Privacy Policy
Official privacy disclosures, data processing boundaries, and Google API Limited Use commitments for EulerSEO.
This Privacy Policy is provided by EulerHive Inc. ("EulerHive", "we", "us", or "our"), operating the EulerSEO website intelligence platform accessible at https://eulerseo.com. EulerSEO delivers deterministic, evidence-backed technical SEO audits, Core Web Vitals diagnostics, and multi-source search engine analytics.
[Note: Corporate registration and registered office particulars are maintained in internal operator corporate records and are available upon formal inquiry to privacy@eulerhive.com.]
1. Introduction & Scope of this Policy
At EulerHive Inc., we take personal privacy, transparent data governance, and data security seriously. This Privacy Policy describes how we collect, store, process, protect, and disclose information when you visit our website, create an account, initiate autonomous website crawls, or connect third-party platforms such as Google Search Console, Google Analytics 4, Google Merchant Center, Google Business Profile, and Bing Webmaster Tools.
This Policy applies to all individuals who access or use EulerSEO ("Users", "you", or "your"), including website visitors, individual developers, digital marketing professionals, agency leads, and enterprise account administrators.
By creating an account, accessing EulerSEO, or submitting a website domain for automated technical analysis, you acknowledge that you have read and understood the practices described in this Privacy Policy. If you do not agree with this Policy, please do not use our service or connect external accounts.
2. Information We Collect
We collect only the categories of information strictly required to deliver our deterministic website intelligence platform, maintain account security, and fulfill user-requested integrations. We organize collected data into distinct categories:
A. Account & Identity Information
When you register for an account or authenticate into EulerSEO, we collect:
- Email Address: Used as your primary account identifier, for session authentication, security notifications, and password recovery.
- Full Name / Display Name: Optional name provided by you or retrieved from your authorized SSO identity provider.
- Profile Picture / Avatar URL: Optional avatar retrieved from your authorized SSO provider (Google or Microsoft) for display in your account header.
- Encrypted Credentials: When using email and password authentication, your password is encrypted using the cryptographic Argon2id hashing algorithm with a unique per-password salt. We never store or transmit your password in plaintext.
- Account Identifiers & Timestamps: Internal pseudonymous user identifier (
usr_[uuid]), account creation timestamp, and last login timestamp.
B. Website Crawl & Technical Audit Data
When you submit a domain or URL for technical SEO analysis, EulerSEO's autonomous crawler fetches and parses public web pages. We collect and store:
- Page URLs & Network Telemetry: Requested URLs, normalized canonical URLs, HTTP response status codes (e.g. 200, 301, 404), response times in milliseconds, response sizes, and HTTP response headers.
- HTML Structure & Metadata: Page titles, meta descriptions, canonical declarations, OpenGraph / Twitter social metadata, robots directives (
<meta name="robots">andX-Robots-Tagheaders), and heading hierarchies (H1 through H6). - Links & Architecture: Internal hyperlinks, outbound external hyperlinks, anchor texts,
relattributes (e.g.nofollow,noopener), and internal link graph topology. - Structured Data & Assets: Schema.org structured data (JSON-LD and microdata), image URLs, image
alttext, and image dimensions. - DOM Rendering State: In headless browser audit mode, we capture the static raw HTML source and the hydrated runtime JavaScript DOM to compute 6-state DOM differences.
- Robots.txt & Sitemaps: The target domain's
robots.txtfile and declared XML sitemaps to verify crawler directives according to RFC 9309.
C. Connected Third-Party Account Information
Connecting external search, analytics, and business platforms is completely optional. If you choose to connect an external account via OAuth 2.0, we access only the specific scopes you authorize:
D. Technical & Operational Metadata
IP addresses (collected for security rate limiting, session verification, and anti-abuse defense), browser type and version, operating system, timestamped session records, and crawl execution logs.
E. Communications & Support Inquiries
When you contact us via email, submit bug reports, or request technical support, we retain your email address, message body, and relevant diagnostic crawl IDs to resolve your inquiry.
3. How We Use Information
We use collected information strictly for explicit, transparent product purposes:
Evaluating 77 deterministic rules across technical SEO, indexability, metadata, structured data, Core Web Vitals, and site architecture.
Comparing static HTML against hydrated client-side JavaScript DOM to identify search engine rendering discrepancies.
Correlating crawl defects with real-world organic impressions, CTR, and traffic from connected Google and Bing accounts.
Tracking defect remediation across crawl lifecycles (open, in_progress, verified_fixed).
Enforcing Server-Side Request Forgery protections, rate throttling, and preventing denial of service against scanned web hosts.
Investigating technical issues, responding to user inquiries, and complying with statutory obligations under applicable law.
4. Google API Services User Data Policy & Limited Use Disclosures
EulerSEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When you choose to connect Google services to EulerSEO, we request only the minimal scopes required to display your search performance, analytics, merchant feed diagnostics, and local business insights alongside your crawl findings:
https://www.googleapis.com/auth/webmasters.readonlyScope & Use: Read-only access to view Search Console properties, search performance metrics (clicks, impressions, position, queries), and live URL inspection status. We use this data strictly to correlate search engine performance with technical on-page SEO issues discovered during website crawls.
https://www.googleapis.com/auth/analytics.readonlyScope & Use: Read-only access to view GA4 web property reporting metrics (sessions, total users, engagement rates, landing page visits, acquisition channels). We use this data to illustrate the real-world traffic impact of identified technical defects.
https://www.googleapis.com/auth/contentScope & Use: Access to view merchant product feeds, product disapproval issues, and price/availability attributes to audit eCommerce product structured data against active Merchant Center listings.
https://www.googleapis.com/auth/business.manageScope & Use: Access to view and manage authorized local business locations, verify NAP consistency against website schema, view customer reviews, and post authorized responses.
openid email profileScope & Use: Non-sensitive identity scopes used strictly to verify your email address and display your avatar/name when logging in via Google Sign-In.
Mandatory Limited Use Commitments:
- User-Facing Delivery Only: Google user data is accessed, processed, and displayed solely to provide and improve the user-facing SEO and analytics features prominent in EulerSEO's user interface.
- No Sale of Google User Data: We never sell, lease, license, or monetize Google user data under any circumstances.
- No Advertising or Retargeting: Google user data is never used or transferred for serving advertisements, interest-based advertising, retargeting, or personalized marketing.
- No Creditworthiness Assessments: Google user data is never used to determine creditworthiness or for lending, insurance, or employment purposes.
- No Model Training: Google user data (including Search Console queries and Analytics traffic) is NEVER used to train, retrain, fine-tune, or improve generalized or foundation artificial intelligence (AI) or machine learning (ML) models.
- Strict Human Access Restrictions: Human personnel at EulerHive Inc. are strictly prohibited from reading or inspecting Google user data, unless: (1) you have provided explicit prior written consent for specific technical troubleshooting; (2) it is necessary for platform security or to investigate an incident; or (3) required by applicable law or regulatory authority.
- No Unrelated Third-Party Transfers: Google user data is not transferred to any third party, except to cloud infrastructure service providers strictly necessary to execute the platform under binding confidentiality agreements.
- Revocation & Deletion: You can disconnect any Google integration at any time directly in the EulerSEO dashboard or via your Google Account Security Settings. Disconnection immediately clears all encrypted OAuth tokens and halts synchronization.
5. Microsoft & Bing Webmaster Tools Data
When you connect your Microsoft Account or Bing Webmaster Tools integration, we request authorization under the webmaster.read scope.
- Data Accessed: Bing verified web properties, crawl statistics, indexation issues, organic search query clicks, impressions, and keyword positions.
- Token Protection: OAuth access tokens and refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption.
- Disconnection & Revocation: You can disconnect Bing Webmaster Tools at any time in EulerSEO or revoke access via Microsoft Account App Permissions. Disconnecting clears all stored credentials immediately.
6. AI & Automated Processing Disclosures
EulerSEO uses automated algorithmic engines and optional local Large Language Models (LLMs) to synthesize technical audit findings into actionable summaries. We maintain strict boundaries regarding AI usage:
All 77 SEO rules, Core Web Vitals grades, and site health scores are 100% deterministic code calculations. Our scoring engine does not use AI hallucinations to invent scores or fabricate errors. LLMs are used solely to draft plain-English summaries, categorize root causes, and explain technical remediation steps.
By default, AI synthesis runs locally on bounded self-hosted inference servers (e.g. Ollama with Qwen 2.5:3b or Apple Silicon MLX). If an operator configures an external API provider (such as an OpenAI-compatible endpoint), prompts are bounded strictly to the crawl findings under analysis.
Your crawl data, search queries, and analytics reports are never retained or used to train, fine-tune, or improve third-party AI models.
AI-generated summaries, code snippets, and remediation suggestions are informational. You remain responsible for independently reviewing, validating, and testing any code or configuration changes before deploying them to your production website.
8. Data Sharing & Third-Party Processors
We do not sell, rent, or trade your personal information. We disclose data only to the following trusted infrastructure service providers necessary to operate the service:
| Processor / Entity | Role & Service | Data Processed | Processing Location |
|---|---|---|---|
| Cloud Hosting Infrastructure | Application & API Server Hosting | Encrypted application traffic, API requests, session cookies | Secured data centers in accordance with deployment configuration |
| MongoDB Database | Primary Database Storage | User accounts, crawl snapshots, audit findings, encrypted OAuth tokens | Encrypted volume storage with strict access controls |
| Redis & Celery Queue | Background Worker Message Broker | Transient crawl task queues, sync job IDs | Internal network memory cache with TLS encryption |
| Google LLC (APIs) | Connected Services API Provider | Search Console, GA4, GMC, GBP data (only when connected by user) | United States / Global infrastructure (Google Cloud) |
| Microsoft Corporation (APIs) | Connected Services API Provider | Bing Webmaster Tools data (only when connected by user) | United States / Global infrastructure (Microsoft Azure) |
Additionally, we may disclose information to law enforcement or regulatory authorities solely when strictly required by enforceable legal process, court order, or applicable statutory mandate.
9. International Data Transfers
EulerSEO is operated by EulerHive Inc. and serves users worldwide. If you access the service from outside India, the European Economic Area (EEA), the United Kingdom, or the United States, your information may be processed and stored in servers located in jurisdictions other than your home country.
Where cross-border transfers occur, we implement appropriate safeguards, including encryption in transit and at rest, strict tenant access controls, and contractual data protection requirements with cloud service providers to ensure your personal information remains protected.
10. Data Retention Schedule
We retain personal information and audit records only for as long as necessary to provide the services or fulfill legitimate operational and legal purposes:
| Data Category | Retention Period | Disposal / Purge Mechanism |
|---|---|---|
| User Account & Profile | Duration of active account | Permanently deleted upon verified account erasure request within 30 days. |
| OAuth Refresh Tokens | Until user disconnection | Immediately cleared from database upon user-initiated disconnect or revocation. |
| Website Crawl Snapshots & Findings | Duration of user project | Retained to provide historical audit comparisons; purged upon project/account erasure request. |
| Connected Search & Analytics Data | Duration of active project | Synchronized daily; historical snapshots preserved until integration or project deletion. |
| Security & Auth Audit Logs | Up to 365 days | Automated rolling expiration for security investigations and audit compliance. |
| Database Backups | Up to 30 days | Encrypted automated backup snapshots overwritten on a 30-day lifecycle. |
11. Technical & Organizational Security Safeguards
We maintain multi-layered technical, cryptographic, and operational security safeguards to protect customer data against unauthorized access, loss, alteration, or disclosure:
All third-party OAuth access and refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption with unique random 96-bit nonces.
User account passwords are protected using the memory-hard Argon2id cryptographic algorithm with unique per-credential salts.
Crawler requests pass strict socket-level SSRF filters that block private IPv4/IPv6 subnets, loopbacks, and cloud metadata endpoints.
Database queries enforce strict user scoping (user_id binding) on all crawls, findings, and integration records to prevent IDOR vulnerabilities.
While we employ rigorous industry-standard defenses, no electronic transmission or cloud storage system is 100% impenetrable. We maintain continuous monitoring and prompt incident remediation procedures.
12. User Privacy Rights Across Jurisdictions
Depending on your location, you possess statutory rights regarding your personal information under applicable privacy laws:
A. Rights under the Digital Personal Data Protection Act, 2023 (India)
As a Data Principal under India's DPDP Act and applicable rules, you have:
- Right to Access Information: Obtain a summary of personal data processed by us and identities of third parties with whom it has been shared.
- Right to Correction & Completion: Correct inaccurate or misleading personal data and complete incomplete information.
- Right to Erasure: Request the deletion of your personal data when the processing purpose is no longer served.
- Right to Grievance Redressal: Submit complaints to our designated Grievance Officer before escalating to the Data Protection Board of India.
- Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.
B. Rights under the General Data Protection Regulation (GDPR / UK GDPR)
For users in the European Economic Area (EEA) and the United Kingdom, our legal bases for processing include Contract Performance (Art. 6(1)(b)), Legitimate Interests (Art. 6(1)(f)), and Consent (Art. 6(1)(a)). You have:
- The right to access, rectify, or erase your personal data.
- The right to restrict or object to our processing of your personal data.
- The right to data portability in a structured, machine-readable format.
- The right to lodge a complaint with your local Data Protection Supervisory Authority.
C. Rights under the California Consumer Privacy Act (CCPA / CPRA)
- Right to Know & Delete: Request disclosure of categories of personal information collected and request deletion.
- No Sale or Sharing: We do not "sell" or "share" personal information for cross-context behavioral advertising.
- Non-Discrimination: We do not discriminate against you for exercising your CCPA rights.
13. Disconnection vs. Deletion Procedures
To provide transparency and avoid confusion, we clearly distinguish between disconnecting integrations, clearing cached search data, and complete account deletion:
You can click "Disconnect" for any Google or Microsoft integration at any time in Profile or Integrations settings. This immediately revokes and clears stored encrypted tokens from our active database and halts synchronization.
Disconnecting an account halts future syncs. Previously synchronized crawl reports and performance snapshots remain linked to your project until you request project or account deletion.
To permanently delete your user profile, projects, crawl history, and all stored data, email privacy@eulerhive.com. Verified requests are fulfilled within 30 days across all operational databases.
14. Children's Privacy
EulerSEO is an enterprise website intelligence and technical software engineering platform intended solely for business professionals, developers, and organizations. The service is not directed to individuals under 18 years of age. We do not knowingly solicit or collect personal information from minors under 18 (in compliance with Section 9 of the DPDP Act 2023 and global child privacy standards). If we learn that a minor has registered an account, we will promptly purge that information upon notification.
15. Changes & Updates to this Privacy Policy
We may revise this Privacy Policy periodically to reflect changes in our platform architecture, statutory legal requirements, or third-party API platform rules. The latest revision date is prominently displayed at the top of this page. For material updates affecting data collection boundaries or Google API user data usage, we will notify registered users via email or through a visible notification banner within the application dashboard prior to the changes taking effect.
16. Contact Details & Grievance Redressal
If you have questions, feedback, or complaints regarding our privacy practices, or if you wish to exercise your statutory Data Principal rights, please contact our compliance desk: