Who we are
Crawvix (crawvix.com) is a website-launch and technical-SEO guidance service run by Crawvix LTD.
In this notice "we", "us" and "Crawvix" mean Crawvix LTD. We decide how and why your personal data is used (in data protection language, we are the "controller").
You can reach us at info@crawvix.com about anything in this notice.
The short version
- We store your email address and a scrambled form (a hash) of your password. We do not store the password itself.
- We store the websites you add and what our scans find on them.
- We never see or store your card number. Payments go through Stripe.
- The error snippet is optional and only works on websites whose owner installs it. It stores no IP address and sets no cookie.
- Only if you press "Accept analytics" in the banner, public pages load Google Analytics to count visits. It is never loaded in the signed-in areas, for signed-in people, or when your browser sends Global Privacy Control or Do Not Track. This site loads no advertising scripts. The cookies we set are listed on the cookies page, where you can also change your choice.
- We do not sell your personal information and we do not share it for advertising.
- Much of what we store has no automatic deletion yet. See "How long we keep it" and "Your rights": you can ask us to delete your data at any time.
What we collect
If you have an account
We store your email address, a hash of your password, whether the address is confirmed, when you last signed in, and a count of recent failed sign-ins and a lock time if the account was locked. We use this to let you sign in, to send you confirmation and password reset emails, and to protect the account.
We store the name of your organization (the name you type at sign-up, which can be your own name if you sign up as an individual), your role in it, and a record for each sign-in session so that signing out ends a session on the server.
If you turn on two-factor sign-in, we store the authenticator key and your recovery codes. They are kept in the database as the sign-in library stores them, without extra encryption.
Websites you add and scan results
We store each website address you add, the ownership proof (a random token and the result of each check), the scans we run, and the results. Results include evidence: text, addresses, headers and DNS records that the website or its DNS publishes. That can include a public email address, a phone number or a link text that belongs to a person.
We also store what you type: a display name, DKIM selectors, a mail-sending IP address if you give one, notes on checks you confirm, and settings. The timeline of changes records who acted as a short label such as "member 1a2b3c4d" (the first characters of your account id), not your email address.
We keep a list of the addresses our crawler found on your website, and for each link the page it is on, the target, and up to 300 characters of the link text. Links such as mailto: and tel: are stored as written on the page.
Reports and share links
When you create a share link we store only a hash of the link, the label you typed, the expiry and a frozen copy of the report with no evidence in it. Each view of a share link adds a row with the link and the time. It stores no IP address, browser or cookie.
Monitoring, alerts and the daily digest
We store your schedule settings, trend numbers for each scan and alerts about checks that stopped passing. If you turn on the daily digest we store the email address you type for it, a scrambled fingerprint (hash) of it and the time its owner confirmed it, and we clear all three when you turn the digest off. We send a confirmation link to that address first and send no digest until it is opened. Every digest has an unsubscribe link; when someone unsubscribes we keep only a hash of their address on a list so no more digests are sent to it, and we keep that hash indefinitely so the request is not forgotten.
We do not send marketing emails or a newsletter. If that ever changes, we will ask for your consent first and update this notice.
Payments
Stripe handles card details in its own payment form. We store Stripe's customer and subscription identifiers, your plan, its status, the period dates, and the identifier, type and time of each Stripe notification. We do not store card numbers, bank details or invoice amounts. When Stripe confirms a payment or a failure, we use the email address in that notice only to address that one message, and we do not save it in the billing records.
Email we send
We send account emails (confirm your address, reset your password, a notice if someone tries to sign up with an address that already has an account), payment receipts and payment-failed notices. Messages wait in a queue with the recipient, subject and body until they are sent, then those are erased. We keep a one-way hash of the recipient address so that sending limits keep working.
If you write to us
If you email info@crawvix.com, we keep your message, your email address and our reply so that we can answer you and keep a record of the conversation.
Visitors of the free sample
If you add a website in the free sample without an account, we store the address you typed and set one cookie with a random identifier so that you can see only your own sample sites. We store no name or email address for the sample.
Forms with a security check (Cloudflare Turnstile)
When the site operator has turned it on, the sign-up, sign-in, forgot-password, new-confirmation-link and free-sample forms ask your browser to pass a check from Cloudflare (Turnstile). Your browser then loads a script and a small frame from Cloudflare, and Cloudflare receives that request, including your IP address and signals from your browser, to decide whether you are a person. Cloudflare gives your browser a one-time token. When you send the form, our server sends that token and your IP address to Cloudflare to confirm it. We do not store the token. The administrator sign-in does not use this check. We have not checked what Cloudflare keeps or for how long, or whether it sets anything in your browser; see Cloudflare's own notices.
Visitors to websites that use our error snippet
The snippet is a small script that a website owner can choose to add to their own website. When a visitor's browser meets a JavaScript error on that website, the snippet sends us a short report: the cleaned error message, the script file address without its query string, the line and column, the page path without its query string, and the browser family such as "Chrome". It sends no cookie, no form content and no page content. We do not store the visitor's IP address or full browser string. We remove email addresses, long digit runs and long token-like text from messages as best we can, but we cannot catch everything that a website's own code puts into an error message. The snippet stays silent when the browser sends "Do Not Track" or "Global Privacy Control". The website owner decides to use the snippet and is responsible for telling their visitors about it; for these reports we act on the website owner's behalf. Website owners should mention the snippet in their own privacy notice.
Everyone who visits
Our server sees the IP address of every request. We use it for limits on sign-in, sign-up, forms and the public pages, and for the administrator sign-in. For customers' sign-in and forms and for the sample and share pages the limit counters hold only a salted hash of the address, in memory, and they are lost when the application restarts. For the administrator sign-in page the counter holds the address itself in memory, and failed attempts write rows (at most 10 a minute) to the database that contain the address. Those rows have no automatic deletion. Our web host also keeps its own server logs. We have not checked what they contain or how long they are kept.
Browsers may send us reports about blocked content. We write a size-limited summary of some of them (at most 60 a minute) to the application log. Browsers send these reports without cookies.
Why we use your data
Data protection law in the UK and the EU asks us to have a "legal basis" for each use of personal data. These are ours.
| What we do | Data involved | Legal basis |
|---|---|---|
| Run your account and the service: sign-in, websites, scans, results, reports, share links, monitoring | Account details, organization, websites, scan results. | Contract: we need this to provide what you signed up for. |
| Take payment and keep billing records | Stripe customer and subscription identifiers, plan and status. | Contract, and legal obligation where tax or accounting law requires records. |
| Send account emails: confirmation, password reset, receipts, payment-failed notices | Email address and the message. | Contract. |
| Send the daily digest | The digest email address you enter and its confirmation. | Consent. You give it by opening the confirmation link and can withdraw it by turning the digest off or using the unsubscribe link. |
| Keep the service secure and stop abuse: rate limits, lockouts, bot checks, security logs | IP addresses, sign-in attempts, request counts. | Legitimate interests: keeping Crawvix and its customers safe. |
| Collect and show JavaScript errors from websites that use our snippet | The short, cleaned error report described above. | Legitimate interests of the website owner and of us in finding errors; for these reports we act on the website owner's behalf. |
| Answer your questions and requests, and handle your privacy requests | Your message, email address and our reply. | Legitimate interests (running a support service), and legal obligation when you use your rights. |
| Fix and improve the service | Application logs and counts. The logs hold no email addresses, passwords or card data. | Legitimate interests. |
| Count visits to public pages | What Google receives, as set out under "Who receives data". | Consent: only after you press "Accept analytics". You can withdraw it at any time on the cookies page. |
| Protect our rights and meet legal duties | Whatever is needed for the matter. | Legal obligation and legitimate interests. |
Where we rely on legitimate interests, we have weighed them against your rights and kept the data to what we need. You can object: see "Your rights". Where we rely on consent, you can withdraw it at any time; this does not affect what we did before.
We do not make decisions about people by automated means that have legal or similarly significant effects. The checks Crawvix runs are about websites, not about you.
Who receives data
We use these companies and services to run Crawvix. They receive data only as shown here. We do not sell your personal data.
| Recipient | What it receives | When |
|---|---|---|
| Our web host and database host (currently SmarterASP.NET shared hosting) | Everything stored by the service, and the host's own logs. | Always. |
| Stripe, the payment provider | Your organization name and your owner email address (to create the Stripe customer), an internal organization id, the plan you choose, and whatever you type into Stripe's payment form. Stripe's script loads in your browser on the checkout page. | Only when you start a checkout, open billing management, or change or cancel a plan. |
| Our email provider (SMTP), currently the mail service of our host, SmarterASP.NET (site4now.net) | The recipient address, subject and body of each email we send. | Whenever an email is sent. |
| Google PageSpeed Insights | The address of the web page being tested. | Only when the server operator has set a PageSpeed key and a full scan runs the Lighthouse checks. Not used by the free sample. |
| Cloudflare (Turnstile security check) | Your browser's request for Cloudflare's script and frame, including your IP address and signals from your browser. After you send a form, our server sends Cloudflare the one-time token from the check and your IP address. | Only when the site operator has turned the check on, on the sign-up, sign-in, forgot-password, new-confirmation-link and free-sample forms. Never on the administrator sign-in. |
| Google Analytics (Google) | From your browser straight to Google: the address of the public page you are on without any query string or #fragment, the page you came from, the page title, browser, device and language details, an identifier in the _ga cookies, and your IP address as part of the connection. Google signals and ad personalization are switched off in our configuration. We receive only counts and reports in our own Google Analytics account, not who you are. | Only on public pages, only after you press "Accept analytics", never when you are signed in or when your browser sends Global Privacy Control or Do Not Track. How long Google keeps the data is a setting of our Google Analytics account that we have not set out here, and where Google processes it is not stated in our code. |
| rdap.org (public domain registration lookup) | The domain name of a website whose ownership is verified. | During a full scan of a verified website. |
| DNS servers, and public spam blocklists reached through them (Spamhaus, SpamCop, SURBL, URIBL, Passive Spam Block List) | Domain names of scanned websites. A mail-sending IP address is looked up only if you typed one. | During scans and ownership checks. |
| The website being scanned, and websites it links to | Requests from our server that name us ("CrawvixBot"). We send no cookies. Linked websites receive a request to check that the link works. | During scans. |
We may also disclose data when the law requires it, for example to answer a valid court order, or to protect the rights, safety or security of our customers, the public or ourselves. If the business is sold or merged, personal data may move to the new owner, who must keep to this notice.
International transfers
Crawvix is used from many countries, and the companies in the table above run servers in several. Your personal data may therefore be processed outside the country where you live, including in the United States.
Where the law of the UK or the EU limits such transfers, we rely on the safeguards the provider offers, such as an adequacy decision or standard contractual clauses, where they apply. We do not control where every provider places its servers. You can ask us about the safeguards for a transfer by writing to info@crawvix.com.
How long we keep it
These periods are what the software does today.
| Data | What the software does |
|---|---|
| An account whose email address was never confirmed | Deleted after 7 days, with its organization if the organization is then empty. The clean-up runs when someone submits the sign-up form. |
| Customer sign-in | The sign-in ends after 8 hours (administrator: 8 hours). The server-side session record of a person is cleaned up the next time that person signs in, once it expired more than a day earlier. |
| Browser error reports from the snippet | Deleted 30 days after the error was last seen. The clean-up runs when a new report arrives. |
| Emails waiting in the queue | Recipient, subject and body are erased as soon as the message is sent. For a message that could not be sent they are erased after 7 days. The queue records are deleted after 30 days. |
| Free sample | The visitor cookie lasts 30 days. Results are removed after 14 days. A sample website that was never verified is deleted with its data after 14 days, and a verified one after 31 days without activity. |
| Share links | A link expires after 14 days unless you choose another time between 1 and 90 days. Expired or revoked links and their views are deleted 30 days later, when the next link is created for the same website. |
| Crawl details (addresses and links found) | Details of older scans are removed after each scan. The newest 3 full scans are kept. |
| Trend snapshots, comparison snapshots, resolved alerts | The newest 730 trend snapshots and the newest 60 comparison snapshots are kept for each website. Resolved alerts are deleted after 180 days. |
| Paid plan that fails to renew | The plan keeps working for 7 days after the first failed payment. After that scans, rechecks and new websites stop until payment succeeds. Data is kept. |
| Messages you send us | Kept for as long as needed to deal with your request and for a reasonable time afterwards in case of follow-up questions. |
| Everything else | Kept with no automatic deletion: confirmed accounts and organizations, websites (archiving a website hides it and deletes nothing), scan results and the timeline, billing records, and administrator security events including the IP addresses of failed administrator sign-ins. We keep these while your account exists and as long as we need them for the purposes above. If you ask us to delete your account, we delete or anonymise this data within one month, except what we must keep by law (for example payment records, which Stripe also keeps under its own obligations) and the unsubscribe hash described above. |
How we protect data
What the software does:
- Passwords are stored only as hashes, never as the password itself.
- All traffic uses HTTPS. Sign-in cookies are marked HttpOnly and, outside local development, Secure.
- Secrets that the service needs, such as the mail server password and API keys, are stored encrypted in the database or held in the host's protected settings, never in the code.
- A signed-in person sees only the websites of their own organization. Another organization's website gives the same answer as one that does not exist.
- Share-link tokens are stored only as hashes. Card details are handled by Stripe and never reach our servers.
- Sign-in, sign-up, forms and public pages have rate limits, and an account locks for a short time after repeated wrong passwords. Two-factor sign-in is available for customer accounts, and an account with platform-administrator rights must use it. The separate administration console (
/admin) has no two-factor step: it is protected by one strong password and rate limiting. - A full scan of a website runs only after its owner has proved ownership.
No system is perfectly secure, and we cannot promise that data will never be exposed. If a breach of personal data is likely to harm you, we will tell you and, where the law requires, the regulator, without undue delay.
Your rights
Depending on where you live, you may have these rights over your personal data:
- Access: to know whether we hold data about you and to get a copy.
- Correction: to have wrong or incomplete data put right.
- Deletion: to have your data deleted.
- Restriction: to ask us to pause using your data while a question is settled.
- Portability: to receive the data you gave us in a common, machine-readable format.
- Objection: to object to uses based on our legitimate interests.
- Withdrawing consent: to withdraw a consent you gave, at any time.
How to use them
Write to info@crawvix.com, preferably from the email address on your account, and say what you want. We may ask you to confirm who you are before we act, for example by asking you to reply from the account address or to sign in. There is no charge. We answer within one month (45 days for California residents) and tell you if the law lets us take longer and why. If we refuse a request, we say why.
Because the service does not yet have buttons for all of this (see "Your choices in the service"), we handle access, correction, deletion and export requests by hand, and send the data you gave us as files.
UK and EU: GDPR and UK GDPR
If you are in the UK or the European Economic Area, the rights above come from the UK GDPR and the EU GDPR. The legal bases for our uses are in "Why we use your data". You can complain to a regulator: see "Complaints".
California: CCPA and CPRA
If you are a California resident, you also have the right to know what personal information we collect, use and disclose, to correct and delete it, and not to be treated worse for using these rights. You may use an authorized agent; we may ask you to confirm the agent's authority.
In the last 12 months we collected these categories of personal information, from you, from Stripe and from the public pages of websites you ask us to scan: identifiers (email address, IP address); customer records and account information (organization name, plan); commercial information (subscription status); and internet or network activity (requests to our servers, error reports from the snippet). We use them for the purposes in "Why we use your data" and disclose them for business purposes only to the recipients in "Who receives data".
We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you.
Your choices in the service
Here is what the service lets you do yourself:
- Change your password, turn two-factor sign-in on or off (off is not allowed for platform-administrator accounts), sign out, or sign out of all browsers.
- Ask for a new confirmation link or a password reset link by email.
- Archive a website to hide it, pause or change scheduled scans, turn the daily digest off (this clears the digest address), and mark an alert as handled.
- Create share links and revoke them at any time.
- Remove the error snippet from your website. Reporting stops at once.
- Remove an unverified website you added in the free sample.
- Download scan data about a website as CSV files (health results, links, timeline, report).
- Cancel a paid plan at the end of the paid period, change plan, and update your payment details through Stripe.
The service does not yet have a button to delete your account, to delete a website and its data, to change the email address on an account, or to download all personal data we hold about you. Write to info@crawvix.com and we will do these for you; see "Your rights". Your analytics choice can be changed at any time under Cookie settings in the page footer; it is kept only in the cx_consent cookie in your browser, and there is no record of consents on our servers.
Complaints
Please write to us first at info@crawvix.com so that we can try to put things right. You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU it is the authority in the country where you live or work, or where you think the problem happened. In California you can contact the California Privacy Protection Agency or the Attorney General.
Children
Crawvix is for people who run websites. It is not for anyone under 16, and we do not knowingly collect personal data from children under 16. If you think a child has given us personal data, write to info@crawvix.com and we will delete it.
Do Not Track and Global Privacy Control
We do not track you across other websites and we do not build advertising profiles. Because we do not sell or share personal information, a "Do Not Track" or "Global Privacy Control" signal from your browser does not change what we do with it. The error snippet stays silent for visitors whose browser sends either signal. Analytics on public pages is also off for them, as described above and on the cookies page.
Cookies
The cookies we set, by exact name, and which ones are strictly necessary, are on the cookies page.
Changes to this notice
We may update this notice when the service or the law changes. The date at the top shows the latest version. If a change is important, such as a new recipient of your data or a new use, we will tell account holders by email or in the service before it takes effect. The Terms explain the rules for using the service.
Contact
Email info@crawvix.com.