after disconnection (without valid tokens) so that past access remains traceable, until the user or the organization is deleted. Expired authorization codes and tokens are deleted no earlier than one day after they expire.
• Your consent choice (cookie “klaro”) expires after 1 year; after that we ask again.
• Logs of the hosting environment are kept only as long as necessary for operation and security.

15.Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR), where the processing is based on a contract or consent,
• object to processing based on legitimate interests (Art. 21 GDPR).

Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7 (3) GDPR); the lawfulness of the processing carried out until the withdrawal remains unaffected. SEO Cockpit bases only the statistics on the public pages (Google Analytics) on consent; you can withdraw it via “Cookie settings” at the bottom of every public page.

To exercise your rights, please contact info[at]simplewebdesign.at.

16.Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at (opens in a new tab).