Privacy Policy

This is the privacy policy of Aevonix B.V. — KinetixSEO ("KinetixSEO", "we", "us", or "our"), provider of the KinetixSEO SaaS platform: a free and paid SEO audit and AI-citation ("GEO") readiness checker. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national implementing legislation.

1. Controller contact details

We are not required to appoint a Data Protection Officer (DPO). For privacy questions, contact privacy@kinetixseo.com or use the contact form.

2. What personal data we process

2.1 Account data

• Name and email address
• Hashed password (we never see or store the plaintext password)
• Registration timestamp and IP address
• Plan, credit/wallet balance, and billing history

2.2 Scan and audit data

• URLs and domains you submit for a free or paid SEO/AI-citation check, including the resulting report: SEO health score, AI-citation ("GEO") readiness score, category breakdowns, and AI-generated fix recommendations
• Free checks (/seo-check) do not require an account or email address. Each result gets a shareable link — treat that link as public, since anyone with it can view the report. You choose how long we keep it: leave the box on the check form ticked and the report is deleted after 90 days, or untick it and we delete it after 36 hours (see §5). Report pages are marked noindex, so search engines are asked not to list them
• Tracked sites, tracked keywords, competitor comparisons, and generated landing pages tied to your account

2.3 Billing data

• Company name, billing address, and VAT number, if you supply them for invoicing
• Purchase and invoice history
• Payments are processed by Mollie, Stripe, or Coinbase Commerce — we do not store your card number, bank details, or crypto wallet keys ourselves

2.4 Technical and security data

• IP addresses (login, registration, and free-check submissions — used for rate limiting and abuse prevention)
• Session cookie
• Browser type and operating system (User-Agent header)
• Login/logout timestamps and failed login attempts
• Error messages and request traces, processed by our self-hosted monitoring stack (see §4)

2.5 Email communications

Email addresses are used for transactional messages: password resets, purchase receipts and invoices, and replies to the contact form. We do not send marketing email unless you opt in.

3. Purposes and legal bases

We do not build behavioural profiles of you as a person (GDPR art. 4(11)) — our AI analysis evaluates the URL or page you submit, not your personal traits or preferences. One automated check does act on you directly without a human involved at that moment: after several failed payment attempts for the same email, checkout is automatically paused for a short, fixed period as a fraud safeguard; you can simply try again once it lifts, and no permanent decision is made. Whether this qualifies as automated decision-making under GDPR art. 22 is under legal review; if it does, you have the right to request human review of that pause. Every other decision with a legal or similarly significant effect on you, such as suspending an account, is made by a person.

4. Sub-processors and third parties

Running a scan means sending the URL/domain you provide, and in some cases the page content it links to, to the third parties below. We never sell personal data.

The Role column distinguishes the two legal relationships this table mixes: processor means the recipient acts only on our instructions and under our processor agreement (GDPR art. 28); independent controller means the recipient decides its own purposes for the data it receives — payment providers process your payment for their own regulatory, fraud-prevention, and accounting obligations, not just ours. Their own privacy notices govern that separate processing.

Where a processor transfers data outside the EEA, we rely on EU Standard Contractual Clauses (SCCs, decision EU 2021/914). Payment providers' own cross-border transfers are governed by their own privacy notices, since that processing is theirs, not ours to contract around.

The self-hosted error/performance monitoring above (Grafana Faro) only runs in your browser after you accept the cookie banner — see our Cookie Policy for what it stores and how to withdraw consent.

5. Retention periods

6. Security

• Encryption in transit: TLS for all connections
• Passwords: hashed with bcrypt — never stored or transmitted in plaintext
• Sessions: HTTP-only, secure cookies
• Rate limiting: applied to login, registration, and free-check submissions

If a personal data breach poses a risk to your rights and freedoms, we report it to the competent supervisory authority within 72 hours of becoming aware of it (GDPR art. 33). If the breach is likely to result in a high risk to you, we additionally notify affected users without undue delay (GDPR art. 34).

7. Your rights

We respond within four weeks.

8. Complaints

If you are dissatisfied with how we handle your data, please contact privacy@kinetixseo.com first. You also have the right to lodge a complaint with your national data protection authority — for the Netherlands, that is the Autoriteit Persoonsgegevens.

9. Changes to this policy

We may update this policy when our services or applicable law require it. For material changes we will notify active account holders by email at least 30 days before the effective date.