Privacy Policy

This policy describes what happens to your data when you visit deeploupe.com or use the analysis tool. It was not produced by a generator but written from the source code: every service named below is genuinely called, and an automated test prevents this list from quietly going out of date.

If anything here is unclear, or if you believe a statement is wrong, write to us — the address is at the end.

Controller

The controller within the meaning of Art. 4(7) GDPR is Speakz Media GmbH, as named in the legal notice. We have not appointed a data protection officer; we are not required to do so under § 38 BDSG.

If you only browse the site

Merely opening a page causes your browser to transmit technically necessary data to our hosting provider: your IP address, date and time, the address requested, the previously visited page, and details about your browser and operating system. A website cannot be delivered without this.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the technical operation and security of the service.

If you analyse a website

The analysis tools (quick scan, citation check, GPTBot check) primarily process data about a third-party website, not about you. What is processed about you is:

• The address you enter. It is stored so that a repeat request is faster and so we can show the result again.
• A hash of your IP address, used to cap the number of free analyses per day. The IP address itself is not stored. The hash is computed as HMAC-SHA256 with a server-side secret that resides solely in our operating environment and is never stored alongside the hashes. It is therefore pseudonymised, not anonymous; without that secret it is practically infeasible to recover the original address.

Results that become publicly visible

Some per-domain results are published as publicly accessible pages (e.g. under /check/…) and may be indexed by search engines. What is shown concerns the website analysed, not the person who requested the analysis: whoever starts a check is not named there and cannot be inferred from the page.

If you operate a domain shown there and would rather it were not, an informal message to us is enough; we will take it down.

If you create an account

An account requires an email address and a password. We store the password only as a cryptographic hash, never in plain text. Alternatively you can sign in with a Google account; Google then provides us with your email address and basic profile data, and Google learns that you are signing in with us.

If you create an account, we additionally store how you came to us: the campaign parameters of the link (utm_source, utm_medium, utm_campaign, utm_content), the referring page, the page you entered on, and the time of that first touch. We record this exactly once, when the account is created; a later visit through a different channel does not change it.

The legal basis for your email address and password is Art. 6(1)(b) GDPR, because the processing is necessary to perform the contract. For the origin data it is Art. 6(1)(f) GDPR; our legitimate interest is understanding which channels work. We use it for nothing else and delete it together with the account.

If you buy something

Payments are handled by Stripe. You enter your payment details directly there — we neither see nor store card numbers or billing addresses. What stays with us is your Stripe customer reference, the product purchased and the details we need for accounting and invoicing.

The legal basis is Art. 6(1)(b) GDPR and, for retaining accounting records, additionally Art. 6(1)(c) GDPR together with German commercial and tax retention periods (§ 147 AO, § 257 HGB — six and ten years respectively).

If you cancel

The cancellation button lets you cancel without signing in. We store what you enter — the type of cancellation, a reason where applicable, the name of the contract, your name, your e-mail address, an optional customer or invoice number and the date you want it to end — together with the wording of your declaration and the time we received it. We also keep a hashed short form of your IP address to prevent abuse of the form; the address itself is not stored.

The legal basis is Art. 6(1)(b) GDPR for ending the contract and Art. 6(1)(c) GDPR for the duties under § 312k of the German Civil Code — we must confirm receipt of your cancellation and be able to show what reached us and when.

We keep this record for three years (the standard limitation period under § 195 BGB) and delete it afterwards. Accounting and invoicing records for the cancelled contract are unaffected and remain subject to tax retention periods.

Audience measurement

We measure which pages are viewed and where users abandon the flow, in order to improve the service. We use PostHog for this. Requests go to our own domain and are forwarded from there to PostHog. Session recording and autocapture of individual clicks are switched off.

Without your consent we count without cookies: PostHog then stores nothing in your browser. On its server, PostHog forms a hash from the day’s random salt, your IP address, the domain visited and the browser identifier, which groups the views of one day. The salt is deleted when the day ends; after that the hash can no longer be traced back to IP address and browser, and a new one arises the next day. As long as you are not signed in, we recognise you within one day at most. When you sign in and in the signed-in area, your account identifier goes to PostHog even without consent (see “Who receives your data”); we attribute those views to your account, on later days too. When you sign in or open the signed-in area, we also attribute your views from earlier that same day to your account. The legal basis is our legitimate interest in understanding where our flow breaks down (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR), informally at the address at the end.

On your first visit, a banner asks whether PostHog may recognise your browser. If you accept, PostHog places cookies and entries in your browser’s local storage, such as ph_…_posthog with your random identifier and __ph_opt_in_out_… with your consent, plus session data in session storage, which the browser deletes when you close the tab. The cookies expire after one year, the entries in local storage do not expire on their own. We can then recognise your browser on later days too, without you being signed in, and after you sign in we also attribute visits from this browser on earlier days to your account. The legal basis is then your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We store your decision itself in local storage so the banner does not reappear on every page; this is strictly necessary for asking (§ 25(2) no. 2 TDDDG).

You can change or withdraw your choice at any time: the “Privacy settings” link at the bottom of the pages opens the banner again. If you decline or withdraw, we remove PostHog’s entries from cookies, local storage and session storage, and cookieless counting applies again.

On a few pages that people visit only once, we do not ask and always count without cookies: the confirmation page after a link from our email, the cancellation flow and the page about a letter from us.

Who receives your data

We share data only as far as operating the service requires. This list is complete — it is bound to the source code and is necessarily updated whenever a new service is added.

Where providers act as processors on our behalf, the agreements required by Art. 28 GDPR are in place.

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA

  Third country

  Purpose

  Hosting, content delivery and execution of the server functions.

  Data

  IP address, date and time of the request, requested URL, referrer, browser and device identification (server logs). When you use the analysis features, additionally the domain you entered.

  Location

  Page content is delivered from Frankfurt am Main; the server functions currently run in Washington, D.C., USA.

• PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA

  Third country

  Purpose

  Product analytics: which pages are viewed and which steps of the flow are reached, in order to improve the service.

  Data

  Your IP address and browser identifier, from which PostHog forms a hash valid for the current day only when you have not consented (cookieless counting, see “Audience measurement”); after your consent, your random identifier stored in your browser instead. Plus pages viewed, timestamps, for the analysis steps the domain you entered, and where the visit came from (campaign parameters of the entry address such as utm_source, the referring page without its query string, and the entry page). Once you are signed in, your account identifier is added — a random string, not your email address — so that the steps of a flow belong together; also the fact that a sign-up or sign-in happened and by which route (email or Google). Session recording and autocapture are switched off.

  Location

  USA.

• Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA

  Purpose

  Error monitoring: if an error occurs in your browser or on our server, it is transmitted so that we can fix it.

  Data

  Only when an error occurs, not on every request: the error message and technical stack trace, browser and operating system version, and the requested address without the part after the question mark — the scanned domain and any tokens are stripped before the report leaves our systems. Once you are signed in, your account identifier is added (a random string, not your email address) so that a complaint can be matched to the incident. Your IP address is not stored. There is no session recording, and nothing is stored on your device.

  Location

  European Union (data region “European Union”, endpoint ingest.de.sentry.io).

• Supabase, Inc., 970 Toa Payoh North #07-04, Singapur 318992

  Purpose

  Database and user accounts (sign-up, sign-in, session management).

  Data

  Email address, password hash, sign-in timestamps, account data and all content stored in the database (see “What we store”).

  Location

  Frankfurt am Main, Germany (region eu-central-1).

• Fly.io, Inc., 2261 Market Street #4990, San Francisco, CA 94114, USA

  Purpose

  Operation of the analysis server that actually loads and renders the website under test.

  Data

  Only the address to be analysed. No account data, no IP address and no session data are transmitted.

  Location

  Frankfurt am Main, Germany (region fra).

• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Irland

  Third country

  Purpose

  Processing of payments and subscriptions.

  Data

  Email address, your user ID, the purchased product, the scanned domain and, where known, where your visit came from (campaign parameters, referring page, entry page). Payment details (card and billing data) are entered directly with Stripe — we neither see nor store them.

  Location

  Ireland; Stripe also transfers data to the USA (Stripe, Inc.).

• Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA

  Third country

  Purpose

  Sending of notification and system emails (e.g. monitoring alerts).

  Data

  Recipient address, subject and content of the respective message.

  Location

  USA.

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland

  Third country

  Purpose

  Sign-in with a Google account — only if you actively choose this option.

  Data

  Google shares your email address and basic profile data with us. In doing so, Google learns that you are signing in to DeepLoupe.

  Location

  Ireland; Google also transfers data to the USA.

• Google Ireland Limited (Gemini), OpenAI Ireland Ltd., Anthropic PBC (USA), Perplexity AI, Inc. (USA)

  Third country

  Purpose

  Core of the analysis: we put a market question to these answer engines and record which providers they name — that is what shows whether a website gets cited.

  Data

  Only a generically phrased market question (e.g. “best bike shop in Berlin”). Neither your IP address nor your account data nor your session are transmitted. To determine the relevant industry, the publicly available page title and meta description of the analysed website are additionally transmitted.

  Location

  Ireland and USA.

• Google Ireland Limited (PageSpeed Insights), Gordon House, Barrow Street, Dublin 4, Irland

  Third country

  Purpose

  Measurement of the load performance of the analysed website.

  Data

  Only the address to be analysed.

  Location

  Ireland; transfer to the USA possible.

• DataForSeo LLC, 1209 Mountain Road Pl NE, Albuquerque, NM 87110, USA

  Third country

  Purpose

  Retrieval of public search engine results for the visibility analysis.

  Data

  Only the search term queried and the target search region.

  Location

  USA.

What is stored in your browser

Some of it is technically necessary — without those entries you could not sign in. The rest serves audience measurement and is dispensable.

• Authentication cookies (sb-…)

  technically necessary

  Keep you signed in and protect the session. Only set once you create an account or sign in.

• Appearance setting (theme)

  technically necessary

  Remembers whether you chose the light or dark appearance.

• Your choice in the privacy banner

  technically necessary

  Remembers whether you accepted or declined recognition, so the banner does not reappear on every page. Kept in local storage until you clear your browser storage; a new choice overwrites the value.

• Audience measurement (such as ph_…_posthog)

  not necessary

  Only after you accept in the banner: cookies and entries in local storage (your random PostHog identifier and your consent), plus session data in session storage, so that we recognise your browser on later days too. The cookies expire after one year, the local storage entries do not expire on their own, and the browser deletes session storage with the tab; withdrawing consent removes them again.

Transfers to third countries

Some of the providers listed above are based in the USA or transfer data there. For those transfers we rely on the European Commission’s standard contractual clauses and, where the providers are certified, on the EU-US Data Privacy Framework.

You should know what that means in practice: in the USA, authorities may under certain conditions access data without your having a remedy equivalent to the European one. That is a residual risk which contractual measures cannot fully eliminate.

Where we can avoid it, we do: our database and analysis server are located in Frankfurt am Main. Our server functions currently still run in the USA; we are working on moving those to Frankfurt as well.

How long we store data

Account data is stored for as long as your account exists. If you delete it, we remove the associated data unless a statutory retention obligation applies; accounting and invoicing records must be kept for six and ten years respectively.

For the technical caches we now delete automatically: the usage-limit counters after 30 days and the cached analysis results of third-party domains after two days. Some further history (such as the log of ongoing website monitors) is not yet removed automatically; it is no longer used once it expires, and we are rolling out automatic deletion step by step. Your right to erasure under Art. 17 GDPR applies at all times: ask us and we delete.

Your rights

You have the following rights against us:

• Access to the data we process about you (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Portability of your data in a transferable format (Art. 20 GDPR).
• Objection to processing based on a legitimate interest (Art. 21 GDPR).
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR).

Complaints

You may lodge a complaint with a data protection supervisory authority at any time without contacting us first. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

Changes

We update this policy when our processing changes. The date below shows the current version. We notify registered users of material changes by email as well.