Privacy Policy

1

About this notice and who we are

ScanMySEO is operated by SCANMYSEO LTD, a company registered in England and Wales under company number 17166063. In this notice, “ScanMySEO”, “we”, “us” and “our” refer to SCANMYSEO LTD.

This notice explains what personal data we process, where it comes from, why we use it, the lawful basis, who receives it, how long it is retained, how international transfers are protected and what rights are available. It applies to scanmyseo.com, the ScanMySEO account and audit service, customer dashboards, reports, AI features, billing, support, sales and related business operations.

A privacy notice explains processing; it is not a contract and does not turn every use of personal data into consent. Where we rely on consent, we ask separately and allow it to be withdrawn. The Terms of Service govern the service contract.

2

When ScanMySEO is a controller or processor

Privacy roles depend on the particular purpose. A company can be a controller for one activity and a processor for another.

Where ScanMySEO acts as processor, the customer is normally responsible for its own transparency, instructions and lawful basis. We still process limited account, security, billing and platform-administration information as an independent controller. A Data Processing Addendum is available for eligible agency and Enterprise customers.

Stripe, Google, LinkedIn and certain other providers may act as separate or independent controllers for their own fraud, legal, account, authentication or service-improvement purposes. Calling a provider a “processor” in one context does not override that provider’s independent legal duties.

3

People covered by this notice

This notice can apply to:

• public website visitors and prospective customers;
• registered, Free, subscription, PAYG and Enterprise users;
• account owners, billing owners, billing administrators, billing viewers and authorised users;
• agency users, freelancers, client representatives and people invited to a workspace;
• people who submit an enterprise quote, procurement enquiry, support request, feedback or privacy complaint;
• newsletter subscribers and recipients of permitted marketing;
• people whose names, roles, biographies, contact details, images or other information appear on a publicly accessible website submitted for audit;
• people mentioned in report examples, customer instructions or Cozmo questions;
• suppliers, advisers, security researchers and business contacts; and
• administrators and staff whose authorised actions are recorded in operational logs.

Some people covered by this notice never create a ScanMySEO account. Section 24 explains the most practical route for a person who appears on an audited website or customer report.

4

Account, authentication and access information

Depending on how you create and use an account, we may process:

• username, display name, email address and normalised email value;
• company or organisation information and account role;
• password hash, whether local password login is enabled and credential-version information used to invalidate old reset links;
• email-confirmation status, confirmation and reset timestamps, token events, delivery, bounce and resend information;
• account creation date, last login, failed login attempts, lockout state and session records;
• authentication provider, provider subject identifier and whether a Google or LinkedIn email was verified;
• safe post-authentication destination and a temporary pending crawl URL;
• account status, Plan, role and permissions;
• security notifications, password-change and suspicious-sign-in events; and
• account-deletion request, signed deletion intent and selected subscription action.

4.1 Passwords

ScanMySEO stores a cryptographic password hash rather than a readable password. OAuth-only accounts are configured without a usable local password unless the user later establishes one through an authorised process. Do not reuse a ScanMySEO password elsewhere.

4.2 Google and LinkedIn sign-in

For Google and LinkedIn OpenID Connect sign-in, ScanMySEO requests basic identity scopes: OpenID identity, profile and email. We typically receive a verified email address, provider user identifier and name or profile fields needed to create or match the account. We do not use those permissions to post to the provider account, read private messages, import contacts or access unrelated social content.

Access tokens are normally used transiently to complete authentication and are not kept as a reusable social-account connection. We retain the provider identity link while needed to support sign-in and account security. The provider independently processes the sign-in under its own privacy notice.

5

Onboarding and personalisation information

Optional or required onboarding can include:

• role or persona, such as owner, in-house marketer, SEO specialist, developer, agency or explorer;
• audit goals, such as traffic, leads, technical SEO, speed, migration, client reporting or site health;
• SEO experience level;
• website type;
• industry selected for an audit;
• optional website or business context;
• whether onboarding was completed, skipped or postponed; and
• the date preferences were last updated.

We use this information to change explanation depth, prioritisation, suggested starting points, summaries and AI context. It does not change the underlying customer responsibility to verify a finding, and it is not used to make a decision with legal or similarly significant effects.

6

Crawl submissions and website audit data

When an authorised user starts an audit, we may process:

• submitted website URL, domain, sitemap URL, selected industry, crawl depth, estimated page count and requested limits;
• the user, account, Plan, entitlement and exact credit reservation associated with the crawl;
• crawl status, task and queue identifiers, start and completion times, progress, pages discovered, pages fetched and failure reasons;
• robots, sitemap, redirect, status-code, certificate, security-header and network response information;
• public page text, metadata, headings, links, image information, structured data, canonical and hreflang signals, technical markup and page-level measurements;
• performance, Core Web Vitals, script, CSS, third-party-resource and mobile signals;
• content hashes, duplicate-content comparisons, readability, indexing, internal-linking and architecture evidence;
• screenshots, rendered or temporary HTML where a particular check requires them;
• error, retry, bot-blocking, rate-limit and diagnostic information; and
• generated issue rows, health scores, summaries and output-file locations.

ScanMySEO is intended for publicly accessible website content. It is not designed to bypass logins, paywalls, CAPTCHAs, private administration areas or other access controls. Customers must have lawful authority to submit the website and must not provide private credentials to the crawler.

A target website, CDN, hosting provider, analytics system or security service may record the ScanMySEO crawler’s requests, user agent, source IP, timing and page access. Those records are controlled by the target-site operator and its providers.

7

Personal data found on public websites

Publicly accessible content can still be personal data. An authorised audit may encounter a person’s name, job title, biography, business contact details, photograph, authorship, social link, testimonial, event information or other information published on the target website.

When we act as processor, the customer decides why the website is audited and is normally responsible for its lawful basis and privacy information. ScanMySEO processes the content to produce the requested technical and AI-assisted report, secure the platform, diagnose faults and comply with law. We do not use crawled names or contact details to market to the people appearing on the target site.

We minimise report evidence where full reproduction is unnecessary. Reports can include a URL, short excerpt, page title, image reference or technical evidence needed to explain a finding. Customers must not use ScanMySEO to build unlawful profiles, harass individuals, harvest sensitive personal data or conduct surveillance.

If you appear on an audited website and want information corrected or removed, the website owner or ScanMySEO customer is usually best placed to correct the source. You may also contact us under section 24 and we will assess our role, preserve account security and assist the relevant customer where appropriate.

8

Reports, exports and historical audit records

Report data can include:

• dashboard findings, Website Health Score and issue counts;
• page-level evidence, recommendations, owners, effort and priority;
• PDF, CSV, spreadsheet, JSON and other downloadable outputs;
• historical snapshots and comparisons between audits of the same domain;
• report filenames, paths, object-storage URLs, generation timestamps and file sizes;
• download, access and report-generation events;
• AI Enhanced Audit findings and selected Report AI content; and
• support or quality records where a customer reports a report defect.

Reports are private to the authorised account except where the customer downloads or shares them. Administrators may access a report only where reasonably necessary for support, security, legal compliance, billing investigation, service restoration or authorised quality assurance. Access is restricted by role and should be auditable where the relevant system supports audit logging.

ScanMySEO is not a permanent archival-storage service. Customers should download material they must preserve and must protect exported reports that contain client, website or personal information.

9

AI Enhanced Audit, Cozmo Intelligence and Report AI

9.1 What AI features process

Depending on the feature and Plan, AI processing can include:

• selected public page text, headings, metadata, structured crawl evidence and deterministic issue findings;
• onboarding context, website type, industry and audit goals;
• page-level content, trust, freshness, intent, commercial, user-experience and discoverability signals;
• the user’s Report AI question, timestamp, crawl/report identifier and relevant report examples;
• generated response, suggested owner, effort, priority, value or direction of change;
• model family, prompt version, batch or job identifier, token or character counts, latency, retry, timeout and failure metadata;
• safety, rate-limit and abuse-prevention information; and
• voluntary feedback about an answer.

9.2 Report-grounded operation

Report AI is designed to answer from the completed crawl’s report context. The current report-chat interface does not browse the live web, accept user file uploads or execute backend changes to a website. It generates explanatory output; the customer decides whether and how to act on it.

9.3 Active model infrastructure

At the effective date, eligible AI Enhanced Audit and Report AI workloads are routed to ScanMySEO-managed inference services hosted on Google Cloud Run in a European region and use a Gemma-family model. Google Cloud provides the infrastructure. This is not the consumer Gemini chat service, and the model creator’s name does not by itself mean that a separate consumer product receives the prompt.

We send only the report excerpts, user question and operational metadata needed for the feature. Temporary HTML prepared specifically for AI analysis is configured for deletion after the run. Core crawl evidence, generated findings and the report may remain under the report-retention rules.

9.4 Training and service improvement

9.5 Human access

Authorised ScanMySEO personnel may access a limited prompt, output or report context where necessary to answer a support request, investigate abuse, diagnose a failure, protect security, verify billing delivery or perform targeted quality assurance. Access is restricted to appropriate roles and is not a licence for routine browsing of customer reports. Provider personnel may have tightly controlled infrastructure access under the provider’s security and legal arrangements.

9.6 AI accuracy and high-impact use

AI output can be inaccurate, incomplete or inconsistent. It is not used by ScanMySEO to make a solely automated decision that produces a legal or similarly significant effect on an individual. Customers should review recommendations before making technical, legal, employment, financial, security or other high-impact decisions.

10

Billing, payments, credits and procurement

ScanMySEO may process:

• billing email, company name, tax status, tax identifier, invoice details and purchase-order reference;
• billing owner, administrator and viewer membership and invitations;
• Stripe customer, checkout-session, payment-intent, subscription, price, invoice, portal and event identifiers;
• product, Plan, billing interval, quantity, currency, subtotal, tax, discount and total;
• order number, status, fulfilment, cancellation, refund, dispute, chargeback and reconciliation information;
• subscription status, period dates, renewal, scheduled cancellation and plan-change state;
• included allowances, PAYG tiers, reservations, consumption, restoration and immutable credit-ledger entries;
• signed Stripe webhook records, processing attempts and error information;
• spending limits, PAYG quantity limits and account billing preferences; and
• Enterprise quote information, including business email, company, estimated pages, audit volume, procurement needs and message.

Billing administrators can see information appropriate to their role. The customer is responsible for inviting the correct people and removing access when authority ends. ScanMySEO administrators may inspect billing records to fulfil orders, reconcile Stripe, answer support questions, prevent fraud and maintain an auditable ledger.

11

Communications, support, feedback and newsletters

We may process:

• support, contact, feedback and privacy-request messages and attachments;
• sender and recipient details, timestamps, subject, delivery, bounce and response information;
• account confirmation, password reset, security, crawl, report, billing and service-notice emails;
• newsletter name, email, source, consent or permission record, subscription date and unsubscribe status;
• customer-satisfaction or report-feedback responses;
• complaint category, evidence, investigation notes, updates and outcome; and
• telephone or meeting notes where an Enterprise or support interaction is arranged.

11.1 Service messages

Confirmation, password, security, report, billing, legal and material service messages are operational communications. They are not converted into marketing merely because they are sent by email. Some cannot be disabled while the account or transaction remains active.

11.2 Marketing messages

Promotional newsletters are sent where we have consent or another valid electronic- marketing permission. Each marketing email includes an unsubscribe route. We keep a limited suppression record after opt-out so the address is not accidentally re-added.

12

Technical, usage, device and security information

When you use the site or service, we and our providers may process:

• IP address, approximate region, request time, URL, referrer, user agent, browser, operating system and device properties;
• session, cookie, local-storage, CSRF, OAuth state and consent-preference information;
• page views, feature events and aggregate usage information where optional analytics is permitted;
• Socket.IO connection, user room, reconnection, progress-poll and delivery information;
• rate-limit keys, hashed email-rate-limit keys, login attempts and bot-risk information;
• reCAPTCHA token, action and score or verification outcome;
• application, database, worker, queue, object-storage and API logs;
• error type, stack or diagnostic metadata, service latency and retry information;
• administrative access, configuration, export, deletion, reconciliation and security events;
• security-email and suspected-account-compromise records; and
• browser notification permission and interaction information where the browser makes it available.

We use this information to operate the service, secure accounts, isolate customer data, detect abuse, investigate incidents, measure reliability and support users. The Cookie Policy explains browser storage and optional analytics in more detail.

13

Where personal data comes from

We obtain information:

• from you, when you register, complete onboarding, submit a website, ask Cozmo a question, purchase, contact us or change settings;
• from your organisation or account owner, when they invite you, assign a billing role, provide client context or administer the workspace;
• from a target website, sitemap, public page, server response or linked public resource during an authorised audit;
• from Google or LinkedIn, when you select provider sign-in;
• from Stripe, when you enter checkout, pay, manage billing, obtain a refund or dispute a charge;
• from devices and browsers, through security logs, cookies, local storage, requests and optional analytics;
• from service providers, including hosting, email, storage, model infrastructure and content-delivery providers;
• from public business sources, where reasonably needed to verify an organisation, domain authority, professional contact or legal claim; and
• from regulators, courts, law enforcement or advisers, where legally permitted or required.

14

Purposes and lawful bases

The lawful basis depends on the purpose and our role. “Contract” includes steps requested before a contract. “Legitimate interests” applies only after balancing our purpose against the person’s rights. Where we act as processor, the customer determines the lawful basis for its instructed processing.

Where special-category or criminal-offence data appears incidentally in submitted context or public website content, we do not intentionally infer or use it for profiling. We limit processing, remove unnecessary copies and rely on the customer’s lawful instructions or an applicable legal condition where such processing cannot be avoided.

15

Our legitimate interests

Our legitimate interests include:

• operating a secure, reliable and commercially sustainable website-audit service;
• preventing account abuse, payment fraud, credential attacks and harmful crawling;
• protecting customers, target sites, infrastructure and our legal rights;
• supporting users and diagnosing failed or inaccurate reports;
• maintaining an auditable billing, entitlement and credit history;
• understanding aggregate product performance without optional cross-site advertising;
• personalising explanations in a proportionate way; and
• communicating with relevant business contacts where lawful and expected.

We consider the nature of the data, the relationship, reasonable expectations, impact, safeguards and available choices. Safeguards can include minimisation, role-based access, security controls, short retention, aggregation, de-identification, consent for analytics, opt-out routes and human review. You can object to legitimate-interest processing under section 22.

16

Personalisation, profiling and automated decisions

ScanMySEO uses automated rules and models to:

• classify crawl issues, severity, owner and suggested effort;
• calculate a Website Health Score and report priorities;
• adapt explanations using onboarding choices;
• estimate site size and determine available Plan or credit paths;
• apply rate limits, account-security checks and bot-risk controls;
• reserve, consume or restore a credit according to delivery events; and
• generate AI-assisted findings and answers.

These processes can affect feature availability, report presentation or whether an action is paused for security, but ScanMySEO does not use them to make a solely automated decision about an individual that has a legal or similarly significant effect. A customer can contact support to challenge an entitlement, fraud, security, credit or report decision and request human review where appropriate.

17

Recipients and service providers

We disclose only the information reasonably needed for the relevant service, legal duty or protected interest. Active recipient categories at the effective date include:

Providers can change as the service develops. We assess privacy, security, role, subprocessing and transfer arrangements before a material provider receives customer data. We update this policy or the business subprocessor schedule before a materially different purpose begins.

18

International data transfers

ScanMySEO is established in the United Kingdom, but providers and support operations can process information in the United Kingdom, European Economic Area, United States and other countries. A destination may not provide the same legal protections as the UK.

Where UK restricted-transfer rules apply, we use one or more of:

• UK adequacy regulations for a destination recognised as providing adequate protection;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• another valid Article 46 safeguard or legally permitted derogation;
• a transfer-risk assessment; and
• supplementary technical, organisational or contractual measures such as encryption, access restriction, minimisation and regional hosting.

You can ask for more information about a relevant transfer mechanism, subject to redaction of confidential and security-sensitive terms. A provider’s global privacy notice does not replace our responsibility to assess the transfer for the particular service.

19

Retention schedule

We keep personal data for the shortest period reasonably needed for the purpose, contract, legal obligation, security need or claim. “Up to” is a maximum operational target, not a promise to keep the record for the whole period. We may retain a specific record longer where law, a dispute, fraud investigation, legal hold or customer instruction requires it.

20

Account deletion and what remains

An eligible user can start account deletion through the account controls or contact support. ScanMySEO uses a short-lived confirmation token to reduce accidental or malicious deletion. The flow may ask how an active Stripe subscription should be handled so an invisible recurring charge is not left behind.

After confirmed deletion:

• access is revoked and live sessions are ended;
• account profile, onboarding, private reports and associated live product data are normally removed within 30 days;
• backup copies expire through the normal cycle, usually within 90 days;
• Stripe separately retains payment information under its legal duties;
• ScanMySEO retains limited order, invoice, subscription, credit-ledger, refund, dispute, tax and reconciliation records for the periods in section 19;
• security, complaint, legal-claim and suppression records can remain where necessary;
• provider-side deletion is subject to the provider’s role and retention duties; and
• genuinely anonymised aggregate information may remain.

Account deletion is distinct from cancelling a subscription or deleting an individual report. Unused paid PAYG credits and refunds are handled under the Terms, Audit Credit Policy and Refund Policy rather than silently rewritten in the ledger.

21

Your privacy rights

Depending on the information, purpose, lawful basis and applicable law, you may have the right to:

• access personal data and receive information about its processing;
• rectify inaccurate personal data and complete incomplete information;
• erase personal data where there is no overriding reason to retain it;
• restrict processing in specified circumstances;
• object to direct marketing and certain legitimate-interest or public-task processing;
• port information you provided where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, without affecting earlier lawful processing;
• challenge automated decision-making and request human intervention where the law applies;
• complain to ScanMySEO and the Information Commissioner’s Office; and
• authorise a representative, subject to reasonable evidence of authority.

Rights are not absolute. For example, we may retain transaction records required by law, protect another person’s rights, preserve security evidence or refuse disclosure of another customer’s confidential information. We explain any material refusal or limitation.

21.1 How to make a request

Email cozmo@scanmyseo.com with the subject “Privacy rights request” or use the contact form. Describe the account, email, domain, report or processing concerned and the right you wish to exercise.

21.2 Identity and authority checks

We may request proportionate evidence to confirm identity, account control, domain or client authority. We do not ask for more identification than reasonably needed. A request made from the verified account email or through an authenticated account can reduce the evidence required.

21.3 Timing and fees

We normally respond without undue delay and within one month. A legally permitted extension may apply to complex or numerous requests, and we will explain it. Requests are normally free, although the law may permit a reasonable fee or refusal for a manifestly unfounded or excessive request.

22

Your right to object

You can also object where we rely on legitimate interests. Tell us the processing and your reasons. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

Optional analytics is based on consent rather than legitimate interests. Use Cookie Settings to reject or withdraw analytics permission.

23

Data-protection complaints and the ICO

A data-protection complaint is a concern that ScanMySEO has infringed data-protection law in relation to personal data. Send it to cozmo@scanmyseo.com with the subject “Data protection complaint” or use the contact form.

Our complaint process is to:

1. record the complaint and preserve relevant evidence;
2. acknowledge it promptly and, where the statutory complaint duty applies, within 30 days;
3. investigate without undue delay through someone with appropriate authority;
4. ask focused questions where information is missing;
5. keep you informed where the investigation takes time;
6. communicate the outcome, action taken and available escalation route; and
7. retain a proportionate complaint and outcome record.

You can complain directly to the Information Commissioner’s Office (ICO), the UK supervisory authority, without contacting ScanMySEO first. We welcome the opportunity to resolve concerns, but it is not a precondition. Visit the ICO complaint service.

24

Agency, client and public-data requests

24.1 Agency or customer-controlled data

Where an agency or business customer controls the audit and report, a person should usually contact that organisation first because it decides the website, purpose and use of the report. ScanMySEO assists the customer with rights requests under the DPA where we act as processor and responds directly for our controller data.

24.2 People appearing on an audited website

If your information appears in crawl evidence, tell us the source URL, information and concern. We may need to notify the customer, restrict a report excerpt, correct our copy, remove an unnecessary cached item or direct the correction to the website operator. We do not normally alter the source website and cannot promise to remove content controlled by a third party.

24.3 Domain and workspace disputes

We may request evidence of domain, client or workspace authority before disclosing, transferring or deleting a report. Owning a domain does not automatically entitle someone to another customer’s confidential account information, and an account record does not override a verified legal right in the underlying personal data.

25

Children, sensitive information and prohibited secrets

25.1 Accounts

ScanMySEO accounts and paid services are intended for adults aged 18 or over. We do not knowingly create accounts for children. A parent or guardian who believes a child created an account should contact us so we can verify and take appropriate action.

25.2 Children appearing on public websites

An authorised crawl can incidentally encounter information about a child on a public page, such as a school, charity, sports or family website. Customers should avoid unnecessary submission of sites containing children’s sensitive information and must have a lawful basis. ScanMySEO limits use to the requested audit and does not intentionally profile the child for advertising.

25.3 Special-category and criminal-offence data

The service is not designed to collect health, genetic, biometric, racial or ethnic, religious, political, trade-union, sex-life, sexual-orientation or criminal-offence data. Do not place such information in onboarding, report chat, support or quote fields unless it is genuinely necessary, lawful and agreed with us in advance for an Enterprise service.

25.4 Passwords and secrets

Never submit passwords, private keys, API credentials, payment-card data, access tokens, authentication cookies or confidential database exports through a crawl field, Cozmo question or ordinary support form. If this happens, notify us promptly so we can reduce exposure and advise on credential rotation.

26

Security, confidentiality and incidents

Security measures are selected according to risk and can include:

• TLS for data in transit and protected cloud storage or databases;
• cryptographic password hashing and short-lived signed account tokens;
• Secure, HttpOnly and SameSite controls for authentication cookies;
• CSRF protection, safe redirects, OAuth state validation and identity-claim checks;
• role-based access, account ownership checks and user-specific report or Socket.IO rooms;
• rate limiting, reCAPTCHA, login-event records and security notifications;
• signed Stripe webhooks, idempotent fulfilment and immutable credit-ledger entries;
• restricted administrative functions and audit records;
• provider due diligence, secrets management, backups and recovery controls; and
• logging minimisation that avoids intentionally writing passwords or full payment-card data.

No online service can guarantee absolute security. Users must protect credentials, remove former team members, use trusted devices and report suspected compromise. We may revoke sessions, require a reset, pause a crawl or restrict an account to contain a risk.

If a personal-data breach creates a risk that requires notification, we follow applicable assessment, regulator and individual-notification duties. We preserve relevant evidence, contain the incident, investigate causes and take proportionate corrective action.

27

Marketing, analytics, aggregate intelligence and commercial neutrality

27.1 No sale, rent or cross-site behavioural advertising

ScanMySEO does not sell or rent personal data. We do not use customer reports, crawl content or Cozmo questions to build a cross-site behavioural advertising profile. We do not permit advertisers to alter technical findings or AI answers.

27.2 Optional analytics

Google Analytics 4 is optional and consent-based. The Cookie Policy explains the approved measurement configuration, retention and withdrawal control. Rejecting analytics does not affect the ordinary audit service.

27.3 Aggregate and de-identified intelligence

We may create aggregate reliability, error-frequency, feature-use, technology-adoption or industry-level statistics where the result does not identify a person, customer or confidential website. We apply aggregation thresholds or other safeguards appropriate to the data and do not attempt to re-identify anonymised information.

We do not sell a customer’s secrets or private report as competitor intelligence. A plan recommendation may use page count, entitlement and usage information, but technical findings are not manufactured or inflated to force an upgrade. Sponsored or affiliate content, if introduced, will be labelled and kept separate from audit methodology.

28

Legal disclosures, external links and corporate events

28.1 Legal and protective disclosures

We may disclose relevant information where reasonably necessary to:

• comply with law, court order or valid regulatory or law-enforcement request;
• investigate fraud, security, abuse, unauthorised crawling or threats to a target site;
• enforce the Terms, protect users or defend legal claims;
• notify an affected person or organisation of a security incident;
• recover debt or resolve a payment dispute; or
• protect vital interests in an emergency.

We assess the requesting authority, jurisdiction, legal basis, scope and available challenge or notice options. We disclose no more than reasonably necessary.

28.2 Corporate transactions

Personal data may be reviewed or transferred as part of investment due diligence, merger, acquisition, restructuring, insolvency or sale of assets. We use confidentiality, minimisation and access controls and provide notice where required. A successor must use the information consistently with applicable law and the commitments that continue to apply.

28.3 External links

Links to Stripe, Google, LinkedIn, articles or other websites lead to services with their own privacy practices. Following a link can disclose IP address, browser headers, referrer and URL information to the destination. ScanMySEO is not responsible for an external service’s independent processing. We avoid placing secrets or sensitive identifiers in external URLs.

29

Changes to this Privacy Policy

We update this notice when processing, providers, retention, rights, product features or law materially changes. The version and date change only after a genuine review; they are not automatically replaced with the date you happen to visit.

Material changes are communicated through the website, account dashboard, email or another appropriate route. Where practicable, we provide advance notice. A new purpose is explained before processing begins, and we obtain fresh consent where the new activity depends on consent. We do not claim that continued use creates consent to an unrelated new privacy purpose.

Previous versions and a meaningful change summary are retained internally and can be made available where reasonably required to understand which notice applied.

30

Contact, privacy requests and Data Processing Addendum

Contact ScanMySEO about this notice, a privacy right, a public-data concern, a complaint or a Data Processing Addendum at cozmo@scanmyseo.com or through the contact form.

Use a clear subject:

• “Privacy rights request”;
• “Data protection complaint”;
• “Public website data concern”;
• “Security incident”; or
• “DPA and subprocessor request”.

Do not email passwords, full card details, private keys or unnecessary identity documents. We will tell you a safer route where evidence is needed.