Privacy policy

1. In short

SEOgrinder checks publicly accessible websites. You do not need an account. We do not use cookies, analytics or advertising tools, or fonts or scripts from third-party servers. One exception is described in section 4: the preview image of the checked website in the report. In addition, all traffic runs through Cloudflare (section 3). What else we process is described in the sections below.

2. Controller

The controller for the data processing on this website is:

3. Hosting, Cloudflare and log files

We run SEOgrinder on a server of Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany. A data processing agreement is in place with the hosting provider, who processes your data only on our instructions.

In front of our server stands the service “Cloudflare” (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare manages the DNS records of our domain and routes all traffic to this website through its worldwide network: your browser connects to Cloudflare, and Cloudflare connects to our server. In doing so, Cloudflare processes your full IP address, date and time, the requested address including the address you have us check (it is part of the request), the referring page and your browser’s user agent. For this, Cloudflare briefly decrypts the traffic and encrypts it again towards our server. The purpose is fast and secure delivery and protection against attacks and abuse. We have not switched on any Cloudflare features that set cookies.

Our server takes over your address from Cloudflare. The access log below and the request limits in section 5 therefore work with your address, not with Cloudflare’s.

The legal basis is Art. 6(1)(f) GDPR (error-free and secure provision of this service). A data processing agreement is in place with Cloudflare (part of Cloudflare’s terms of service). The transfer to the USA is based on Cloudflare’s certification under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/participant/5666) and on the standard contractual clauses of the EU Commission. More in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.

On every request the web server writes to an access log: a shortened IP address (for IPv4 without the last number field, for IPv6 only the first 48 bits), date and time, the requested path without query parameters (so the address you have checked does not appear there), the status code, the amount of data, the referring page (referrer) if your browser sends one, and your browser’s user agent. In the error log of the web server your full IP address and the full request may appear in case of a fault, including the address you are checking and the referring page. Both logs are deleted automatically after 15 days at the latest. If an error occurs in the service itself, an operating log may contain parts of the request; it is deleted after 7 days.

The purpose is secure and stable operation (troubleshooting, protection against abuse). The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a working service that is protected against abuse.

4. Checking a website

When you enter an address and start a check, your browser sends the address and your settings (language, device) to our server. The server fetches the page and further pages of the same website (up to 500 requests), plus robots.txt, the sitemap, individual images and links, and analyses them. The report is sent back to your browser.

These requests come from our server, not from your device. The operator of the checked website therefore sees the address of our server and the addition “SEOgrinder/1.0 (+https://seogrinder.com)” in the user agent, not your IP address. During the crawl of further pages the server follows the disallow rules of robots.txt and a crawl delay of up to 60 seconds. The individual checks of the entered page (fetching the page, response time, redirects, individual links and images, preview image, samples from the sitemap, test of delivery to AI crawlers) run independently of robots.txt. The server fetches at most two addresses at a time from any one website.

In the report, your browser loads the preview image (og:image) and, where applicable, the icon of the checked website directly from that website’s server. That server learns your IP address and browser identifier, but not the referring page (we send no referrer). This is the only connection of your browser to a third-party server.

Apart from the log files and counters described in sections 3 and 5, all that remains on the server after a check is a cache: the finished report is kept in memory for up to 24 hours so that the same website is not fetched repeatedly, and anyone who checks the same address receives it. Campaign identifiers such as gclid or utm_… are removed from the address beforehand. The report contains the measurements of the checked website, no IP address and nothing about you, and is not written to disk. For visitors the service keeps no history per website and no archive of reports.

The legal basis is Art. 6(1)(b) GDPR (carrying out the check you requested) and Art. 6(1)(f) GDPR (orderly operation that is considerate to other websites).

5. IP address and request limit

To keep the service available to everyone and to prevent it from being used to overload other websites, we limit the number of requests: per IP address (for IPv6 per /64 network) and per network (for IPv4 the addresses sharing the first three number fields, for IPv6 the first 48 bits) per hour and per day, plus one running check per address. For this the service counts your IP address and the times of your checks, retrievals of finished reports from the cache, uploads and requests for keyword ideas.

These counters exist in memory only. They are not stored and not linked to other data. An entry disappears once its time windows (one day at most) have passed, at the latest when the service restarts. The legal basis is Art. 6(1)(f) GDPR (protecting the service and third parties from overload).

6. Speed measurement by Google PageSpeed Insights

To measure loading speed, our server sends the address of the checked page to Google’s PageSpeed Insights API. Google fetches the page itself and returns the measurements. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing may also take place at Google LLC in the USA.

The request comes from our server. Google does not receive your IP address or any information about your browser. Only the address of the checked page and the settings of the measurement (device, language) go to Google. If a person can be identified at that address, it is that person’s data, so please enter only addresses you are entitled to check.

The legal basis is Art. 6(1)(b) GDPR (the measurement is part of the check you requested). The transfer to the USA relies on the certification of Google LLC under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/participant/5780). More in Google’s privacy policy.

7. Uploading a Search Console export

You can upload the export of your Google Search Console (ZIP or CSV) so that it is analysed alongside the check. The file goes to our server and is analysed there in a separate process, in memory only and only for as long as the analysis takes. The service does not store it. The web server in front of it may briefly buffer larger files in a temporary file during the transfer, which it deletes afterwards. The result stays in your browser (next section). For the comparison the server fetches up to 140 public addresses of your website.

Signing in to Google or access to your Google account is not possible on this website. The legal basis is Art. 6(1)(b) GDPR.

8. Storage in your browser

SEOgrinder sets no cookies. Your browser does, however, store data locally on your device (Local Storage): the chosen language (only if you choose one yourself), the most recently checked addresses (up to eight), the latest reports, tasks marked as done and analyses of uploaded Search Console exports.

This data does not leave your device and is not transmitted to us. You delete it with “Clear” under “Recent analyses” (except the language choice) or in your browser settings. The storage serves only the function you are using and is necessary for it (§ 25(2) no. 2 TDDDG).

9. What we do not use

No cookies, no sign-in, no tracking or audience measurement, no advertising, no embedding of fonts, scripts, maps or videos from third-party servers (for the preview image in the report see section 4, for Cloudflare section 3). The fonts of this site are on our server. Links to other websites (for example to PageSpeed Insights or Search Console) are plain links: the provider only learns of your visit once you click.

10. Your rights

You have the right to information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent at any time with effect for the future. Because of the short retention periods and the shortened address, we often cannot tell which data belongs to you; in that case we cannot give you information either.

Write to us at business@pfcapital.de. You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

11. Encryption

This site is delivered encrypted over HTTPS: between your browser and Cloudflare, and from there to our server. Cloudflare briefly decrypts the traffic in order to forward it (section 3); other third parties cannot read it on the way.

12. Changes

If the service changes, we will adapt this policy. The date above gives its status.