// LEGAL_DOCUMENT

Privacy Policy

Last updated: October 13, 2026

This Privacy Policy explains how CrawlBit (the "Service") collects, uses and protects your information. CrawlBit is an SEO and AI visibility audit tool. By using the Service you agree to this Policy.

1. Who we are (data controller)

The Service is operated by MindoLabs LLC ("we", "us"), a limited liability company registered in the State of Wyoming, United States. We are the controller of the personal data described here. For any privacy question or request, contact support@crawlbit.app.

2. Information we collect

Account information. When you create an account we store your email address and a securely hashed password. If you sign in with Google, we receive your name, email address and Google account identifier from Google.
Audit data. The website URLs you submit, the audit results we generate, your tracked sites and the historical score snapshots we keep to show your progress over time.
Billing information. Payments are processed by Stripe. We do not see or store your full card number. We store only your plan, subscription status and Stripe customer reference.
Search Console and Analytics data. If you connect a Google account to see Search Console or Google Analytics data next to an audit, Google gives us an access token and the email address of that Google account. We store the refresh token, encrypted, that email address, the permissions you granted, and the Analytics property you pick for each site. The reports themselves (clicks, impressions, search queries, pages, sessions, users and traffic sources) are fetched from Google when you open the dashboard, or when the assistant needs Search Console figures to answer you, shown only to you, and not stored.
Communications. If you enable email or Telegram digests, we store the destination needed to deliver them.
Marketing leads. If you ask us to email you a result or checklist from a free tool, we store the email address you provide and the fact that you opted in.
Technical data. Basic request information such as IP address, used for rate limiting and security.

3. How we use your information

To provide and operate the Service: run audits, track sites, generate reports and recommendations.
To authenticate you and keep your account secure.
To process subscriptions and billing.
If you connect them, to show your own Search Console and Analytics data next to your audit.
To send the monitoring digests, alerts and checklists you opt into.
To prevent abuse and protect the Service.

4. Legal bases (GDPR)

If you are in the European Economic Area or the UK, we rely on the following legal bases: performance of a contract to provide the Service to account holders; consent for marketing emails and any optional communications (you can withdraw it at any time); and our legitimate interests in keeping the Service secure and preventing abuse (for example, short-term use of IP addresses for rate limiting).

5. Third-party services

We share the minimum data needed with service providers (processors) that help us run CrawlBit:

Render hosts the application and stores its data on our behalf (United States).
Anthropic processes the publicly available page content we audit to generate AI analysis and recommendations, and, if you connected Search Console, the Search Console figures the assistant reads to answer your questions.
Anthropic, OpenAI, Perplexity and Google answer the questions used to measure citation. They receive the question and the domain being measured, and no account data.
Cloudflare provides DNS for our domain and routes incoming email to our support address.
Stripe processes payments.
Resend delivers transactional, digest and checklist emails.
Google provides optional sign-in (OAuth) and, if you connect it, read-only access to your Search Console and Analytics data.
Google Analytics counts visits to our public pages, and only if you accept it (United States).
Telegram delivers optional alerts if you connect it.

We do not sell or share your personal data, and we do not use it for cross-context behavioural advertising.

Data from Google APIs

CrawlBit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

Search Console and Analytics data is used only to show it to you in the dashboard and, for Search Console, to answer your questions in the assistant. It is never used for advertising, never sold, and never used to train AI models.
It goes to no one else, with two exceptions you trigger yourself. If you press Use your queries for the citation test and then Rewrite the set from these, the queries you send are processed by Anthropic to write your citation-test questions. And if you connected Search Console and ask the assistant a question that needs it, such as your Google traffic or your search queries, the assistant reads that site's Search Console figures (totals, top queries and top pages over the last 28 days), which Anthropic processes to write the answer. Analytics data is never sent to the assistant. Anthropic does not train its models on that data.
No one at CrawlBit reads it, unless you ask us to for support, or to investigate abuse or comply with the law.
Disconnecting Google in the dashboard, or deleting your account, deletes the stored token and asks Google to revoke our access. You can also revoke it yourself at any time from your Google Account permissions.

6. International data transfers

We operate from outside the European Economic Area, and our hosting and most of our providers are located in the United States. When you use the Service, your personal data is transferred to and processed in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. By using the Service you understand that your data will be processed in these locations.

7. Cookies and local storage

Two kinds of cookies are strictly necessary: a session cookie to keep you signed in, and short-lived cookies, kept ten minutes at most, that protect the Google sign-in and Google connection flows against cross-site request forgery and return you to the page you started from. None of them needs your consent, and we use no advertising or cross-site tracking cookies.

We also use Google Analytics to count visits to our public pages. It sets cookies in your browser, and it runs only if you accept it. A banner asks you when you first arrive; declining takes one click and is exactly as easy as accepting, and nothing is sent to Google until you accept. Signing in, running an audit and using the product work the same either way. Your answer to that banner is itself kept in your browser's local storage rather than in a cookie, so the answer never reaches us. Analytics never runs on a white-label report or on a report shared with a client. If your browser sends a Global Privacy Control signal, we treat it as a refusal: no banner is shown and Google Analytics never loads. A Do Not Track signal is honoured the same way. This matters for residents of California and other US states where that signal is binding, and it applies to everyone. To change your answer: .

Your browser also remembers the last website address you asked us to scan, so the scan bar and the free tools do not ask you to type it again. It is held in your browser only, carries no identifier, expires after 7 days, and disappears when you clear your browsing data. We receive an address only when you actually run a scan, never from this stored copy on its own. Like a shopping basket, it keeps something you typed in order to deliver what you asked for, which is why it needs no consent banner either.

8. Data retention

Account data is kept while your account is active and deleted when you delete your account.
Sessions expire after 30 days.
A Google connection is kept until you disconnect it or delete your account. Either one deletes the stored token and asks Google to revoke it.
Marketing leads are kept for at most 24 months, then automatically deleted, or sooner if you unsubscribe.
Shareable reports are rotated automatically; we keep only a limited number.
Technical/security data (such as IP addresses) is kept only briefly for rate limiting and abuse prevention.

9. Your rights

You can access and download your account data and delete your account at any time from Settings. You may also ask us to correct your data, object to or restrict certain processing, or withdraw consent for marketing (every marketing email has an unsubscribe link). To exercise any right, use the controls in Settings or email support@crawlbit.app.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. As our European user base grows we will designate a representative under Article 27 GDPR; until then, please reach us at the email above.

10. California privacy rights (CCPA/CPRA)

We are below the thresholds that make the CCPA mandatory, and we do not sell or share personal information. As a matter of good practice, California residents may still request access to or deletion of their personal information using the controls in Settings or by emailing us, and we will not discriminate against you for exercising these rights.

11. Security

Passwords are stored hashed, never in plain text. The Service is served over HTTPS. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your data.

12. Children

CrawlBit is a business tool not directed at children under 16, and we do not knowingly collect their data.

13. Changes to this Policy

We may update this Policy from time to time. We will revise the "Last updated" date above when we do.

14. Contact

Questions about this Policy? Email support@crawlbit.app. CrawlBit is a product of MindoLabs LLC.