Who we are
DeepSpider.ai is a cloud-based technical SEO audit service. For questions about this policy or the personal information processed through the service, contact us at support@deepspider.ai.
The controller of your personal data is Netzforscher OÜ (registry code 17625017), Väike-Kuke tn 8b-1, 80018 Pärnu, Pärnu County, Estonia.
This policy covers the public site at deepspider.ai and the audit application at app.deepspider.ai. When you ask DeepSpider to audit a third-party website, that site's own privacy practices remain the responsibility of its operator.
What we collect
Account and sign-in information
When you create an account or sign in, the authentication provider handles your sign-in. We receive and use account identifiers and basic profile details such as your email address and, if provided, your name and profile image. We use this information to identify your account, provide access and connect your saved audits to you. If you choose a country or region when you create your account, or later in the welcome questions, we store it with your account and use it for regional defaults, such as showing Japanese-language SEO news in the Daily Brief (you can change these defaults in Settings), and to show our team, in its internal customer overview, which country you chose. If you have not chosen one, that overview may instead show the approximate country of your most recent sign-in, as our sign-in provider Clerk estimates it from the network address of that session, marked as an estimate. We store only that country, not the address, refresh it at most once a week while it is shown, and delete it once you choose a country, when it has not been refreshed for 90 days, or when the account is deleted. If you save billing details in Settings (such as company name, VAT number, country and address), we store them with your account and use them to fill in the Paddle payment form; the billing country is also shown in that internal customer overview. To suggest that country on the sign-up form or in the welcome questions, DeepSpider looks up the country of your IP address on its own servers, using the DB-IP Lite database (IP Geolocation by DB-IP, licensed under CC BY 4.0), or your browser's time zone when the address gives no country. The address is used only for this lookup and is not stored for it. Do not send your password or one-time sign-in code to DeepSpider support.
After your first payment or promo code activation, DeepSpider may ask a few optional welcome questions: your company name, what kind of work you do and how you found DeepSpider, and, if you did not choose one when you created your account, your country or region. Answering is optional and you can skip them. We store the answers with your account and use them only to improve the service and our marketing; a country you choose there is used as described above. If you reach the sign-up page through a link that carries campaign parameters (such as utm_source or utm_campaign in an email or advertisement), we store those parameters, the deepspider.ai page you came from and the name of another referring website with your account. We use them only to understand which campaigns bring new customers. No cookie is set for this.
Since 6 November 2026, when you create an account from a sign-up link on deepspider.ai, the link also carries the random identifier of that browser tab that our audience counter uses to put a visit in order (see Visiting deepspider.ai). DeepSpider then copies that tab’s visit from the 24 hours before your account was created to your account: the deepspider.ai pages you viewed in it, in order and with their times, how long each was visible and how far it was scrolled, the sign-up, pricing and home page clicks recorded with it, the free tools used that day, where the visit came from (its source category, campaign parameters and the referring website’s domain), and its device type, browser family and approximate country. Only DeepSpider’s administrator sees it, to understand how people find and choose DeepSpider. It is kept with your account and deleted with it. Visits in other browser tabs or on other days are not linked to your account, and nothing is copied when the counter does not run (Do Not Track or Global Privacy Control).
When you open the payment form, DeepSpider records with your account the time, the payment transaction identifier from Paddle and the plan, billing period and currency you chose. We use this to avoid charging you twice while a payment is still being processed and to understand how many people open the payment form without completing it. These records are kept for 400 days (about 13 months) and are deleted earlier when you delete your account.
Website audit information
When you start an audit, we process the domain and settings you submit and the publicly accessible URLs, HTML, images, response details, links, metadata and other evidence collected during the crawl. The service stores audit results, history and operational checkpoints so you can review and compare them. Public pages can themselves contain personal information; avoid submitting a site unless you are authorized to have it audited.
Shared check links
If you choose Share on a check of a saved audit, DeepSpider stores a read-only copy of that check’s rows (the affected URLs, their HTTP status and the audit evidence shown for them) and gives you a link that anyone who has it can open without signing in. The copy does not change when you run a new audit. It shows the website, the check and the audit date, never your email address or other audits. Only a one-way hash of the link is stored; the shared page asks search engines not to index it and sends no referrer. The copy is deleted when the link expires (after 7 or 30 days, as you choose), when you revoke it, or when you delete the audit, the website or your account. Share only what you are entitled to share with the recipient.
Support, usage and technical information
If you contact us, we process your message, contact details and related correspondence to respond. We also process technical information needed to operate and protect the service, such as request times, IP addresses, browser or device information, service errors and audit progress. The site and app may use necessary browser storage or authentication cookies to keep sessions and preferences working.
To recognise duplicate or abusive sign-ups, DeepSpider keeps for each account a one-way keyed hash of the IP address and of its network range (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address) used when the account was created, or, for accounts created before this check was introduced on 22 October 2026, from the account's most recent session at our sign-in provider. The address itself is not stored. People at DeepSpider see only whether accounts share an address or network, never the address. These hashes are deleted after 90 days or when the account is deleted.
When you use the app while signed in, DeepSpider records which views you open (such as Overview, Issues or a specific check of one of your audits), which Settings pages you open, and actions such as starting or stopping an audit, exporting results or creating a share link, each with its time. On the plan selection page it also records the plan, billing period and currency you pick, which of its links and buttons you click, whether the payment form opened, and how long the page was open. When you open the daily SEO brief, it records that too, and for each article you open from it, the news website the article comes from (not the article or its address). It also records when you are active in the app: the start and end time of each visit, taken from your clicks and key presses (never what you click on or type), and the view you come back to after being away for a while. We use these records to understand how the service is used, to improve it and to help you when you contact us. We do not record what you type, mouse movements, screenshots or the contents of pages. These records are kept for 90 days and are deleted earlier when you delete your account.
Google sign-in
Google sign-in is used for authentication. DeepSpider requests basic identity information needed to create or access your account, such as your Google email address, name and profile image where available. Google sign-in does not give DeepSpider access to your Gmail messages, Google Drive files or other Google content. Access to Google Search Console is requested separately, only if you choose to connect it (see below).
Google supplies this sign-in information to our authentication provider, Clerk, which uses it to verify your identity and maintain your account. DeepSpider uses the resulting account information to provide the audit service. We do not sell Google user data, use it for advertising, or use it to train AI models. You can disconnect DeepSpider from your Google Account in Google's third-party connection settings; you can also ask us about deleting the linked DeepSpider account data.
Google Search Console (optional)
You can choose to connect Google Search Console in the DeepSpider app. Google then asks you to give DeepSpider read-only access to your Search Console data (the https://www.googleapis.com/auth/webmasters.readonly permission) and to see the email address of the Google account you connect, so DeepSpider can show which account each website uses. You can connect several Google accounts, for example the accounts of different clients. You can use DeepSpider without connecting it, for example by uploading Search Console export files instead.
What DeepSpider reads
- Search performance: clicks, impressions and average position per page, and per search query with its page, for the last 90 days, and clicks and impressions per day for the property, shown on a chart next to the dates of Google ranking updates. The update dates come from Google’s public Search Status Dashboard; no account data is sent to Google to read them.
- URL Inspection results: Google's index status, the canonical URL Google selected and Google's last crawl details for pages found in your own DeepSpider audits.
DeepSpider reads only Search Console properties that your connected Google accounts can access and that cover a website you have saved in your DeepSpider account. Each saved website is linked automatically to such a property. DeepSpider does not change anything in Search Console.
How the data is used
The data is used only to show you reports in your own account that compare Google's data with your audits of the same website, such as pages with search traffic that the audit did not find or audited pages Google has not indexed. It is not shown to other accounts. It is not sold, not transferred to others except the service providers needed to run DeepSpider, not used for advertising and not used to train AI models. People at DeepSpider do not read it unless you ask us to for support, it is needed to investigate security or abuse, or the law requires it.
Storage and deletion
The access granted by Google is stored encrypted and is used only to fetch this data. The email address of each connected Google account is stored with it and shown only in your account. The data is kept with the website in your account until you remove the Google account, delete the website or delete your account. Removing a Google account on the Search Console page revokes DeepSpider's access for that account at Google (unless the same Google account is also connected to another DeepSpider account) and deletes the Search Console data that came from it, except for websites another of your connected accounts can open. You can also remove access in your Google Account's third-party connection settings or ask us to delete the data.
DeepSpider.ai's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Server access logs (Bot activity)
The Bot activity feature shows how search engine and AI crawlers visit your website, based on your own server access logs.
- Uploaded logs are read in your browser. Only requests from search and AI crawlers are counted, and only a summary without IP addresses or visitor requests is sent to DeepSpider.
- Automatic delivery: if you set it up, your hosting provider, CDN or log shipper sends log lines to the private delivery address of your website. DeepSpider processes them in memory, uses IP addresses only to check whether a request really came from the crawler it claims to be, and stores only daily crawler summaries (counts per crawler, day, URL path and response status). Visitor requests and IP addresses are not stored.
Crawler summaries are kept for 90 days and are deleted earlier when you remove them or delete the website. Only send logs you are entitled to share with us.
Audit result emails (optional)
You can choose to receive emails when your audits finish, finish with some pages not checked, need your action or fail. This is off by default and only you can turn it on, in Settings. You can choose which of these emails you receive, receive only audits longer than a chosen time, or receive one daily summary instead of separate emails.
The emails are sent to your account's email address through Resend, our email delivery provider. An email contains the audited website's address, the audit outcome and summary figures such as the Health Score, pages checked, errors, warnings and duration. Every email has a link that turns these emails off at once. DeepSpider keeps a record of which audit emails were sent so that none is sent twice; it is deleted with the audit or your account.
Getting-started emails (optional)
If you created an account and have not chosen a plan, DeepSpider may send you up to two emails about getting started: one asking whether everything worked and how we can help, and one that can offer a personal code for a few free days of a plan. Each email is reviewed and sent by a person at DeepSpider, one at a time; none is sent automatically.
The emails go to your account's email address in one of two ways: through Resend, our email delivery provider, from support@deepspider.ai, or sent by that person from their own email account (for example Gmail, provided by Google). Replies come to the address the email came from. A free days code works only for your account; the days start when you activate it, and no payment details are needed. Every email has a link that stops these emails at once, and we keep that choice with your account.
We keep a record of which of these emails was sent to your account, when, its subject and text, and any code it contained, so that we do not send the same email twice by mistake. The record and your choice are deleted with your account.
Team members (Agency plan)
On the Agency plan, the account owner can invite colleagues to work in the account. To send an invitation, the owner gives us the colleague's email address. We store it with the owner's account, together with when the invitation was sent, when it expires and whether it was used, and send the colleague an invitation email through Resend. The invitation link works once, for 7 days, and only for that email address; we store only a fingerprint (hash) of its secret part, not the link itself.
A colleague who joins signs in with their own login. While they are a member, they can see and work with the account's websites, saved audits and connected data, such as Google Search Console data and server access log summaries, within the account's plan. The account owner sees each member's email address, when they joined and how many audits they started. An audit a member starts shows their email address in the account's audit history and stays in the account after the member leaves. Audit result emails for an audit a member started go to that member, under the member's own email settings. Billing, plans, promo codes, account backups and the team are managed only by the owner. A member's own settings, notifications and support messages stay with their own login. Our team's internal customer overview shows which account a member works in.
The owner can remove a member, and a member can leave, at any time; access to the account ends at once and the other side is told in DeepSpider. A membership is deleted when either account is deleted. Invitation records stay with the owner's account until that account is deleted.
Free tools and bot protection
DeepSpider's free tools, such as the Indexability, Sitemap, Breadcrumb and AI Readiness checkers, can be used without an account. When you run a check, DeepSpider requests the public address you enter, and pages of that website, from its own servers, and shows you the result.
- Limits against misuse: to limit how often one visitor can run checks, DeepSpider stores a one-way hash of your IP address with a counter, which expires within a day. The address you check is not stored with it.
- Usage statistics: DeepSpider counts how often each tool is used and whether the check succeeded, with a one-way hashed visitor identifier and your country. The address you check is not included.
- Short-term reuse: a result can be kept in the server's memory for up to 30 minutes, so the same check is not repeated and so you can share it.
- Share links (AI Readiness Checker): only if you choose Create share link, the report is stored for 30 days and can be opened by anyone with the link. Shared reports are not listed and search engines are asked not to index them. Ask us to delete a shared report earlier.
Cloudflare Turnstile
To keep automated scripts from misusing the free tools, they can be protected by Cloudflare Turnstile. When it is on, Cloudflare checks signals from your browser and device, such as your IP address and browser characteristics, to tell people from bots. Most visitors see no challenge. DeepSpider receives only whether the check passed and sends Cloudflare your IP address to confirm the result. Cloudflare processes this information under its Turnstile privacy addendum and privacy policy. The basis is our legitimate interest in protecting the service from misuse.
How and why we use data
- To provide the service: authenticate users, run requested audits, save results and support account features. The basis is performance of the service requested by the account holder.
- To respond and maintain reliability: answer support requests, diagnose failures, prevent misuse and secure accounts and infrastructure. Depending on the activity, the basis is the service relationship or our legitimate interest in running a safe, reliable service.
- To meet applicable obligations: retain or disclose information where a law requires it. The basis is the relevant legal obligation.
Audit evidence is used for the requesting user's report and related service operations, not to build a public search index or train an AI model.
Visiting deepspider.ai
When you visit deepspider.ai, our hosting and security providers process technical request information such as IP address, browser and device details, requested pages, times and response status, to deliver the site and protect it.
Our built-in audience counter records page visits, the traffic source category, the campaign parameters of the link you followed (utm_source, utm_medium and utm_campaign), the domain of a referring website, clicks on sign-up buttons, how long each page was visible and how far it was scrolled, the hour of the visit (kept for 90 days), the device type (desktop, mobile or tablet), the operating system family (such as Android or Windows) and the browser family (such as Chrome, Safari or an app's built-in browser), all read from your browser's user agent, which is not stored, the width class of your screen (for example 1,366–1,919 pixels; the exact size is not kept), whether your device is set to a light or dark display theme (the site shows the theme you use), clicks on the sun/moon button and the theme chosen there (the choice itself stays only in your browser's local storage on deepspider.ai), free-tool use, and, when a page is not found, the missing address with the deepspider.ai page whose link led there (or the referring website's domain). On the pricing page it also records the time of the visit, the deepspider.ai page visited just before it (the page address only, without query parameters), how it was reached (the header’s Get started button or Pricing link, the footer, a link inside a page, as the first page of the visit or another way; the clicked link’s place is kept only in that browser tab’s sessionStorage until the next page), which currency the prices were first shown in and whether it came from your time zone, your earlier choice or a link (the time zone itself is not sent), which billing period, currency and “See full comparison” buttons were used, and which plan button was chosen together with the billing period and currency shown at that moment. On the sample audit page it records, with the time, that the page was opened, whether the pricing box at its end came into view and whether a link in that box, or the pricing link shown just above it on phones, was clicked. To show the order of a visit, each page view also carries a random identifier of the browser tab and the page’s number in that tab (both kept in the tab’s sessionStorage, not a cookie, and gone when the tab is closed), with the deepspider.ai page visited just before it, the time spent on the page and how far it was scrolled. On the home page it also records which of its sections came into view and which of its links, buttons and FAQ questions were used, named by their place and their own wording on the page. When a test of the home page's top section is running, each browser tab is shown one of its versions (texts and image) at random (the choice is kept in the tab's sessionStorage) and the version shown is recorded with the visit, to compare what visitors did next. If your browser or the Google Translate website machine-translates a deepspider.ai page, the counter records that the page was translated, the language it was translated into and whether the browser or the Google Translate website did it, together with that day's visit (like its country); none of the page's text is sent. Each recorded page view, free tool check, sign-up click and reading report is also kept with its exact time for 48 hours, so the last hour can be compared with the hour before; after that only the daily records described here remain. These visit details are kept for 90 days. It sets no analytics cookies. A per-tab sessionStorage value keeps the source, campaign and referring domain while you move between pages, and passes the campaign to the sign-up page. Full referrer URLs are not stored. IP addresses are used to estimate daily unique visitors and country, then discarded; the country is looked up on DeepSpider’s own server in the DB-IP Lite country database (IP Geolocation by DB-IP), and the address is not sent to any third party. Visits from data-centre networks, such as cloud servers, hosting companies and advertising scanners, are recognised from the IP address with the DB-IP Lite ASN database (IP Geolocation by DB-IP, CC BY 4.0) and left out of the statistics as automated. Visit records are kept for 400 days (about 13 months) to compare periods. The daily keys that let a visit be matched to an IP address are deleted after 90 days, after which those records can no longer be linked to an address. To count how many different visitors came during a month, a second key that changes every calendar month is stored with each visit; its secret is deleted when the month ends, after which these keys can no longer be linked to an address either. To show how many people were on the site in the last 30 minutes and the last 1, 2, 3, 6, 12 and 24 hours, the latest page, traffic source and time of each daily visitor estimate are kept for at most 24 hours. The counter does not run when your browser sends Do Not Track or Global Privacy Control.
When you open a promo code page (app.deepspider.ai/c/ followed by a code, or deepspider.ai/ followed by a code that has a short link; usually from the QR code on a business card or flyer), DeepSpider counts that a person opened that code that day, to see how many people who received a code looked at it. It stores the code, the day, the time of the first visit that day, whether you were signed in, and a one-way key made from your IP address with a random secret of that day, so that one person is counted once a day. Since 4 November 2026 it also stores, to see where the people who opened a code came from: your approximate country and city, looked up from your IP address on DeepSpider’s own server in the DB-IP Lite country and city databases (IP Geolocation by DB-IP); how you reached the page (a scanned QR code, whose link carries a mark for this, a short link, a code typed in, or another link); where the click came from (a campaign name in the link, or the name of the website or app that sent you, never the full address of that page); the type of device, operating system and browser family, read from your browser’s user agent, which is not stored; and the language your browser asks for first. The IP address itself is not stored, and each day’s secret is deleted after two days, after which the key can no longer be linked to an address. Visits from data-centre networks and tool browsers, and DeepSpider administrators, are not counted. For a short link, the deepspider.ai page that is not found asks DeepSpider whether its address is a promo code before it opens the code page, and passes on only the name of the website that sent you there; the address of that page is not stored for this. If you activate the code on the same day from the same network, that day’s record is linked to your free access, so the administrator can see where the visit that led to your account came from; the link is removed when the free access or the account is deleted. These records are kept for 400 days. If you create an account through the sign-up link on that page, the page’s address is stored as where the account came from. When you activate a promo code, DeepSpider’s administrator receives an email with your account email address, the code and when it was activated and the account created.
If you use the contact form, we store your message and contact details so that DeepSpider administrators can answer you.
When you send a question, problem report or feedback from inside the app, DeepSpider stores your message with the page you were on, any error shown on the screen, a screenshot if you choose to add one, and, since 4 November 2026, the name and version of your browser, your operating system and the type of device, read from your browser’s user agent (the user agent itself is not stored), so that DeepSpider administrators can understand the problem and answer you. These messages are deleted when you delete your account.
Retention and security
We keep account data and saved audits while they are needed to provide the account and its selected features, until they are deleted or the applicable retention period ends. Search Console data is kept until you disconnect or delete the website, and crawler summaries from access logs for 90 days. Temporary checkpoints, service logs and support records are kept only as long as needed for operations, security, troubleshooting or applicable legal requirements. Backup copies may remain for a limited restoration period after deletion. The precise period can depend on the account plan, the kind of record and any legal obligation.
We use access controls and other reasonable technical measures to protect data. No online service can promise absolute security. If you believe your account has been compromised, contact us promptly.
Your choices and rights
You can ask to access, correct, export or delete personal information connected to your account. Where applicable, you may also object to or request restriction of processing, request portability and complain to your data protection authority. We may need to verify that a request concerns your own account, and legal or security obligations can affect what can be deleted immediately.
Send requests to support@deepspider.ai. You may also manage Google's connections to DeepSpider from your Google Account. Removing Google sign-in there does not automatically remove audits already stored in DeepSpider; to delete Search Console data, use Disconnect on the Search Console page or ask us.
Changes and contact
We may update this policy as the service changes. The effective date at the top identifies the current version; significant changes will be communicated through the service or another appropriate channel. For privacy questions, email support@deepspider.ai.
See also our Terms of Service and Refund Policy.