Privacy Policy

W3 EDGE, LLC d/b/a Auctollo ("Auctollo," "we," "us," or "our") operates the Indexation WordPress plugin and the cloud platform at app.auctollo.com (collectively, the "Service"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have.

Google user data: how we access, use, store, and share data from Google (Search Console, Google Analytics, and sign-in with Google) is described in Section 12.

1. Information We Collect

1.1 Indexation WordPress Plugin

The Indexation Plugin operates entirely on your server by default. We collect personal information from the Plugin only when you explicitly opt in to cloud services or beta features via the consent banner or onboarding wizard. When you opt in, we collect:

Until you interact with the consent banner or account-creation step, no personal data is transmitted to our servers.

1.2 Auctollo Cloud Platform (app.auctollo.com)

Account data: email address (required); display name and avatar URL, whether the provider has verified your email, and the provider's ID for you (from your OAuth provider if you sign in via Google, Microsoft, or GitHub, where it supplies them); timestamps.

Subscription and billing: Stripe customer ID and subscription ID; subscription tier, status, and billing period; monthly credit balance and reset date. We do not store payment card numbers — Stripe handles all payment processing and is PCI DSS compliant.

Connected sites: WordPress site URL and name; WordPress version, PHP version, plugin version; site status and last-seen timestamp.

API keys: key prefix (first 8 characters — safe for display and logging); label, creation time, last-used, expiration, and revocation timestamps. The full API key is SHA-256 hashed at creation and never stored in plaintext.

Usage / audit log: feature slug, credits consumed, timestamp, third-party AI provider used, provider cost in USD, request ID, and optional context data (JSON, capped at 2,048 bytes). This log is immutable.

OAuth tokens: token hashes (SHA-256 only; full tokens are never stored), prefixes, scopes, expiration, revocation, and rotation metadata.

Browser notifications (only if you turn them on): for each browser you register, the address its push service gives us and two encryption keys, the browser's user-agent text (your device list shows it as a name such as "Chrome on macOS"), and when it was added and last used; and the on or off choice you set for each kind of notification. We use them only to send the notifications you choose. A notification travels through the push service run by your browser's maker (for example Google, Mozilla, Apple or Microsoft), which can see that a message was sent to that browser and when, but not what it says. You can remove a browser, or turn notifications off, at any time on the Notifications page; signing out in a browser removes it too.

1.3 Server Logs

We collect standard server logs including IP addresses and user-agent strings for security, fraud prevention, and operational debugging. IP addresses are not linked to user profiles for marketing purposes.

2. How We Use Your Information

We do not sell your personal information. We do not use your content or site data to train AI models.

3. Third-Party Service Providers

We share personal data only with the processors listed below, and only so that each can provide its service to us. Each handles it under its own terms; its privacy policy is linked in the table. Other recipients, and services you connect yourself, are covered after the table.

Other recipients. These receive public information only, no personal data, and do not process anything on our behalf, so they are not sub-processors.

Services you connect. When you connect one of these with your own account or key, our servers send it requests on your behalf. They are not our sub-processors: you choose them, and their own terms apply.

We do not use advertising networks, data brokers, cross-site behavioral tracking, or sell data to any third party for their independent marketing purposes.

Business customers (Controllers under GDPR Art. 28): Where you use the Service to process personal data of your own end users, our role is processor and yours is controller. Our Data Processing Agreement governs that relationship, including sub-processor commitments, international transfer safeguards (Standard Contractual Clauses), and breach-notification timelines.

4. Content Submitted to AI Features

Four features use Anthropic, our AI provider, when they run. Three of them send content from your site or your question to it. llms.txt summaries send a page's URL, a section label, its title, and a text excerpt, to write a one-line description. Markdown (.md) page versions send a page's URL, title, and type, the site section it is in, and a text excerpt, with the summary preferences and site bio you set. An excerpt is up to about 8,000 characters. The Indexation troubleshooter chat sends the URL of the page you ask about, your question (up to 500 characters), and facts about that page from your own site: whether your sitemap lists it, how many pages link to it, when Googlebot last requested it, site audit findings about it, and its IndexNow submissions. The fourth, translating our own product announcements, sends only an announcement's title and body, text we wrote for every customer; it sends none of your content or account details. We use Anthropic's API, whose standard terms state that customer data is not used to train its models. We do not send Search Console data (Section 12) or account details to AI providers. For llms.txt summaries, the usage log on your dashboard shows the provider that handled each request.

5. Cookies and Tracking

See our Cookie Policy for full details. In summary: we use strictly necessary session cookies for authentication, and optional analytics cookies (Google Tag Manager / GA4) only with your explicit consent: in the Plugin settings, or, in the dashboard, by turning on Product analytics under Privacy & data (off until you do). We do not use advertising or cross-site tracking cookies. If you turn on browser notifications, your browser also keeps the site's notification permission, a small service worker and a push subscription (not cookies); the Cookie Policy lists them.

6. Data Security

We implement industry-standard security measures: TLS/HTTPS for all data in transit; SHA-256 hashing of API keys and OAuth tokens; Supabase Row-Level Security (RLS) policies for per-user data isolation; Stripe PCI DSS Level 1 compliance for payment data; and access restricted to authorized Auctollo personnel. If you discover a security vulnerability, please disclose it responsibly to legal@auctollo.com.

Staff access to your account. Authorized Auctollo staff can open a time-limited, read-only "view as customer" session to see your dashboard as you see it, so we can investigate and resolve support requests, except that your Google Search Console data is hidden (Section 12.5). Staff cannot change your settings, sites, or other account data through a session, and each session ends automatically after 30 minutes (sooner if staff end it). Separately, authorized staff can make administrative changes to an account, such as issuing credits, extending a billing period, or issuing a refund; these are recorded in the internal staff audit log described below.

Every session is recorded in an internal staff audit log, separate from your usage audit log: which staff member opened it, which account it was for, and when it started and ended or expired, plus a list of the dashboard pages viewed and when (up to the 50 most recent).

We keep these records as an accountability trail and do not delete them on a schedule. If you delete your account, each session's detailed record, including its page list, is deleted with it; minimal audit-log entries for the session stay, without a link to your account, though they may still show a label identifying your site or account (normally your site's domain name). Audit-log entries for administrative changes also stay after you delete your account. The link to your account is removed, but they can still include the staff member's written reason, payment-provider IDs (for example for a refund, charge or subscription), amounts, and a label identifying your site or account (normally your site's domain name). Questions about staff access? Email privacy@auctollo.com.

7. Data Retention

Billing evidence. We keep a minimal billing-evidence record — when and from where (IP address and browser) you accepted our Terms and our checkout disclosures, when and from where you signed in (at most once a day, for paying accounts), a daily summary of service usage on your account, plus basic payment references, but no site or sitemap data — solely to defend against payment disputes and chargebacks (GDPR Art. 17(3)(e)). If you have been charged or started a checkout, we keep it for up to 180 days after your last charge or checkout, even if you delete your account. Otherwise we keep it while your account is open and for up to 180 days after you delete it. If a dispute is open, the record is kept until it is resolved.

8. Your Rights and Choices

All Users

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and personal data.
• Portability: Receive your data in a machine-readable format.

EU and UK Residents (GDPR / UK GDPR)

In addition to the above rights:

• Restriction: Ask us to restrict processing of your data.
• Object: Object to processing based on legitimate interest.
• Withdraw consent: For consent-based processing (marketing emails, analytics cookies), withdraw at any time.
• Supervisory authority complaint: Lodge a complaint with your local data protection authority.

California Residents (CCPA / CPRA)

• Right to know what personal information we collect and use.
• Right to delete personal information we hold about you.
• Right to opt out of sale — we do not sell personal information.
• Right to non-discrimination for exercising your rights.

How to Exercise Your Rights

WordPress plugin users: Use WordPress's built-in privacy tools at Tools → Export Personal Data and Tools → Erase Personal Data. The Plugin registers its data categories with WordPress's privacy framework.

Platform users: Email privacy@auctollo.com with the subject "Privacy Request — [Action]" (e.g., "Privacy Request — Data Deletion"). We will acknowledge within 5 business days and respond within 30 days.

9. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact privacy@auctollo.com.

10. International Data Transfers

Auctollo is based in the United States, and data is stored and processed primarily on Supabase / AWS US-East-1 infrastructure. For EU/UK residents, we rely on Standard Contractual Clauses (SCCs) and Supabase's EU data transfer mechanisms to safeguard cross-border transfers.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification will be sent to the email address on your account and will describe the nature of the breach, the categories and approximate volume of data affected, likely consequences, and the measures taken or proposed.

EU and UK residents: We will also notify the relevant supervisory authority within 72 hours where required by GDPR Article 33.

To report a suspected security issue: legal@auctollo.com

12. Google User Data

This section covers the data we receive from Google: your Search Console data, when you connect it in the dashboard (Integrations → Google Search Console) or with "Connect with Google (via Auctollo)" in the plugin; your Google Analytics data, when you connect it in the dashboard (Integrations → Google Analytics); and your basic profile, if you sign in with Google.

12.1 What we access and why

For Search Console we ask for one Google permission, https://www.googleapis.com/auth/webmasters, the read and write Search Console permission. We use the write part only to submit a sitemap.

When you connect, we read the list of Search Console properties your Google account can see, once, to find the one for your site (its URL-prefix property, or the Domain property that covers it). We keep only that property and do not store the rest of the list, and we do not request any other Search Console data. Google Analytics is covered separately in Section 12.7.

12.2 How we use it

Search Console data. We use it only to provide the features above to you: to show it in your dashboard, to submit sitemaps you ask for, and to send you alerts, by email and in the notification bell, and the reports you schedule (for example an "Indexation dropped" alert, or a scheduled report with the Index coverage section). We do not sell Google data, use it for advertising, or use it to develop, improve, or train AI or machine-learning models. We do not send Search Console data to any AI provider.

Sign-in details. We use them to create and run your account and to email you, as the table above says. We do not sell them or use them to show ads.

12.3 How we store it

• Refresh token. When you connect, Google gives us a refresh token, so we can read your Search Console data without asking you to sign in each time. We encrypt it (AES-256-GCM) before it is stored, with a key kept separately from the database. It is never shown in the dashboard and never sent to your browser or to your WordPress site. We ask Google for a short-lived access token when we need one and do not store it.
• Connection record. Your site's Search Console property, the connection's status, the last sync time, and the last error message. We do not store the email address or name of the Google account you connected.
• Index status. For each URL we check, whether Google reports it as indexed, crawled, discovered, excluded, in error, or unknown, and when we checked. We keep the latest result for each URL. When a later check finds a different result, we also keep a note of the change for 90 days: the URL, the search engine, the new and the previous result, and when we saw each result. We use these notes to list the pages that dropped out of the index. Once a day we also save one number for each site: how many entries were indexed, counting one entry for each URL and each search engine (so a URL indexed by both Google and Bing counts twice), and which search engines it counted. We use it to detect drops. For the indexed-percentage chart we also save, each day and for each search engine, how many URLs we have checked and how many of them were indexed, and keep these daily counts for 90 days.
• Search analytics, URL inspection details, and sitemap lists are not saved. They are fetched when you ask and held in server memory for up to 5 minutes.
• Reports. If you add the Index coverage section to a scheduled report, its totals are in the report we generate and email. Report files are kept for 90 days. A data export too large to download at once (Reports → Exports) is prepared as a file available to download for 7 days, then deleted; the index status export lists your URLs with their index status.
• Notifications. An "Indexation dropped" alert also appears in the notification bell in your dashboard, with the same two counts. We delete a notice 90 days after it was created if you have read it, and 180 days after it was created in any case.
• Alert rules and their history. The alert rules you set for a site, and a record of each time one fired, are stored with the site: the figure measured, the figure it was compared with and a one-line sentence made of those numbers (for the "Indexation dropped" rule, the same two counts). We delete a history entry 180 days after it fired, and delete the rules and their history with the site. Our staff do not see the history while they view your account as you. An alert about indexed pages is sent by email and appears in the notification bell; it is not sent as a browser push notification.
• Sign-in details. If you sign in with Google, Supabase Auth (Section 3) stores what Google returns: your email address, whether Google has verified it, your name and picture URL, and Google's ID for your account. Your name and picture URL are also copied to your profile when your account is created.

Everything except the in-memory results is stored in our database at Supabase (United States). Row-level security keeps each account's data separate, and the refresh token cannot be read through the dashboard at all; only our servers use it.

12.4 Who receives it

• Your WordPress site. With "Connect with Google (via Auctollo)" we keep the refresh token and give your site short-lived access tokens, and your site then calls Google directly from your own server. The Search Console data it fetches goes to your site, not to us. If your site is linked to a Pro account, the plugin also tells us that a Search Console action happened (its name, a count, and a small detail such as how many rows came back) so we can record usage. It does not send us the results. On this connection the plugin does not ask Google for your account's name or email address.
• Other members of your account. The connection belongs to your site, not to the person who made it. Members you add on the Members page can see your site's Google data in the dashboard (index status, the daily counts, the connection and its last error message, and stored report files) and can use the Search Console tools, connect, and disconnect.
• Our service providers (Section 3) that run the Service for us: Supabase stores the data, Vercel hosts the app, and Resend delivers the alerts and reports above, which can include index totals.
• People you choose, if you schedule a report and enter their email addresses.

We do not share Google data with anyone else, except where the law requires it.

12.5 Staff access

In the product, authorized staff cannot see your Google Search Console data. The read-only "view as customer" sessions described in Section 6 show a notice that it is hidden in place of the Indexation page, the Webmaster tools page, the error message on the Search Console card in Integrations, and the list and downloads of your stored report files, which can include the Index coverage section. In a session the tools that call Google live (search analytics, URL inspection, and sitemaps) are switched off, and the refresh token is never shown. We do not otherwise read your Google data, except to investigate abuse or a security issue, to comply with the law, or with your permission.

12.6 Disconnecting and deleting

• In the dashboard: Integrations → Google Search Console → Disconnect. This deletes the encrypted refresh token, the index status of your URLs and the notes of its changes, the daily counts that included Google, and the sync position we keep for it (where the next sync would resume), and clears the connection's last error message. The connection record (your site's Search Console property, its status, and its dates) stays, so you can reconnect. Disconnect does not contact Google, so the permission you gave Google stays until you remove it there (see below). Reports and notifications that were already created are kept for the periods above. A data export file that was already prepared stays available to download for its 7 days, then is deleted.
• In the plugin: Disconnect on the plugin's Integrations page. The plugin asks us to delete our copy of your refresh token and to mark the connection disconnected. Uninstalling the plugin sends the same request just before it removes the credential from your site, once for each site that has one (on a network of sites, one after the other). It waits at most five seconds for each request and fifteen seconds for all of them, and it never stops the uninstall. If a request is not sent or does not get through (your site cannot reach us, or on a large network the fifteen seconds are spent before its turn), nothing repeats it: once the plugin is removed there is nothing left on your site to disconnect with, so our copy then stays until you ask us to delete it (email privacy@auctollo.com). Disconnect before you uninstall if you want to be sure. We keep a short record of the connection (your site's URL, and when it was created, last used, and disconnected) but not the token. A connection you start but never finish is deleted, with its token, within about two days.
• If you leave an account: a connection belongs to the site, not to the person who made it. If you connected it as a member of someone else's account and then leave, the connection and its data stay with that site until someone disconnects it, and deleting your own account does not remove it. Disconnect it before you leave, or remove our access at Google (see below).
• At Google: disconnecting does not remove the permission you gave Google. To remove it, go to myaccount.google.com/permissions, choose Auctollo, and remove access. We do not do this for you because Google applies it to every site and dashboard connection on that Google account at once. This includes Google Analytics (Section 12.7).
• Deleting your account, or a site, deletes the dashboard connections, tokens, index status, daily counts, notifications, and report files that belong to it (copies in database backups are purged within the period in Section 7). Plugin connections are not tied to an account, so disconnect them in the plugin or email privacy@auctollo.com.

12.7 Google Analytics

If you connect Google Analytics to a site (Integrations → Google Analytics; only the site owner can), Google asks you to approve a second, separate permission, https://www.googleapis.com/auth/analytics.readonly, the read-only Google Analytics permission. The Search Console approval never includes it, and this approval asks for nothing else. We use it for two things only: to list the Analytics properties your Google account can read, so you can choose one, and to read one report from the property you chose.

• What we read. For the property you choose: the number of sessions that came from organic search (Google Analytics' "Organic Search" channel), for each landing page on your site's own host name, by day. We read the last 90 days when you choose the property, then the latest days once a day. We do not read user-level data, audiences, events, or traffic from other channels.
• What we use it for. Only to show you your organic search traffic, and to build on it features you use: a warning when it drops, choosing which pages a site audit looks at first, and ranking your pages. We do not sell it, use it for advertising, or use it to develop, improve, or train AI or machine-learning models. We do not send Google Analytics data to any AI provider.
• What we store. The connection: which property you chose and its name, its status, when the last pull ran and the newest day it covered, and a short note of our own if the last pull failed. The refresh token, encrypted (AES-256-GCM) with a key kept separately from the database; it is never shown in the dashboard and never sent to your browser or to your WordPress site. For each page and day, the page's address and its number of organic sessions, kept for 90 days and then deleted. We do not store the email address or name of the Google account you connected.
• Who receives it. You and the members of your account, who can see its status and traffic numbers in the dashboard; only the site owner can connect, change, or disconnect it. Our service providers (Section 3): Supabase stores the data and Vercel hosts the app. We do not share it with anyone else, except where the law requires it.
• Staff access. As in Section 12.5, authorized staff cannot see it: the "view as customer" sessions show a notice that it is hidden in place of the Google Analytics card and its numbers.
• Disconnecting and deleting. Integrations → Google Analytics → Disconnect. We delete the token, the daily traffic, and the connection record. Disconnect does not contact Google, so the permission you gave Google stays until you remove it at myaccount.google.com/permissions. We do not revoke it for you because Google applies a revocation to every site and dashboard connection on that Google account at once. Deleting your account, or the site, deletes them too (copies in database backups are purged within the period in Section 7).

12.8 Limited Use

Auctollo's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

13. Changes to This Policy

We will post changes to this page and update the "Last updated" date. For material changes, we will notify you by email or via a dashboard notice at least 30 days before the change takes effect.

Privacy inquiries: privacy@auctollo.com
W3 EDGE, LLC d/b/a Auctollo
9450 SW Gemini Drive PMB 22185, Beaverton, OR 97008-7105, US