1. Who we are
The Service is operated by SiteRefiner ("we", "us"). We are the data controller for the personal data described in this policy, except where section 2.2 says otherwise.
Questions, requests and complaints: [email protected].
2. What we collect and why
2.1 Account and contact data
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Name, email address, password (stored hashed) | You, at sign-up | Create and secure your login | Contract |
| Google account ID, email address and name | Google, if you sign in with Google | Create and identify your login | Contract |
| Business name, phone number | You, during onboarding | Name your account and contact you about it | Contract |
| Plan and trial dates | Generated | Run your trial and subscription | Contract |
| Two-factor secrets, passkeys, recovery codes | You, if enabled | Secure your login | Contract; legitimate interest in security |
| People you invite (name, email, role) | You | Let your team use your account | Contract |
2.2 Website and check data
When you add a website to the Service we store its address and sitemap, and the results of every check you switch on: the page content and metadata we crawl, the links we test and their status, and performance scores from Google's PageSpeed Insights API. We do not take screenshots of your pages. Where you connect Google services we store the data described in section 5.
Check results are business data about websites, but they can include personal data that appears on those pages (for example an author's name in a byline) or in the analytics you connect. For that data you, or the client whose website it is, are the controller and we are your processor: we process it only to produce your reports and on your instructions. You are responsible for having the right to audit the websites you add and to share the Google properties you connect.
2.3 Content generation
If you use content generation, the topic, the site profile we build (purpose, audience, tone, existing content), research notes, drafts and the final article are stored on your account, and the text is sent to our AI model provider (section 7) to be researched, written and edited. Do not include personal data in topics or instructions unless you need it in the published piece.
2.4 Usage and technical data
Server logs (IP address, browser user agent, requested URL, timestamp), session identifiers and error reports, kept to run and secure the Service. Legal basis: our legitimate interest in operating a secure service.
The marketing website sets no analytics or advertising cookies and does not load third-party tracking scripts.
2.5 Support
Emails you send us and messages sent through the contact form, kept to answer you. Legal basis: legitimate interest in answering you.
3. What we do not do
- We do not sell personal data.
- We do not use your data, your clients' website data or Google data for advertising, and we do not build advertising profiles.
- We do not use data from your account to train AI models. Our AI model provider is contractually prohibited from training on the data we send it.
- We do not share data between customer accounts. Each account only sees its own websites.
5. Google user data
This section describes our use of information received from Google APIs. It covers both ways you can give the Service access to Google.
5.1 Sign in with Google
If you choose to sign in with Google we request the openid, email and profile scopes. We receive your Google account's unique identifier, email address and name. We use them only to create and identify your SiteRefiner login and to keep it linked to your Google account. We do not read your Gmail, Drive, Contacts, Calendar or any other Google data through sign-in. If the email address matches an existing SiteRefiner login, we link the two only when Google reports the address as verified.
5.2 Connecting a website to Google services
To run the Search Console, Index Coverage, SEO Opportunity, Google Analytics 4, Conversion Funnel, Tag Manager and Google Ads checks on a website, the Service needs read access to that website's Google properties. You can give it in one of two ways:
- Share with a service account. You add the Service's service account as a read-only user on the Google Analytics property, Search Console property or Tag Manager container. Access is limited to exactly the properties you share.
- Connect with Google. You authorise the Service through Google's consent screen. We request only read-only scopes:
https://www.googleapis.com/auth/analytics.readonly- read Google Analytics 4 reports for the connected property, including the Google Ads performance data that Google exposes through the property's Ads link.https://www.googleapis.com/auth/webmasters.readonly- read Search Console performance and index-coverage data for the connected property.https://www.googleapis.com/auth/tagmanager.readonly- read the configuration of the connected Tag Manager container.https://www.googleapis.com/auth/adwords- only if you connect a Google Ads account directly: read campaign, keyword and search-term performance and spend. We never create, change or pause anything in your Ads account.
5.3 How we use Google user data
We use this access solely to read the traffic, search performance, index status, tag configuration and advertising performance data of the specific websites you connect, and to turn that data into the reports, charts, scores, written narratives, keyword lists and content briefs you see in the Service for that website. The written narratives are produced by sending the relevant figures to our AI model provider, acting as our processor, as described in section 7. We do not use Google user data for any other purpose.
We store the data we read on your account, scoped to that website, so that reports can be compared over time. Where you connect with Google we also store the OAuth refresh token needed to keep reading on the schedule you set. Tokens and uploaded keys are encrypted at rest.
We do not use Google user data for advertising, we do not sell it, we do not share it with third parties except the sub-processors in section 7 to the extent needed to provide the Service to you, and we do not use it to train AI models. People who work for SiteRefiner read Google user data only with your permission when you ask for support, where it is needed to investigate a security problem, or where the law requires it. Any such access happens through a logged impersonation that is visible to you in the audit log.
5.4 Revoking access and deleting Google user data
- You can disconnect Google from any website at any time from that website's settings in the application. Disconnecting deletes the stored token. Removing the service account from a property has the same effect.
- You can also revoke the Service's access from your Google Account permissions page. We stop reading at the next scheduled run.
- Deleting a website in the application deletes every check result, stored report and token for it. Deleting your account deletes everything on it. Either way the stored Google user data is gone within 30 days, including from backups.
- To have the stored Google user data for a website deleted sooner, or to ask what we hold, email [email protected].
5.5 Limited Use disclosure
SiteRefiner's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Where data is stored
Our servers and backups run with a cloud infrastructure provider in the United Kingdom or the European Economic Area. Where we transfer personal data outside the United Kingdom or the European Economic Area, for example to the sub-processors below, we rely on adequacy regulations or standard contractual clauses and the UK addendum.
7. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Cloud infrastructure provider | Servers, database, backups | The United Kingdom or the European Economic Area |
| Google LLC | PageSpeed Insights API, Analytics, Search Console, Tag Manager and Ads APIs, Sign in with Google | USA, with UK and EU transfer safeguards |
| AI model provider | Written narratives, content research, writing and editing. Receives only the figures or text needed for the task. Contractually barred from training on it | USA, with UK and EU transfer safeguards |
| Email delivery provider | Transactional email such as password resets and verification links | The United Kingdom or the European Economic Area |
The named entities behind these categories are available on request from [email protected]. We will update this list before adding a sub-processor that processes personal data, and account owners can object by closing their account.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and user data | While your account exists, then deleted within 30 days |
| Check run history, including data read from Google | 180 days. The latest successful run of each check is kept while the website exists in your account, so a report never goes blank |
| Content drafts and published pieces | While the website exists in your account |
| Google OAuth tokens and uploaded keys | Until you disconnect, delete the website or delete your account |
| Server logs | 30 days |
| Support emails and contact-form messages | 2 years |
Deleting a website in the application deletes its check history, content and tokens. Deleting your account deletes everything on it. Backups are overwritten within 30 days.
9. Your rights
Under UK GDPR and, where it applies, EU GDPR you can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to processing; export it in a portable format; and withdraw consent where consent is the basis. You can change your profile, security settings and delete your own login in the application. For anything else, including closing a whole account, email [email protected]. We answer within one month.
You can complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority. We would rather hear from you first.
10. Security
Passwords are stored hashed. Two-factor authentication and passkeys are available on every account. Google tokens and uploaded keys are encrypted at rest. Every website address you enter is checked against a public-host rule before our crawler visits it. Every website, check and draft belongs to one account, and staff access to customer data happens only through a logged impersonation. We will notify you and, where required, the regulator without undue delay if a breach affects your personal data.
11. Children
The Service is for businesses and is not directed at anyone under 18.
12. Changes
We will post changes here and update the date at the top. For material changes we will email account owners before they take effect.
13. Contact
SiteRefiner. [email protected].
See also the Terms of Use and the security overview.