Privacy Policy

This is the privacy policy of Aevonix B.V. — KinetixSEO ("KinetixSEO", "we", "us", or "our"), provider of the KinetixSEO SaaS platform: a free and paid SEO audit and AI-citation ("GEO") readiness checker. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national implementing legislation.

1. Controller contact details

We are not required to appoint a Data Protection Officer (DPO). For privacy questions, contact privacy@kinetixseo.com or use the contact form.

2. What personal data we process

2.1 Account data

• Name and email address
• Hashed password (we never see or store the plaintext password)
• Registration timestamp and IP address
• Plan, credit/wallet balance, and billing history

2.2 Scan and audit data

• URLs and domains you submit for a free or paid SEO/AI-citation check, including the resulting report: SEO health score, AI-citation ("GEO") readiness score, category breakdowns, and AI-generated fix recommendations
• Free checks (/seo-check) do not require an account or email address. Each result gets a shareable link — treat that link as public, since anyone with it can view the report. You choose how long we keep it: leave the box on the check form ticked and the report is deleted after 90 days, or untick it and we delete it after 36 hours (see §5). Report pages are marked noindex, so search engines are asked not to list them
• Scan statistics. Either way, each free check also adds one row to our scan statistics: the two scores, which findings were present, the top-level domain (such as .nl), whether the site uses HTTPS, and the scan date. It never contains the URL, the page path, the page content or anything about who ran the check. The site is identified only by a keyed hash of its domain, so repeat scans of one site count once; that makes the data pseudonymous rather than anonymous, and we publish only aggregates from it. Audits of your own pages run from an account are not included. Scheduled competitor checks are included, the same way, with no link to the account that tracks the competitor. So are the scans we run ourselves: research scans of public websites, and scans of sites we consider contacting for outreach
• Tracked sites, tracked keywords, competitor comparisons, and generated landing pages tied to your account

2.3 Billing data

• Company name, billing address, and VAT number, if you supply them for invoicing
• Purchase and invoice history
• Payments are processed by Mollie, Stripe, or Coinbase Commerce — we do not store your card number, bank details, or crypto wallet keys ourselves

2.4 Technical and security data

• IP addresses (login, registration, and free-check submissions — used for rate limiting and abuse prevention)
• Session cookie
• Where your visit came from: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), the website that linked to us, and which page you landed on (the page type, never a private link's code). We keep this in your session, using the same session cookie as the rest of the site; on a few pages that otherwise set no cookie, a link with campaign tags sets the session cookie for this. If you create an account, it is stored with your account, together with the app you were connecting (such as Claude or ChatGPT) if you signed up while connecting it. If you do not, it ends with the session
• Browser type and operating system (User-Agent header)
• Login/logout timestamps and failed login attempts
• Error messages and request traces, processed by our self-hosted monitoring stack (see §4)

2.5 Email communications

Email addresses are used for transactional messages: password resets, purchase receipts and invoices, and replies to the contact form. We also send account messages: onboarding tips and, when an account has been inactive for three months or more, a reminder of what changed — each with an unsubscribe link. Inactive Free accounts receive deletion notices 30 days, 7 days and 1 day before deletion; those cannot be unsubscribed from.

Marketing email (an occasional offer, such as a free plan trial or free credits, or an announcement of something new in KinetixSEO) is sent only if you said yes. We ask during onboarding, or on your dashboard until you answer, and nothing is ticked in advance: no answer means no. We record when and where you answered as proof of your consent. You can withdraw it at any time under Notification settings or with the unsubscribe link in every marketing email; withdrawing never affects your account or the account messages above, which are not marketing email (that includes the onboarding tips and the inactivity reminder of what changed).

2.6 Google Analytics data (only if you connect it)

You can connect a Google Analytics 4 property to a tracked site, so we can show how many visits reach that site from AI assistants (such as ChatGPT or Perplexity) and from search engines. Nothing is read until you click Connect with Google and approve access on Google's own consent screen. We ask for one permission: read-only access to your Analytics data (analytics.readonly). We cannot change anything in your Google account or Analytics settings.

• What we read: the list of Analytics properties your Google account can see, so you can pick one; the email address of that Google account, if Google provides it, so the connection card can show which account is connected; then, for the property you picked, the number of sessions per day per landing page, for traffic sources we recognise as AI assistants and search engines only. If you enter a conversion event name, we check that the event exists and then read the number of sessions per day in which it happened
• What we store: those daily visit and conversion counts per source and landing page. These are totals: Google Analytics gives us no data about individual visitors, and we ask for none. We never request paid, email or social traffic, and drop any non-search, non-referral row that comes back. We also store the property you picked, the connected account's email address (if provided), and the access and refresh tokens Google issues. While you pick a property (at most 15 minutes) those tokens sit in our server-side cache; once you have picked one they are stored encrypted
• How we use it: only to show these numbers to you, in your site's AI referral report and in client reports you choose to create and share. We do not sell it, use it for advertising, send it to AI models, use it to train any AI model, or show it to other customers. No KinetixSEO staff reads it, except with your permission to help with a support request, when needed for security, or to comply with the law
• Disconnecting: when you disconnect, we ask Google to revoke our access and delete the stored tokens and every imported number straight away (a client report you shared may show the old numbers for up to 15 minutes more, until its cached copy expires). You can also remove our access yourself at any time at myaccount.google.com/permissions; imports then stop, and the stored numbers are deleted when you disconnect, delete the site, or delete your account

KinetixSEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Purposes and legal bases

We do not build behavioural profiles of you as a person (GDPR art. 4(11)) — our AI analysis evaluates the URL or page you submit, not your personal traits or preferences. One automated check does act on you directly without a human involved at that moment: after several failed payment attempts for the same email, checkout is automatically paused for a short, fixed period as a fraud safeguard; you can simply try again once it lifts, and no permanent decision is made. Whether this qualifies as automated decision-making under GDPR art. 22 is under legal review; if it does, you have the right to request human review of that pause. Every other decision with a legal or similarly significant effect on you, such as suspending an account, is made by a person.

4. Sub-processors and third parties

Running a scan means sending the URL/domain you provide, and in some cases the page content it links to, to the third parties below. We never sell personal data.

The Role column distinguishes the two legal relationships this table mixes: processor means the recipient acts only on our instructions and under our processor agreement (GDPR art. 28); independent controller means the recipient decides its own purposes for the data it receives — payment providers process your payment for their own regulatory, fraud-prevention, and accounting obligations, not just ours. Their own privacy notices govern that separate processing.

Where a processor transfers data outside the EEA, we rely on EU Standard Contractual Clauses (SCCs, decision EU 2021/914). Payment providers' own cross-border transfers are governed by their own privacy notices, since that processing is theirs, not ours to contract around.

The self-hosted error/performance monitoring above (Grafana Faro) only runs in your browser after you accept the cookie banner — see our Cookie Policy for what it stores and how to withdraw consent.

5. Retention periods

6. Security

• Encryption in transit: TLS for all connections
• Passwords: hashed with bcrypt — never stored or transmitted in plaintext
• Sessions: HTTP-only, secure cookies
• Rate limiting: applied to login, registration, and free-check submissions

If a personal data breach poses a risk to your rights and freedoms, we report it to the competent supervisory authority within 72 hours of becoming aware of it (GDPR art. 33). If the breach is likely to result in a high risk to you, we additionally notify affected users without undue delay (GDPR art. 34).

7. Your rights

We respond within four weeks.

8. Complaints

If you are dissatisfied with how we handle your data, please contact privacy@kinetixseo.com first. You also have the right to lodge a complaint with your national data protection authority — for the Netherlands, that is the Autoriteit Persoonsgegevens.

9. Changes to this policy

We may update this policy when our services or applicable law require it. For material changes we will notify active account holders by email at least 30 days before the effective date.