Legal

Privacy Policy

Last updated 13 October 2026

1. Who we are

The hosted CodoSEO service at codoseo.com is run by RankOrg, a business in India. RankOrg decides how and why your personal data is processed for the service, so it is the data fiduciary (or "controller") for it. This policy covers the hosted service only. A self-hosted copy of CodoSEO is run by whoever hosts it, and sends nothing to us.

We wrote this policy with India's Digital Personal Data Protection Act, 2023 in mind, and we offer the rights below to everyone, wherever you live.

2. What we collect

Your account

• Your email address, plus a normalised form of it so the same inbox cannot open several accounts.
• If you sign in with GitHub: your GitHub user ID and the email address GitHub gives us.
• Your plan, when you signed up and last signed in, and when you last opened a link in one of our emails.

Sign-in and sessions

Sign-in links and session tokens are random values that we store only as a SHA-256 hash, so a copy of our database cannot be used to sign in. A sign-in link works once and expires after 15 minutes; a session lasts 30 days.

Sites you add and crawl data

The domains you add, their crawl settings, and what CodoSEObot finds on their public pages: addresses, status codes, response times, redirects, titles, meta tags, headings, links, structured data, and files such as robots.txt, sitemaps and llms.txt. We also keep check results, health scores, the changes between crawls, and the AI access (GEO) results for each site. We do not store the full HTML of pages.

Alerts

The places you ask us to send alerts: email addresses, Slack and Discord webhook URLs, and your own webhook URLs and their signing secrets. These are stored encrypted (AES-256-GCM, with a key that is not kept in the database). We also keep the alert rules you set, and a short-lived queue of the alerts and emails we send.

API and MCP

API keys are shown to you once and stored only as a SHA-256 hash, with a short prefix so you can tell them apart. We count API and MCP calls per key and per day to apply your plan's limits.

Audits without an account

When you audit a site from the home page without signing in, we keep the site's address and results, and a cookie that lets you claim the audit later. To limit abuse we keep a hashed form of your IP address, with a salt that changes every day, rather than the address itself. The audit form may use Cloudflare Turnstile to tell people from bots.

Billing

For paid plans we keep your plan, its status and renewal dates, your Dodo Payments customer and subscription IDs, and the notifications Dodo Payments sends us about your subscription. We never receive or store card numbers: Dodo Payments collects payment details on its own checkout.

Server logs and analytics

• Like any website, our servers and network process technical data such as IP addresses, browser user agents and the pages requested, to deliver the service, keep it secure and fix problems. These logs are kept for a short time.
• On the public pages (such as the home page, audit reports and these legal pages), we use Umami, a privacy-focused analytics tool that does not use cookies, to count visits. The signed-in app does not load it.

3. Why we use it

• To provide the service you asked for: sign you in, crawl your sites, run checks, send alerts and digests, and answer API and MCP calls. This is needed to perform our agreement with you.
• To bill you through Dodo Payments and apply your plan's limits.
• To keep the service safe: rate limits, stopping abuse, and handling complaints from site owners.
• To email you about your account and the service, such as sign-in links, alerts, a weekly digest, and a note before we pause monitoring on an inactive Free account.
• To meet legal duties, such as keeping payment records and answering lawful requests from authorities.

We do not sell your personal data, share it for advertising, or use it to train AI models.

4. Who processes it for us

We share data only with the service providers we need to run CodoSEO, and only what they need:

• Dodo Payments, our merchant of record, for checkout, payments, taxes, invoices and subscription management.
• Our email delivery provider, to send sign-in links, alerts and other service emails.
• Our hosting provider, which runs the servers and database the service lives on.
• Cloudflare, for the Turnstile check on the audit form.
• GitHub, only if you choose to sign in with GitHub.
• Umami analytics, for cookie-free visit counts on the public pages.
• Slack, Discord or your own webhook endpoints, only when you set them up as alert channels: alerts about your sites go to them.

If you click "Take this site to RankOrg" on an audit, the link carries the domain and its top pages to rankorg.com. Some of these providers may process data outside India; where they do, we rely on their contractual and legal safeguards.

We may also disclose data when the law requires it, for example to law enforcement, or to protect the service and others from abuse.

5. How long we keep it

• Crawl history: per-page data for each site's latest two crawls. Older crawl results, changes and AI access incidents are deleted automatically after 30 days on the Free plan and one year on paid plans.
• Audits without an account: deleted after 7 days if no one claims them by signing in.
• Sign-in links and sessions: deleted once they expire (15 minutes and 30 days).
• API usage counts: 35 days. Revoked API keys: deleted 90 days after you revoke them.
• Queued alerts and emails: deleted 14 days after they are sent, or 30 days after they fail.
• Your account, sites and alert settings: for as long as you keep your account. When you delete it, we delete them, except records we must keep by law, such as payment records.

6. Cookies and local storage

We use no advertising or tracking cookies. The service sets only these, all HttpOnly and limited to codoseo.com:

• codoseo_session: keeps you signed in, for up to 30 days.
• codoseo_audit: links audits you start without an account to your browser so you can claim them, for up to 7 days.
• codoseo_oauth: protects GitHub sign-in, for 10 minutes.

Your browser's local storage also remembers your theme and whether the sidebar is collapsed. That never leaves your device. Cloudflare Turnstile, when shown on the audit form, may store its own technical data to tell people from bots.

7. Your rights

Wherever you live, you can ask us to:

• access the personal data we hold about you and learn how we use it;
• correct or update it;
• delete it, including closing your account;
• export it in a common format (you can also download crawl data as CSV from the app);
• withdraw consent where we rely on it, and object to how we use your data;
• nominate someone to act for you if you die or cannot act yourself.

Email [email protected] from your account's email address so we can confirm it is you. We aim to reply within 30 days. This address is also where to raise a grievance about how we handle your data. If you are not satisfied with our answer, you can complain to the Data Protection Board of India or your local data protection authority.

8. Security

The service runs over HTTPS. Sign-in links, sessions and API keys are stored only as hashes, alert destinations are encrypted, and access to production systems is limited. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

9. Children

The service is not meant for children under 18, and we do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.

10. Changes to this policy

We may update this policy. When we make a material change, we tell you by email or with a notice on the site, and update the date at the top.

11. Contact

Questions or requests about privacy: [email protected]. See also our Terms of Service.