Privacy Policy
Last updated: October 14, 2026
Convenience translation. This page is an English translation of the Turkish original, Gizlilik Politikası, provided for convenience only. The Turkish version is the binding text and prevails in the event of any discrepancy between the two versions.
Seolin (seolin.io) is an SEO audit tool that measures your website's search engine performance. This policy explains what data we collect when you use the service, why we collect it, who we share it with, and how you can have it deleted. The short answer: we collect only the data needed to provide the service, we sell none of it, and we do not use it for advertising.
1. Data controller
The Seolin service is provided by ELLISEKIZ LLC, which is the data controller of your personal data (address: 30 North Gould Street, Suite 100, Sheridan, WY 82801, United States). You can write to [email protected] with any question about this policy or your data. For users in Türkiye, the information under KVKK (Türkiye's Personal Data Protection Law No. 6698) is also set out separately in the KVKK Privacy Notice.
2. Data we collect
a) Your Google account information
When you sign in to the service with Google, we request only the openid, email and profile scopes from Google. Of the account information Google returns for these scopes, we use only three items: your email address, whether that address has been verified by Google (no account can be created with an unverified address), and your name. Of these, we store your email address and your name. We do not use or store the other fields included in the profile scope (e.g., the profile photo link). We do not request scopes that give access to your contacts, calendar, Gmail or Drive content.
When you connect Search Console or Analytics, we also request the openid and email scopes in addition to the scopes below: we store the email address of the Google account you connect and the list of scopes you granted, in order to identify the connection. We do not use your name in this flow.
b) Google Search Console data
If you choose to connect your Search Console account, we request the https://www.googleapis.com/auth/webmasters.readonly scope. As its name says, this scope is read-only: we cannot change, add or delete anything in your Search Console account. We use this access for three things:
- Ownership verification. We read the list of properties you can access to confirm that the site you want to audit really is yours. A verified site qualifies for a deeper crawl (more pages); this limit exists so that we do not crawl a third party's site under heavy load.
- Search performance reports. Only for the sites you have matched, we read and store daily impressions, clicks, click-through rate and average position data, broken down by query, page, query–page pair, device and country, and we combine it with audit findings. For example, recommendations such as “this page ranks 6th and gets many impressions, but its title doesn't contain the query it is searched for most” come from this combination.
- Page index status (URL Inspection). On the site you have matched, for pages that an existing recommendation is about, we read and store the page's status in Google's index from Search Console's URL Inspection tool: whether it is indexed, its coverage and crawl status, its robots.txt status, the canonical URL Google selected and the one the page declares, and the last crawl time. Only a limited number of pages are checked per day, and results are refreshed periodically. This information confirms recommendations such as “this page is not in Google's index” or “Google selected a different canonical URL”, and whether a task you completed is reflected in Google.
c) Google Analytics 4 data
If you choose to connect your Google Analytics account, we request the https://www.googleapis.com/auth/analytics.readonly scope. This scope is also read-only: we cannot make any changes to your Analytics account, your property settings or your data streams. We use this access for the following:
- Property selection. We list the names of the Analytics accounts and properties you can access so that you can select the one that matches your site. To check that the property you select measures your site, we also read the URLs of that property's data streams. We do not read any report data from properties you have not selected.
- Traffic reports. For the property you have matched, we read and store daily aggregate counts: sessions, users, engaged sessions, engagement time and key event counts, broken down by channel group, source/medium, landing page, device category and country. We use them to show where your organic traffic comes from and which pages bring in business, and to combine them with search data to generate recommendations.
We do not receive person-level data from Analytics: the identity, IP address, device ID or browsing history of your individual visitors never reaches us; Google's reporting interface returns only aggregate counts.
Your Search Console and Analytics access tokens (access and refresh tokens) are stored in the database in encrypted form; the encryption key is kept not in the database but in a separate environment variable.
d) Data from the sites we crawl
When you start an audit, our own crawler (SeolinBot) visits the target URL and follows robots.txt rules. For each page, what we collect are technical SEO signals: URL, HTTP status code, redirects, page title, meta description, canonical tag, robots meta tag, heading hierarchy, word count, internal/external link counts, number of images without alt text, server response time, page size, and the structured data (JSON-LD / Microdata) markup on the page. We also read your robots.txt and XML sitemap files.
We do not store the full HTML content of pages; we keep only the extracted signals above and the evidence for findings. We do not log in to your site, fill in forms, or enter areas that require signing in.
e) Audits without an account (free audits)
When you start an audit from the home page without signing up, we record the following to prevent abuse: an irreversible hash of your IP address, generated with a secret key (we do not store your raw IP address in our own systems), your browser identifier (user-agent), the referring URL and — only while report emails are enabled and only if you entered it yourself — the email address you provided so that we can notify you when the report is ready. Report emails are currently disabled; the form does not ask for an email address.
The ID and URL of your most recent free audit are kept in your browser's local storage (localStorage) for 7 days. The purpose is to transfer that report to your account if you later create an account and add the same site, so that you do not need to have your site crawled again. This information is sent to our server only when you add a site.
f) Cookies
We use two strictly necessary cookies for the service to work: seolin_session keeps you signed in, and csrftoken is a security cookie that prevents your forms from being submitted on your behalf by another site. After you sign in, three preference cookies are also set to remember the view choices you make in the dashboard: seolin_site (selected site), seolin_range (selected date range) and seolin_sidebar (whether the menu is expanded or collapsed). A seolin_locale cookie is also set to remember your interface language: it is created when you use the language switcher or open our English pages, even if you are not signed in; it carries only the selected language (tr or en) and is kept for 1 year. These carry only those choices; they do not track your identity or your browsing. We do not use advertising cookies or tracking pixels; Google Analytics does not run on our own site.
Cookieless site measurement. Cloudflare adds its own measurement script (Cloudflare Web Analytics) to our pages. The script does not use cookies or any persistent identifier; it sends Cloudflare the URL of the page you open, the referring URL if there is one, load times, and the type and version of your browser and operating system. Cloudflare also sees your IP address when it receives this request. From this measurement we see only aggregate visit and page speed statistics; we do not use it to identify individual visitors or to build profiles. The legal basis is stated in the KVKK Privacy Notice.
g) Technical logs and error reports
Our servers keep request logs for security and debugging: time, requested path (without query parameters), response code, browser identifier (user-agent) and referring URL. Because requests reach us through Cloudflare and our internal proxy server, these logs show the proxy server's address, not your IP address. Details of unexpected errors are written to the same logs; we do not use an external error-tracking service. Logs are kept in size-limited files, and older logs are deleted automatically. We do not knowingly write your cookies, form contents or Google tokens to these logs.
3. Why and how we use data
| Data | Purpose of use |
|---|---|
| Google email and name | To create your account, recognize you and link you to your workspace. |
| Search Console property list | To verify that the site belongs to you and to raise the crawl limit accordingly. |
| Search Console search data | To combine audit findings with real search performance and generate prioritized recommendations. |
| Search Console URL Inspection results | To confirm not-indexed and canonical-mismatch recommendations, and to see whether completed tasks are reflected in Google's index. |
| Analytics account/property list | To let you select the Analytics property that matches your site. |
| Analytics aggregate traffic data | To show traffic and channel reports, and to combine organic traffic with search data to generate recommendations. |
| Crawled site data | To identify technical SEO findings, calculate a score and show what changed between two audits. |
| IP hash, user-agent, referrer | To prevent abuse and rate-limit violations. Not used for profiling. |
| Email address | To respond to your requests, and for mandatory notices about the service. The service does not currently send automated emails; when report emails are enabled, it is also used to send the report link to the address you provided in a free audit. We do not send marketing emails without your permission. |
| Cloudflare Web Analytics measurements | To monitor the site's aggregate visit and page speed statistics. |
| Request and error logs | To keep the service secure and to detect and fix faults. |
We do not sell your data, we do not use it for ad targeting, and we do not use it to train artificial intelligence models.
4. Google user data — Limited Use disclosure
Seolin's use of information received from Google APIs, and its transfer of that information to other apps, adheres to the Google API Services User Data Policy, including the Limited Use requirements of that policy.
This disclosure covers all data we receive from Google: sign-in information (openid, email, profile), Search Console data (webmasters.readonly) and Google Analytics data (analytics.readonly). Specifically:
- We use the data we receive from Google only to provide and improve features that are visible to you: audit reports, search and traffic screens, recommendations.
- We do not transfer this data to anyone else; the only exceptions are our infrastructure providers that are necessary to provide the feature to you (our server provider and Cloudflare, which carries the traffic; see Section 5), security, legal obligations, or a company merger or transfer (with prior notice).
- We do not use it for advertising, including retargeting, personalized or interest-based advertising; we do not sell it; and we do not use it to determine creditworthiness or for lending purposes.
- We do not have humans read it; we read it only with your explicit permission to resolve a support request, for security purposes (e.g., an abuse investigation), when required by law, or for internal operations in a form aggregated so that it cannot be linked to individual users.
- We do not use Google user data to develop, train or improve artificial intelligence or machine learning models (including general-purpose models), and we do not transfer it to third parties for that purpose.
5. Who we share data with
We use a small number of infrastructure providers to run the service. We share your data only with the recipients below and only to the extent needed to provide the service:
- Google. We read Search Console and Analytics data directly from Google APIs, under the authorization of the account you connect (Sections 2(b) and 2(c) above). The Google measurements in audits (PageSpeed Insights, Chrome UX Report, Web Risk) are currently disabled, and no requests are sent to these APIs. When they are enabled, only the public URL of the audited page is sent to these APIs; no information about your identity is sent.
- Application server: a virtual server (VPS) service provider. This website and our audit and sync services run on this server; your account, audit and Google data are also stored on the same server, in a PostgreSQL database that we manage. We do not use a separate managed database provider.
- Cloudflare (domain, email routing, content delivery, security and site measurement). All requests to the site and the dashboard first pass through Cloudflare's network; Cloudflare decrypts the connection and forwards the request to our server, re-encrypting it. In doing so, it processes your IP address and request information; the data you see in the dashboard (including Google data) also passes along this route. For site measurement, see 2(f).
- Email. Emails sent to our domain are forwarded to our mailbox by Cloudflare's email routing service and are stored on the servers of the provider that hosts our mailbox.
- Legal obligation. When there is a valid legal request, we share only what the request covers.
We do not currently use an email sending provider or an external error-tracking service.
Our application server is located outside Türkiye; Cloudflare and Google are US-based companies. Your data is therefore processed and stored outside Türkiye. The list of recipients is in Section 4 of the KVKK Privacy Notice.
6. Retention and deletion
- Account and audit data: kept for as long as your account is active.
- Google connection and tokens: when you open the “Manage connection” page for the relevant connection under Settings → Connections in the dashboard and confirm “Remove connection”, the connection record and the encrypted tokens are deleted. Data retrieval through that connection stops; the Search Console and Analytics matching of the sites that use the connection, and the ownership verification obtained through that connection, are removed. Only the owner or an admin of the workspace can remove a connection.
- Aggregate data retrieved from Search Console and Analytics: when you remove a connection, the previously retrieved Search Console and Analytics data of the sites linked to that connection (daily tables, sync status and URL Inspection results) is deleted in the same operation as the tokens; of the recommendations, only those based on that source are removed, and the current plan is archived. You do not need to make a separate request. Your technical audit findings (crawl results) are not affected by this operation.
- Reports and archived plans: reports you created earlier contain the Search Console and Analytics totals (e.g., clicks, impressions, sessions) as of the time they were created; tasks in an archived plan also keep the baseline values of the page or query they are based on. Removing the connection does not delete these. They are deleted when you delete the site from the dashboard or when you write to us.
- Site deletion: when you delete a site from the dashboard, that site's audits, reports, plans and all data obtained from Google for that site are deleted. Your Google connection and the other sites in your workspace are not affected.
- Audits without an account: the report remains accessible via its link. The email address you provided for the audit, the browser identifier and the referring URL are deleted automatically 30 days after the audit; the hash of your IP address remains with the report. If you want the report deleted completely, write to us.
- Request and error logs: kept for a short time, on a rotating basis, and deleted automatically.
- Complete deletion of your account: write to [email protected]. We delete your account, your workspace, your sites, your Google connections, the retrieved Google data and your audit history within 30 days. Deleted data may remain in our database backups for some time; automatic backups on the server are deleted after 14 days.
Removing the connection in the dashboard does not by itself revoke the permission you granted in your Google Account. You can also remove Google's access at any time, independently of us: Your Google Account → Third-party apps.
7. Security
- All traffic is encrypted with TLS.
- Google access and refresh tokens are written to the database in encrypted form; the encryption key is kept outside the database.
- We do not store raw IP addresses in our own systems: free audits and rate limiting use only an irreversible hash generated with a secret key. For Cloudflare's processing of your IP address, see Section 5.
- The service that handles audits without an account connects to the database with read-only permission.
No system is 100% secure; if there is a breach affecting your data, we will notify you and the relevant authorities within the time required by applicable legislation.
8. Your rights
Depending on where you are (KVKK, GDPR and similar legislation), you have the right to access your data, to have it corrected, to request its deletion, to restrict its processing and to receive a copy of your data in a portable format. To exercise any of these rights, simply write to [email protected]. The application procedures under KVKK are set out in the KVKK Privacy Notice.
9. Children's privacy
The service is not intended for people under the age of 18, and we do not knowingly collect data from children.
10. Changes to this policy
If we update the policy, we change the “Last updated” date on this page. For an update that materially changes the data we collect or the purpose for which we use it, we will notify you by email before the change takes effect.
11. Contact
ELLISEKIZ LLC · 30 North Gould Street, Suite 100, Sheridan, WY 82801, United States
Email: [email protected]
Where to write for each topic: Contact.
Related documents: Terms of Use · KVKK Privacy Notice · About SeolinBot