This policy explains what personal data Sevenfixes handles, why, and what you can do about it. It covers this website and the Sevenfixes app.
Who we are
Private Entrepreneur Serhii Symonov (FOP Symonov Serhii), a sole proprietor (FOP) registered in Ukraine, tax ID 3102901953, 17 Hranychna St., Kropyvnytskyi, Kirovohrad Oblast, 25000, Ukraine, trading as Sevenfixes ("we", "us").
We are the controller for your account data. For the data you bring from your connected sources, see our data processing agreement. Write to [email protected] with any privacy question or request.
An EU representative under Article 27 GDPR will be named here once one is appointed.
What we collect and why
| Data | Why |
|---|---|
| Your email address, an optional name, and a hashed password | To create your account, sign you in and send you the weekly list and service emails. |
| Your organization's settings: sites, page types, schedules, keywords, AI prompts, notes | To run the service you set up. |
| Data from the sources you connect (Google Search Console, Google Analytics, Cloudflare, Bing Webmaster Tools) | To build your weekly list, check your fixes and show the Recovery view. See "Data from Google" below. |
| Pages we fetch from your site: a small sample of URLs from your sitemaps | To check things like canonical tags, titles and structured data, and whether a fix worked. We store the results of those checks. |
| Server logs, which include IP addresses | To keep the service secure and fix errors. Logs rotate automatically and are kept for a short time. |
We do not collect personal data about your site's visitors. Search Console and Analytics data reach us as aggregated numbers, and we read Cloudflare analytics without client IP addresses.
Payments are handled by Paddle, our reseller and Merchant of Record. Paddle collects your payment details as an independent controller under its own privacy policy; we never see your full card number.
Data from Google
When you connect Google, you choose which access to grant. We ask only for what each feature needs:
| Scope | What we use it for | Why a narrower scope does not work |
|---|---|---|
openid, email, profile | To know which Google account you connected and show it in the app. | These are the minimum scopes for identifying an account. |
webmasters.readonly | To read search performance, sitemaps and URL Inspection results for your sites, and to confirm that your account has access to a site before we fetch anything from it. | It is the read-only Search Console scope; there is no narrower one. |
analytics.readonly (optional, only if you add Google Analytics) | To read which page types bring visits. | It is the read-only Analytics scope; there is no narrower one. |
Sevenfixes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- We use Google data only to provide and improve the features you see in Sevenfixes.
- We do not sell it, we do not use it for advertising, and we do not use it to train AI models.
- We do not transfer it to others, except as needed to run those features (the subprocessors listed on our subprocessors page), to comply with the law, or as part of a merger or acquisition with your data kept under the same commitments.
- People do not read it, except with your consent, for security purposes (such as investigating abuse), to comply with the law, or when the data is aggregated and anonymised for internal operations.
Who at Sevenfixes can see your data
Our staff can open your organization's pages in the app only to give you support with your consent, for security reasons, or when the law requires it. Every such view is recorded in an audit log.
AI mentions
If you use the AI mentions feature, we send the AI prompts and brand terms you enter to AI platforms through our data provider, DataForSEO, to see whether those platforms mention your site. We do not send your Search Console or Analytics data. Those platforms handle the queries under their own terms, which we do not control.
Security
- All traffic to Sevenfixes uses TLS.
- Access tokens and keys for your sources are encrypted at rest with authenticated encryption (Fernet: AES-128 + HMAC-SHA256). They are used only on our servers and never sent to your browser.
- When you disconnect a source, we delete its stored tokens. You can also revoke our Google access at any time at myaccount.google.com/permissions.
- Passwords are stored only as salted hashes. Staff accounts use two-factor authentication.
Cookies
We use only the cookies the service needs to work: a session cookie that keeps you signed in, and a CSRF cookie that protects forms. We use no analytics, advertising or third-party cookies, so there is no cookie banner.
Who processes data for us
We use a small number of providers for hosting, email and data. They are listed, with what each one does, on our subprocessors page. Our servers are in the EU. Where a provider processes data outside the EEA, we rely on an adequacy decision or the EU Standard Contractual Clauses.
How long we keep data
- Account and site data: while your account is open. When you delete a site, or ask us to delete your account, we delete its data from the live database.
- Source tokens: until you disconnect the source or delete your account.
- Backups: encrypted, and they expire on a rolling schedule, so deleted data leaves the backups after that period.
Your rights
Under the GDPR and similar laws you may ask to access, correct, export or delete your personal data, to restrict or object to its processing, and to withdraw consent. Write to [email protected]; we answer within one month. You may also complain to your local data protection authority.
Changes
If we change this policy in a way that matters, we will tell you by email before the change takes effect. The date at the top shows the latest version.