Privacy Policy

This privacy policy explains how Keupera collects, uses, discloses and retains personal data, and what rights you have in relation to it. It is issued under Articles 13 and 14 of the GDPR.

Defined terms. Capitalised terms not defined here have the meaning given to them in our Terms of Service. Where this policy and the Terms of Service conflict on a question of data protection, this policy prevails.

Two roles, two documents. For some processing we are the controller; for other processing we are a data processor acting for you. § 2 and § 3 explain which is which. Where we act as a processor, the governing document is our Data Processing Agreement, not this policy.

The controller within the meaning of Art. 4(7) GDPR for the processing described in this policy is:

Data protection contact. Enquiries and requests to exercise your rights should be sent to legal@keupera.com. Please state which right you are exercising and, where you are not writing from the email address on your account, enough information for us to identify you without collecting more data than necessary.

Data protection officer. We have not appointed a data protection officer. The threshold in § 38(1) sentence 1 of the German Federal Data Protection Act (BDSG) - twenty or more persons constantly engaged in automated processing - is not met. We keep the second limb of § 38(1) BDSG under review as our processing changes, and we will publish the appointment here if one becomes necessary.

Representatives. We are established in the European Union and therefore require no representative under Art. 27 GDPR. Where we are required to designate a representative for the United Kingdom, that designation will be published in this section.

Parts of the Services exist to process personal data that belongs to your business rather than to us. For that processing you are the controller and we are your data processor. We act only on your documented instructions, and our Data Processing Agreement - not this policy - sets the terms.

Your obligations as controller. You must have a lawful basis for this data, provide the privacy information your own data subjects are entitled to, and obtain any consent that applies - in particular consent under Art. 5(3) of the ePrivacy Directive and § 25 TDDDG before deploying our tracking script, which contains no consent mechanism of its own.

Where to find the terms. Our Data Processing Agreement is published at keupera.com/legal/dpa and forms part of your contract with us. It incorporates the standard contractual clauses where they are required.

We collect the following categories of personal data in our capacity as controller.

Special categories. We do not seek personal data falling within Art. 9 GDPR, and the Services are not designed to process it. Do not upload it.

We offer a set of SEO tools on keupera.com that anyone may use without registering. This section applies to those tools, and to the equivalent tools inside the application when used before sign-in.

Rate limiting. Requests from unauthenticated users are limited by IP address and by guest identifier. This is the reason the IP address is processed; it is not used to build a profile of you.

Onward transfer. Where the tool requires it, the target address or keyword you enter is transmitted to the relevant sub-processor in § 14 - for example a search-data provider or an AI provider - in order to produce the result. We do not transmit your IP address to those providers for this purpose.

Retention. We are reducing the retention of these records. Our commitment is that the IP address and user-agent associated with an anonymous request are erased within 30 days, after which only aggregate counts remain. Where you were signed in, the record is retained for 12 months.

Your rights. You may object to this processing, and request erasure of the records associated with your guest identifier or IP address, by writing to legal@keupera.com. Because we hold no other identifier for anonymous users, please include the approximate date and the tool used.

Some data reaches us from sources other than the person it concerns. Art. 14 GDPR requires us to be explicit about this, and we are.

Owners and contacts of third-party websites. When a customer runs backlink or outreach research, we retrieve publicly accessible pages and, from them, contact names and email addresses published on those pages. The source is always the public web. The legal basis is Art. 6(1)(f) GDPR; our interest, and that of our customer, is in identifying appropriate professional contacts for a business communication. We do not collect data from private or access-controlled areas, we do not attempt to defeat access controls, and we do not enrich this data from data brokers.

Any email you subsequently receive is sent by our customer, from our customer's own mail server, and our customer is the controller of that communication. If you write to legal@keupera.com we will nevertheless erase your details from our systems and, on request, tell you which customer holds them.

Leads captured by our customers. Where a customer places our audit widget on their website, a visitor who requests a report may provide an email address, which we store together with the IP address, user-agent and referring page. For this data we are a data processor and the customer is the controller. Please direct requests to that customer in the first instance; we will assist them, and we will act ourselves where they do not.

Visitors to our customers' websites. See § 11.

Data in uploaded log files. A customer analysing AI-crawler traffic may upload their own server access logs, which typically contain visitor IP addresses. We process that content solely to produce the requested analysis, as a data processor.

People named in customer content. Articles, notes, comments and team messages may mention identifiable people. We process that content only to provide the Services.

The Services can act on other systems on your behalf. Doing so requires us to hold credentials, and we want to be precise about how they are handled.

How they are protected. Credentials are encrypted at rest with AES-256-GCM under a key held only in our server environment, and are decrypted only in server-side code at the moment an action you configured is carried out. They are never transmitted to your browser, never returned by our API, and never written to application logs.

Your warranties. By connecting an account you confirm that you are entitled to grant that access and that doing so does not breach your agreement with the provider concerned.

Revocation. You may disconnect an integration at any time in the application, which deletes the stored credential. You may additionally revoke Google access at myaccount.google.com/permissions and revoke a WordPress application password from your own WordPress profile. We recommend doing both when you stop using an integration.

Where you connect Google Search Console, our use of the data obtained is governed by the Google API Services User Data Policy, including its Limited Use requirements. This section is the disclosure that policy requires.

Several parts of the Services are built on large language models operated by third parties. We consider it important that you know exactly what leaves our systems.

Notice under Art. 50 of the AI Act. Where you interact with our support assistant, the dashboard assistant, the editor assistant or the workflow assistant, you are interacting with an artificial-intelligence system and not with a human being. We are a deployer and downstream provider of these systems; we are not a provider of a general-purpose AI model.

Training. We do not train, fine-tune or otherwise develop any model on your content, and we operate no model of our own. What our providers may do with data submitted through their APIs is governed by their own terms, which we have accepted on the standard commercial basis for business API use. We will not state that your content is excluded from provider-side retention or model training unless and until we have secured that contractually, and we will update this section when we do.

Accuracy. Model outputs can be wrong, incomplete or fabricated, including where they appear confident. Review anything you intend to publish. Nothing in the Services is a guarantee of a search ranking, of traffic, or of being cited by any AI assistant.

Keupera includes a first-party analytics product. Where you install our script on your own website, we process data about your visitors as your data processor; you are the controller.

This is pseudonymisation, not anonymisation. A hash of an IP address can in principle be reversed by an exhaustive search, so the resulting identifier remains personal data under the GDPR. We say so plainly, because describing it otherwise would misstate your obligations as controller.

Country lookup. Country and city are normally derived on our own servers from a local geolocation database. In a narrow fallback path the IP address is sent to ip-api (Artia International S.R.L., Romania) to resolve the country. We are removing this fallback; while it exists, it is disclosed here.

Consent is your responsibility. The script has no consent mechanism of its own. It begins collecting when the page loads. You must obtain consent under § 25 TDDDG and Art. 5(3) of the ePrivacy Directive, or the equivalent rule in your jurisdiction, and load the script only after that consent is given.

Bot traffic. We also record requests from identifiable AI crawlers such as GPTBot, ClaudeBot and PerplexityBot. That data describes automated agents, not people.

Storing information on your device, or reading information already stored there, requires your consent under § 25(1) TDDDG unless it is strictly necessary to provide a service you expressly requested. We ask for that consent through the banner shown on your first visit.

Cookie-free statistics. keupera.com additionally uses Simple Analytics, which produces aggregate traffic statistics without setting cookies and without any cross-site identifier.

Your record of consent. When you make a choice we store a consent identifier, the time of your decision, the policy revision in force, and which categories you accepted or rejected. This record exists so that we can demonstrate compliance with Art. 7(1) GDPR; it is held in our product-analytics system.

Revisions. If we change our use of cookies materially we increase the policy revision number, and you will be asked to review your choices again.

Scope. Your choice is stored for the whole of keupera.com, including app.keupera.com, and lasts for one year unless you change it sooner.

Changing your mind. Use the button below, or the "Manage preferences" link in the banner, at any time. You can also delete cookies through your browser settings, though doing so will also clear the record of your preferences.

A complete, itemised register of every cookie and storage item - name, provider, purpose and duration - is published in our Cookie Policy at keupera.com/legal/cookies.

Newsletter and product marketing. We send marketing email only where you have consented, or where § 7(3) of the German Act Against Unfair Competition (UWG) permits us to write to an existing customer about our own similar services. Every message contains a one-click unsubscribe link, and we act on unsubscribes without delay. Withdrawing consent has no effect on your use of the Services.

Double opt-in. Where you subscribe on our website, we send a confirmation email and record your subscription only after you confirm it. We store the confirmation and its timestamp as evidence of consent.

Onboarding sequence. After sign-up we send a short, finite sequence of guidance emails about getting started. These are sent on the basis of Art. 6(1)(f) GDPR, or of your consent where you gave it in the onboarding survey, and each one can be stopped with a single click. Your notification preferences in the application control this independently of the newsletter.

Service messages. Invoices, security notices, changes to these documents and messages about your subscription are part of the contract. They cannot be unsubscribed from while you hold an account.

Affiliate programme. If you arrive through a partner link, and you have accepted the marketing cookie category, we record the referring partner for thirty days so that commission can be attributed. Partners see the fact of a referral and the resulting commission; they do not see your account content. Attribution is operated for us by ZASolution (Affonso), whose details are in § 14.

No advertising profiles. We do not build advertising profiles, we do not operate retargeting pixels for advertising networks, and we do not disclose personal data to advertising networks.

Primary processing locations. Our database, file storage and application backend run in the European Union (Ireland). Our analytics store, crawler and MCP server run in Germany. Our product analytics is hosted in the European Union.

Transfers to third countries. Certain sub-processors listed in § 14 are established in, or process in, the United States. For those transfers we rely on the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, supplemented by a documented transfer impact assessment and by the technical measures described in § 16.

On the EU-US Data Privacy Framework. Some of our providers are certified under the Framework, and its adequacy decision remains in force. Because an appeal against the General Court's judgment upholding that decision is pending before the Court of Justice, we do not rely on the Framework as our sole basis for any transfer. The standard contractual clauses stand independently of it.

Israel. Transfers to Bright Data Ltd. are made on the basis of the European Commission's adequacy decision for Israel.

Your copy. You may request a copy of the safeguards we rely on, with commercially confidential terms redacted, by writing to legal@keupera.com.

Public authorities. We have received no order requiring bulk disclosure of customer data to any public authority. Where we receive a lawful, specific request we assess it, and where we are permitted to do so we notify the affected customer before responding.

We maintain technical and organisational measures appropriate to the risk, as Art. 32 GDPR requires. The principal measures are:

What we do not claim. We hold no ISO 27001 or SOC 2 certification, and we do not represent that we do. We publish the current state of our measures, including their limits, at keupera.com/legal/security, and we update it as they improve.

Personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware of it, in accordance with Art. 33 GDPR, and we notify affected individuals without undue delay where the risk is high. Where we act as a processor, we notify the affected customer without undue delay and in any event within 48 hours, as our Data Processing Agreement provides.

Reporting a vulnerability. Write to security@keupera.com. We will acknowledge your report, keep you informed, and will not pursue researchers who act in good faith and give us a reasonable opportunity to respond before disclosure.

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires.

Record of deleted accounts. When an account is deleted we retain the email address alone, in a separate table, for 30 days, to prevent immediate re-registration for the purpose of abusing free allowances. The legal basis is Art. 6(1)(f) GDPR. We disclose this expressly because it means one item of data survives an erasure request for that period. Nothing else is retained.

Content owned by an organisation. Team messages, editor comments, audit runs and captured leads belong to the organisation rather than to the individual who created them, and they remain when that individual's account is deleted. This is necessary for the remaining members to continue using the Services. Contact us if you need such content removed.

Backups. Data removed from live systems persists in encrypted backups until those backups age out on their normal rotation, after which it is overwritten. Restored backups are re-processed to remove data that was erased in the interim.

Under the GDPR you have the following rights in relation to personal data we hold about you as controller.

How to exercise them. The application offers self-service export and deletion under Account. Where you want a complete set of everything we hold - which is broader than the current in-app export - write to legal@keupera.com and we will assemble it manually. We are extending the in-app export to cover the full record.

Our response. We respond within one month of receipt. Where a request is complex, or where you have made several, we may extend that period by two further months and will tell you within the first month, with reasons. Our response is free of charge; we may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, and we will explain why.

Identification. Where we have reasonable doubt about the identity of the person making a request we may ask for further information. We will not use anything you send for that purpose for any other end.

This section applies in addition to § 18 if you are a resident of a US state with a comprehensive consumer privacy law, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island.

Notice at collection. The categories of personal information we collect, the purposes, and the categories of recipients are set out in § 4, § 5 and § 14. We collect all of it directly from you, from your use of the Services, or from the public sources described in § 7.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA and in the equivalent statutes of other states. We do not process personal information for targeted advertising, and we have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under sixteen.

Sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics, and we use none of it beyond what is necessary to provide the Services.

Data minimisation. We collect only what is reasonably necessary and proportionate to provide the Services you requested. Where the law of your state - Maryland's, in particular - sets a stricter standard, we apply that standard to your data.

How to exercise them. Write to legal@keupera.com, or use the self-service tools under Account. We verify requests against the information already associated with your account. An authorised agent may act for you on production of written authority, and we may still ask you to confirm the authorisation directly.

Timing and appeals. We respond within 45 days, extendable once by a further 45 days where reasonably necessary, with notice to you. If we decline a request you may appeal by replying to our decision with the word "Appeal" in the subject line. We decide appeals within 45 days and, if we again decline, we will tell you how to complain to your state Attorney General.

Global Privacy Control. Because we do not sell or share personal information, an opt-out preference signal has no sale or sharing to switch off. We honour it as a withdrawal of consent to non-essential cookies.

The Services are business tools, offered exclusively to persons acting in the course of a trade, business, craft or profession. They are not directed to children and we do not knowingly collect personal data from them.

Age requirement. You must be at least 18 years old to open an account, as our Terms of Service provide. Where a lower age would otherwise apply under Art. 8 GDPR, our contractual minimum of 18 governs.

If we discover a child's data. We will delete it without undue delay and terminate any account concerned. If you believe a child has provided us with personal data, write to legal@keupera.com and we will act promptly.

Content you upload. You must not upload personal data concerning children through the Services. If you do, you are the controller of it, and you must have a lawful basis and any parental consent that applies.

Changes to this policy. We keep this policy under review and update it when our processing changes. The version in force is always published here with its effective date. Where a change is material - a new purpose, a new category of data, a new category of recipient, or a change to the legal basis - we notify account holders by email at least 30 days before it takes effect. Continued use of the Services after that date constitutes acknowledgement; it does not constitute consent where consent is required, which we will always ask for separately.

Version history. Previous versions are available on request from legal@keupera.com.

Complaints to us. If you are dissatisfied with how we handle your personal data, please tell us first at legal@keupera.com. We take complaints seriously, we will investigate, and we will reply substantively.

Complaints to a supervisory authority. You have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. Approaching us first is not a precondition.

Our competent supervisory authority is:

Judicial remedy. Art. 79 GDPR additionally gives you the right to an effective judicial remedy, and Art. 82 a right to compensation for damage suffered as a result of an infringement.

Effective date. This policy takes effect on 5 September 2026 and replaces all previous versions.