Privacy policy

1. Controller

The controller responsible for data processing on this website and within the nanoSEO application is:
Web Nano - IT Solutions, Inh. Jozef Nano, Steinbach 8b, 84329 Wurmannsquick, Deutschland, E-Mail: info@web-nano.com. For further details, see Imprint.

2. Privacy at a glance

We value data minimisation. This site uses no advertising cookies, no external third-party fonts and, for audience measurement, exclusively a cookie-less, self-hosted statistics solution (see section 15). Within the app, only the data required for registration, billing and the website analyses you commission is processed.

3. Hosting & server log files

The provider of the pages automatically collects and stores information in server log files: browser type and version, operating system, referrer URL, host name, time of the server request, IP address (anonymized where applicable). The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in secure and stable operation).

4. Registration and user account

When you register, we store your name, email address and an encrypted password. This data is required to provide our contractual service (Art. 6 (1) lit. b GDPR). You can optionally enable two-factor authentication; the associated secret is stored encrypted.

In the first days after registration you will receive a few emails with guidance on setting up your account. You can opt out of these onboarding emails at any time via the unsubscribe link in each email (Art. 6(1)(f) GDPR).

5. Analysis of the websites you have added

If you add a domain for monitoring, nanoSEO retrieves its publicly accessible pages and transmits the HTML content found there to an AI analysis service for automated evaluation. This service is operated exclusively in European data centres and works in a GDPR-compliant manner (details of the provider used can be found in Section 12 "Recipients and processors"). Only content that is publicly visible on the pages you have specified is processed – no access credentials, no internal systems. The legal basis is the performance of the analysis assignment (Art. 6 (1) lit. b GDPR). You are responsible for adding only domains that you are authorized to monitor.

6. Payment processing

For paid plans and additional purchases, we use Stripe Payments Europe, Ltd. as a payment service provider. Payment data (e.g. card data) is processed directly by Stripe and does not reach our servers. The legal basis is the performance of the contract (Art. 6 (1) lit. b GDPR). For details, please refer to Stripe's privacy policy.

7. Cookies

We use technically necessary cookies and local storage functions for login sessions, CSRF protection and the stored language setting. We do not use our own tracking or marketing cookies. On sign-in and account pages, Google reCAPTCHA may use cookies or similar storage technologies; details about data processing are provided in section 8. The legal basis for technically necessary storage access is Section 25 (2) TDDDG; the processing of personal data is based on Art. 6 (1) lit. f GDPR.

8. Google reCAPTCHA

To protect our forms (e.g. login and registration) against automated misuse, we use Google reCAPTCHA (version 3) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Information such as IP address and user behaviour is transmitted to Google and evaluated there in order to distinguish automated access (bots) from human users. The legal basis is our legitimate interest in the security of our website (Art. 6 (1) lit. f GDPR). Further information can be found in Google's Privacy policy and the Terms of Service of Google.

9. Google Search Console (optional)

On request, you can connect your Google account to Google Search Console in the project settings. In doing so, you grant nanoSEO read-only permission (scope "webmasters.readonly") via Google's OAuth authorization process so that we can retrieve metrics such as search queries, impressions, clicks, click-through rate and position data for the property you have verified. We use this data solely to show you weekly pages with many impressions but below-average click-through rate as an optimization suggestion. We store the access and refresh tokens encrypted. The legal basis is your consent through the active connection process (Art. 6 (1) lit. a GDPR); you can disconnect at any time in the project settings, which deletes the stored tokens.

10. Free SEO check without registration

On our homepage you can enter a domain for a free SEO check without registering. For this purpose we collect the domain you provided, your email address and your IP address (to protect against misuse, see Section 8). We crawl and analyse the domain in the same way as described in Section 5, but limited to up to 10 pages and separate from any existing customer projects for the same domain. We use your email address solely to send you the result and offer you a user account; we do not use it for advertising purposes. The legal basis is your legitimate interest in the requested analysis as well as our legitimate interest in being able to deliver the result to you and protect the service against misuse (Art. 6 (1) lit. f GDPR). We delete data relating to free checks at the latest 90 days after the request (see Section 13 "Storage duration").

11. Contact enquiries

If you send us an email, your details are stored for the purpose of processing the enquiry. We do not pass on this data without your consent.

12. Recipients and processors

To provide our service, we use the following service providers, with each of which data processing agreements pursuant to Art. 28 GDPR exist or appropriate safeguards are in place:

• Hetzner Online GmbH and netcup GmbH – server hosting (Germany)
• OVHcloud – AI analysis via AI Endpoints (EU location)
• Google Ireland Limited – Google reCAPTCHA to protect against automated misuse as well as, when a connection is active, Google Search Console for the metrics described in Section 9
• Stripe Payments Europe, Ltd. – payment processing

13. Storage duration

We store personal data only for as long as is necessary for the stated purposes or as required by statutory retention periods (e.g. commercial and tax law). After deletion of your account, data that is no longer required is deleted or anonymized. Requests for the free SEO check (Section 10), including the email address provided, are automatically deleted at the latest 90 days after the request.

14. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection to the processing of your personal data. To do so, please contact the contact address stated above. You also have the right to lodge a complaint with a data protection supervisory authority.

15. Audience statistics and marketing attribution

To measure audience reach we use the self-hosted open-source software Umami. Umami works without cookies, does not store full IP addresses and does not create cross-site user profiles; the statistics data remains on servers operated by us. The legal basis is our legitimate interest in a privacy-friendly analysis of how our website is used (Art. 6(1)(f) GDPR).

On your first visit to our website we store, for the duration of your session, the source through which you found us (marketing parameters of the requested address, so-called UTM parameters, the referring website and the landing page). If you then register an account, we link this information to your team account so we can evaluate through which channels customers become aware of nanoSEO. No IP addresses are stored in this process. The legal basis is our legitimate interest in measuring the success of our marketing activities (Art. 6(1)(f) GDPR). Without a registration, this information is deleted at the latest when your session ends.

16. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our services change. The current version is available on this page.