Privacy Policy

1. Who we are

nanoSEO (“nanoSEO”, “we”, “us” or “our”) operates this website and the SEO audit service available through it. For the purposes of the UK GDPR, EU GDPR, and other applicable data protection laws, nanoSEO is the controller of the personal data described in this policy.

Privacy and legal contact: cw228911@gmail.com.

2. Scope

This policy applies to this website, checkout, audit reports, report exports, and any related support or legal communications. It applies worldwide. It does not apply to third-party websites, including websites you ask us to scan or NanSwap’s payment service, which have their own privacy notices.

3. At a glance

• No nanoSEO account, name, or email address is required to buy or view an audit.
• We do not keep a full copy of scanned websites. We store extracted audit data such as page URLs, titles, metadata, counts, links, scores, findings, and recommendations.
• We use order and audit records to create, deliver, secure, support, and account for the service.
• We do not sell personal information or share it for cross-context behavioural advertising.
• NanSwap processes the crypto payment inside the checkout. nanoSEO does not receive your private wallet keys or card details.
• Report history is stored in your browser’s local storage and can be cleared from the reports section or your browser settings.

4. What we collect

We do not intentionally collect special-category data, health data, biometric data, precise location, children’s data, or information used to infer sensitive characteristics. Do not send us sensitive personal data. URLs can contain personal data in paths or query strings, so remove such information before submitting a URL.

5. How we use information

• Create orders, calculate prices and discounts, process or verify payment status, and deliver purchased audits.
• Discover pages, scan public pages, generate findings, scores, comparisons, sitemap coverage, link maps, and reports.
• Host reports, provide exports and report-history features, and respond to support requests.
• Maintain security, prevent abuse, investigate errors, enforce our Terms of Use, and protect legal rights.
• Keep accounting, tax, fraud-prevention, and other legally required records.
• Comply with law and respond to valid legal requests.

We do not use your data for behavioural advertising, retargeting, or the sale of personal information. We do not make decisions producing legal or similarly significant effects through automated processing.

6. Legal bases in the UK, EU/EEA, and Switzerland

• Contract: processing needed to create your order, provide the audit, and deliver the report.
• Legitimate interests: securing the service, preventing abuse and fraud, troubleshooting, improving reliability, and protecting legal rights, balanced against your rights.
• Legal obligation: retaining records where accounting, tax, consumer, or other law requires it.
• Consent: where we expressly ask for it, including any optional communication. You may withdraw consent at any time without affecting earlier processing.
• Vital or public interests: only where applicable law permits.

7. Cookies and browser storage

nanoSEO does not set analytics, advertising, or marketing cookies. We use local storage in your browser to remember recent reports. You can clear this using the “Clear history” control or your browser settings.

The private admin area uses a signed, HttpOnly, SameSite=Strict session cookie that expires after eight hours. It is not used for tracking or advertising.

Our hosting and payment providers may use strictly necessary security or network-management cookies or similar technologies under their own policies. The NanSwap checkout runs inside an iframe and may use its own cookies or storage; review the privacy information shown in that checkout and NanSwap’s own policies.

8. When we share information

We do not sell personal information. We share it only as needed with:

• Cloudflare for hosting, content delivery, security, and the D1 database that stores orders, payment metadata, and audit records.
• NanSwap and its payment infrastructure to create and verify crypto payment orders. NanSwap may act as an independent controller for its payment and compliance activities. We do not receive private wallet keys or card details.
• Professional advisers, auditors, insurers, and service providers where necessary for legal, accounting, security, or business operations, subject to appropriate confidentiality obligations.
• Authorities or other parties where required by law, to protect safety or rights, to investigate fraud or abuse, or as part of a merger, acquisition, financing, reorganisation, or sale of assets, subject to applicable law.
• Anyone you choose if you share a report link, export, or other information yourself.

We require processors to protect personal data and use it only for the services they provide to us. Some providers may use aggregated or de-identified information under their own terms, subject to applicable law.

9. International transfers

nanoSEO and its providers operate globally. Your information may be processed in the United Kingdom, the European Economic Area, the United States, and other countries where Cloudflare, NanSwap, or their subprocessors operate. Privacy laws in those countries may differ from those where you live.

Where required, we rely on appropriate safeguards such as an adequacy decision, the UK International Data Transfer Addendum, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. Contact us if you want more information about the safeguards used for a particular transfer.

10. How long we keep information

We keep order, payment, and audit records for as long as reasonably needed to provide and support the service, maintain security, resolve disputes, prevent fraud, and meet accounting, tax, and legal obligations. We delete or de-identify information when it is no longer needed, when a valid request is actioned, or when records are removed as part of maintenance, security, or legal processes. Retention periods vary because the purpose and legal requirements for each record differ.

Audit reports remain accessible through their unlisted report URL until removed in response to a valid deletion request or otherwise deleted or purged as part of maintenance, security, or legal processes. Because nanoSEO does not require an account, we may not be able to locate your records without a report ID, order ID, or target URL. Browser history remains in your browser until you clear it or remove the browser data.

If you contact us, we keep the correspondence only for as long as needed to handle the matter and meet legal obligations. We may retain limited records where the law requires retention or where needed to establish, exercise, or defend legal claims.

11. Security

We use administrative, technical, and organisational safeguards designed to protect information, including encrypted transport, access controls, signed admin sessions, restricted administrative access, and reputable infrastructure providers. No internet transmission or storage system is completely secure, so we cannot promise absolute security.

You are responsible for keeping report URLs and exports private if you do not want others to see them. Contact us promptly if you believe a report or account credential has been exposed.

12. Your rights

Subject to applicable law, you may have the right to:

• request access to personal data and information about how it is used;
• request correction of inaccurate data;
• request deletion of data;
• request restriction of or object to processing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to a data protection authority; and
• ask not to receive direct marketing. We do not currently send marketing.

Email cw228911@gmail.com with enough information to identify the request, such as the report ID, order ID, target URL, and the email address you used to contact us. We may need to verify your identity or authority before acting. We will respond within the time required by applicable law.

13. United States privacy rights

If you live in a US state with a comprehensive privacy law, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or a similar law, you may have some or all of the following rights:

• to know or access the categories and specific pieces of personal information we hold;
• to correct inaccurate personal information;
• to delete personal information;
• to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling;
• to limit the use and disclosure of sensitive personal information;
• to use an authorised agent;
• to appeal a refusal where the applicable state law provides an appeal; and
• to be free from discrimination for exercising privacy rights.

Our practice: we do not sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising, or use sensitive personal information to infer characteristics. We do not knowingly collect personal information from consumers under 16. If a Global Privacy Control signal is sent, we treat it consistently with our no-sale/no-sharing practice.

California notice at collection: in the preceding 12 months, the categories we may have collected are identifiers (such as IP address, order and report IDs, and URLs), commercial information (plan, amount, payment status), internet or network activity (scan and request data), and inferences drawn from audit results (such as a score or finding category). We collect these for the purposes described in this policy. We do not use or disclose sensitive personal information for purposes requiring a right to limit under the CPRA.

To exercise a right, email cw228911@gmail.com. Include the report ID or order ID where available. We may ask for information needed to verify the request. An authorised agent may submit a request with written authority and verification. If we deny a request, we will explain the reason and any appeal process required by applicable law.

14. Other regions

Canada

We handle personal information in accordance with applicable Canadian privacy law, including PIPEDA and, where applicable, Quebec’s Law 25. You may request access or correction, ask questions about our handling, or withdraw consent subject to legal or contractual restrictions. You may also contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority.

Australia

We handle personal information in accordance with the Australian Privacy Principles. You may request access or correction and may complain to us or the Office of the Australian Information Commissioner. Our providers may process information outside Australia, including in the United States and the United Kingdom, subject to applicable safeguards.

New Zealand

We handle personal information in accordance with the New Zealand Privacy Act 2020. You may request access or correction and may complain to us or the New Zealand Privacy Commissioner.

Brazil

Where the Brazilian LGPD applies, you may request confirmation of processing, access, correction, anonymisation, portability where applicable, deletion, information about sharing, and withdrawal of consent. You may contact the Brazilian National Data Protection Authority (ANPD).

Other jurisdictions

If another privacy law gives you rights that are not described here, contact us and we will handle your request as required by that law. Nothing in this policy limits a right that cannot legally be limited.

15. Children

nanoSEO is a business service and is not directed to children. We do not knowingly collect personal information from children under 13, or under the minimum age required by local law. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

16. Events outside our immediate control

We may be unable to process or retain information, provide a report, or meet a timing estimate because of events outside our immediate control, including natural disasters, severe weather, fire, flood, earthquake, epidemic or pandemic, war, terrorism, civil unrest, riot, government action, sanctions, labour disputes, cyberattacks, internet or telecommunications failures, power failures, hosting outages, blockchain congestion, exchange or payment-provider outages, or failures of third-party infrastructure. We will take reasonable steps to protect information and restore service, and our obligations are suspended to the extent the event prevents performance, except where applicable law requires otherwise.

17. Changes to this policy

We may update this policy to reflect changes in the service, law, or our practices. We will publish the revised version here and update the “last updated” date. Where a change is material, we will provide additional notice if required by law. The version in force when you use the service applies to that use, subject to any non-waivable legal rights.

18. Contact and complaints

Questions, privacy requests, complaints, and legal notices should be sent to cw228911@gmail.com. Please include “Privacy request” in the subject line and enough detail for us to identify the relevant order or report.

You may also complain to your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO). In the EU/EEA, it is your local supervisory authority. We would appreciate the chance to resolve your concern first.