SiteTest.ai

Privacy Policy

Last updated: October 11, 2026

Controller

SiteTest.ai — Individual entrepreneur (FOP) Halyna Samoilenko
E-Mail: info@seoport.com.ua

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR / DSGVO) is the seller listed above.

What data we collect

When you use SiteTest.ai we process the following data:

  • The URL you submit for analysis (and its publicly accessible content fetched by our crawler).
  • Your IP address — used for rate limiting and abuse prevention; it is recorded in server logs and in our internal event log on our own server, where it is stored together with your e-mail address (if you gave it) and the address of the checked site (see “Retention period”).
  • Your e-mail address — required to order a paid audit (to contact you about the order and payment); for a free audit, only if you voluntarily provide it to receive the report.
  • Standard server log data (IP address, timestamp, user agent, request path) for security and reliability.
  • Payment data — amount, currency, payment status and date, order number, and the masked card number and card type if the payment service passes them on. We never receive the full card number.
  • Additionally, Google Analytics receives the following — in Ukraine from your first visit until you opt out, in other countries only if you allow statistics (see “Cookies and tracking”): device and browser data, approximate location, the pages you open (a page address may contain the report ID, the address of the checked site and UTM campaign tags) and your actions on the site, and identifiers stored in cookies or browser storage. If statistics are allowed but ad measurement is not, ad click identifiers (such as gclid, fbclid or msclkid) are removed from the page address before Google Analytics loads; if ad measurement is allowed as well (in Ukraine — until you opt out), ad click identifiers in the page address are not removed and are passed on.
  • If you send a request to a specialist: your name, e-mail address, preferred messenger and your handle there (if given), who edits your site, and the request details (the checked site, your comment) — to reply to you and prepare an offer.

Purpose of processing

We process this data to deliver the audit service you requested (fetching, analysing and reporting on the submitted URL), to send you the report, to prevent abuse and overload of the service, and to operate and secure our infrastructure. We also count visits without cookies (Plausible Analytics) and measure visits and the results of our advertising with Google Analytics and Google Ads — with your consent, or in Ukraine until you opt out (see “Cookies and tracking”).

Legal basis

Processing is based on:

  • Art. 6 (1) (b) GDPR — performance of a contract (delivery of the requested audit) or steps taken at your request before entering into a contract (a reply to your request to a specialist).
  • Art. 6 (1) (f) GDPR — legitimate interest in operating, securing and improving the service: server logs, abuse prevention, internal service notifications to us in Telegram, our own counters of report steps (event, report ID, country, interface language and technical labels of the step, such as the plan, the source and whether a promo code was used; no IP address or e-mail), and visit statistics via Plausible Analytics, which sets no cookies and stores nothing on your device; Plausible receives the addresses of the pages you open (including report links, which contain the report ID and sometimes an access key to the report), events of your actions on the site with their parameters (see “Recipients / third-party processors”) and the addresses of external links you click.
  • Art. 11 of the Law of Ukraine “On Personal Data Protection” of 01.06.2010 No. 2297-VI — conclusion and performance of a transaction to which you are a party (item 3 of part 1) and compliance with an obligation imposed by law, in particular accounting for payments (item 5 of part 1). For users in the EU, payment records are kept on the basis of Art. 6 (1) (f) GDPR — our legitimate interest in complying with the accounting obligations that apply to us.
  • Google Analytics and Google Ads — statistics and measuring our advertising, two separate purposes. Outside Ukraine — your consent, given separately for each purpose: in the EEA — Art. 6 (1) (a) GDPR, and for cookies and browser storage Art. 5 (3) of Directive 2002/58/EC (ePrivacy) and national rules such as § 25 (1) TDDDG in Germany and Art. 22.2 LSSI in Spain; in the United Kingdom — Art. 6 (1) (a) UK GDPR and Regulation 6 of PECR; in Switzerland — the Federal Act on Data Protection (FADP) and Art. 45c of the Telecommunications Act; in other countries — your consent. Strictly necessary storage needs no consent, and Plausible Analytics works without consent and without cookies (see “Cookies and tracking”). In Ukraine, both purposes are on from your first visit until you opt out, and the cookie banner says so. The basis is our legitimate interest in measuring visits and the results of our advertising (item 6 of part 1 of Art. 11 of the Law of Ukraine No. 2297-VI): ad personalisation is off, and you can object to this processing with one click — “Decline” in the cookie banner — or later via “Cookie settings”. If your browser sends the Global Privacy Control signal or does not let the site save your choice, the site works in Ukraine as it does in countries where consent is required (see “Cookies and tracking”). You can withdraw consent or opt out at any time via “Cookie settings” at the bottom of this page or of the site's homepage; this applies to the future and does not affect the lawfulness of processing before it.

Retention period

Free audit reports: 90 days after the audit is created we delete the report content and the data identifying the site and you from the report record — the URL, the domain, the link to your user account, the page data, the AI-generated text and the details of every check. The report link stops working. The report record then keeps only its internal report ID, scores, dates and technical details of the check (such as the plan, the language, the duration and the number of issues found); we do not claim it is fully anonymous data. Separately, for each single (non-batch) audit we keep a score history entry — the checked domain, the report ID, your user ID if the audit is linked to your account, the site health score and grade, the number of critical and high-priority issues and the date; we have not yet set an automatic deletion period for it. Our own report-step counters (event, report ID, country, interface language, technical labels of the step) are kept separately; we have not yet set an automatic deletion period for them. Paid audit reports for audits created from 1 September 2026: the same clean-up 365 days after the audit is created, and the period is stated before payment. Paid reports for audits created before that date are not cleaned up automatically, even if bought later — we will not shorten access to something already sold without contacting the buyer first. The clean-up runs daily and has been in operation since 1 September 2026; it also covers free reports created before that date. E-mail addresses are kept until you ask us to delete them; the unsubscribe link in our e-mails stops the report and reminder e-mails about that report, and we keep the address marked as unsubscribed so that we do not write to you about that report again (a payment confirmation is still sent). An e-mail address in a payment record is kept for the period set for payment records (see below) and is not deleted earlier. For security purposes, web server logs are kept for 14 days and our internal event log for 30 days; application logs are removed by rotation (the last 7 files of each log are kept); two older application log files from May 2026 are not covered by rotation, and we have not yet set a date for deleting them. Requests to a specialist are kept until you ask for their deletion. The audit task queue keeps the technical data of the last 1,000 completed and 500 failed checks — the report ID and, for some checks, a key made up of your user ID, visitor identifier or IP address and the checked domain, and for failed checks also the error text, which may contain the address of the checked site; older entries are replaced by new ones. Other internal task queues keep, for the last 200–500 failed tasks of each queue, the task identifiers (such as the report or batch ID) and the error text, which may contain the address of the checked site. Database backups are removed by rotation; if a backup is ever restored, we will run the clean-up again over the restored data. These periods apply to data on our server; the recipients listed below keep data under their own rules — for example, Telegram notifications stay in our chat until we delete them.

Payment records (amount, currency, payment status and date, order number, the buyer’s e-mail, the masked card number if the payment service passed it on) are kept for the period set by accounting legislation.

Google Analytics keeps user- and event-level data for 14 months (the retention setting of our property); for a user’s data this period restarts with each new activity of that user, so data about a returning visitor may be kept longer. Aggregated reports may be kept longer. Withdrawing consent to statistics or opting out of it stops further Google Analytics collection on our site but does not delete data already sent to Google; deleting cookies by itself does not withdraw a saved consent. Where consent is required, your cookie choice is valid for 12 months; we ask again when it expires or when the purposes change. In Ukraine, your choice applies for as long as it is stored in your browser; if there is no such entry, the site behaves as on a first visit (see “Cookies and tracking”).

Recipients / third-party processors

We use the following services and pass data to the following recipients. For each recipient we state what it receives and, where applicable, on what terms and in what role.

  • DeepSeek (China) and — as a fallback and to check how ChatGPT reads the submitted page — OpenAI (USA): AI analysis of the address and publicly available content of the submitted page. We do not send them your e-mail address or IP address; however, the page address or its content may itself contain personal data. The European Commission has not adopted an adequacy decision for China.
  • Plausible Insights OÜ (Estonia, EU) — Plausible Analytics, visit statistics without cookies. Plausible receives the full addresses of the pages you open (with UTM campaign tags and ad click identifiers, such as gclid, if they are in the address), including report links: they contain the report ID, and the link after payment and links for sharing the report also contain an access key to the report. Some page addresses also contain the address of the checked site (for example, /site/… pages and links with ?url=…). Plausible also receives the referring site, browser and device data, your IP address (from which Plausible determines the country), clicks on external links (with the address of the link you clicked) and events of your actions on the site (for example, audit started or completed, checkout opened, share, PDF download, request to a specialist) with their parameters: the report ID, the plan, the audit grade and score, the interface language, UTM campaign tags, whether an e-mail address or a promo code was entered (but not the address or the code itself), the reason a check was refused, for offers the CMS and the site type, for requests to a specialist the chosen messenger and who edits the site, and other technical labels of the action (for example, audit status, offer state and order, action source, sharing method, current and target plan, which checks in the AI text-access block can be fixed). From our server, Plausible receives payment events (completed, failed or abandoned) with the report link, the plan and either the amount and currency or the payment status — without your IP address or e-mail.
  • Hetzner Online GmbH (Germany) — hosting and infrastructure.
  • Cloudflare, Inc. (USA, with EU subprocessing) — CDN, DDoS protection, bot management. Cloudflare processes IP addresses and basic request metadata under DPA and SCCs. Cookies: __cf_bm, cf_clearance.
  • Google Analytics and Google Ads — Google Ireland Limited (Ireland) and Google LLC (USA) — in Ukraine from your first visit until you opt out, in other countries only with your consent (see “Cookies and tracking”). With statistics allowed: device and browser data, approximate location derived from your IP address, the addresses of the pages you open on our site (including report links and UTM campaign tags), your actions there (for example, audit started, checkout opened) with the parameters listed for Plausible above (the report ID is not sent as a separate parameter) and a cookie identifier. Our Google Ads conversions are measured by importing these events from the linked Google Analytics property; there are no separate Google Ads tags on the site. If ad measurement is allowed as well (in Ukraine — until you opt out), the ad click identifier is passed on and the site sends the ad_storage and ad_user_data signals as “granted”; otherwise they are sent as “denied”. The ad personalisation signal is always set to “denied”. For Google Analytics statistics, Google acts as our processor under the Google Ads Data Processing Terms; data imported into Google Ads for conversion measurement is processed by Google as an independent controller under the Google Ads Controller-Controller Data Protection Terms (Google's privacy policy: policies.google.com/privacy). Under our account’s data sharing settings, Google may use the data in aggregated, de-identified form for modelling and benchmarking, Google technical support may access the account data, and Google may use the data to give us recommendations for our business. Data may be processed outside the EU, including in the USA: transfers to the USA rely, from the EEA, on the EU–U.S. Data Privacy Framework, from the United Kingdom, on its UK Extension, and from Switzerland, on the Swiss–U.S. Data Privacy Framework (Google LLC is certified under all three); from Ukraine, on the data protection safeguards Google gives in the Google Ads terms named above (item 5 of part 4 of Art. 29 of the Law of Ukraine No. 2297-VI).
  • Plus Five Five, Inc. (Resend, USA) — sending e-mails (sign-in codes, report links and reminders, links to restore access to your reports, payment confirmations, the automatic reply to a request to a specialist); processes your e-mail address and the content of the message. Resend acts as our processor under its Data Processing Addendum, which is part of its terms of service and includes the Standard Contractual Clauses. Data may be processed in the USA.
  • Telegram (messenger) — internal service notifications to us (for example, about audits started, completed and refused, payments, promo codes, requests to a specialist and server errors). Depending on the event, a notification may include your e-mail address (if you provided it), the address of the checked site, internal report, user and request identifiers, payment and order numbers, payment statuses, the interface language, the plan, the payment amount and currency, a promo code, the discount and whether the code was accepted (and if not, why), the audit grade and score and how long the audit took, the details of a request to a specialist (messenger and handle, who edits the site, the CMS, the estimated price and hours), for agency batches the number of sites and the “prepared for” label entered by the agency, for failed audits the error text (up to 120 characters), and for server errors the request path without parameters and the error text (up to 200 characters). Your IP address is not included as a separate field. Telegram processes this data under its own terms; we have no data processing agreement with Telegram. Data may be processed outside the EU.
  • Google PageSpeed Insights API — Google LLC (USA): to measure loading speed, the address of the checked page is sent to Google; this is part of the audit you request and does not depend on your cookie choice. No data from your device is sent.

When you pay, your data is received by the payment service you pay through, which processes it under its own rules: WayForPay receives your e-mail address, the amount, the currency, the order number and the name of the service with the address of the audited site; monobank (through the payment gateway mono-pay) receives the amount, the currency and the order number. Card details are entered only on the payment service’s side; we receive from it the payment status and technical payment details (including the masked card number and card type, if the service passes them on).

The payment gateway mono-pay, through which we issue monobank invoices, acts as a processor of personal data on our behalf: it processes the amount, currency, order number and payment status.

We do not sell personal data. With your consent — and in Ukraine until you opt out — we disclose measurement data to Google for Google Analytics and Google Ads conversion measurement, as described above.

Cookies and tracking

The site needs the following cookies and browser storage entries to work, and they are used without consent: the sign-in cookie st_session (30 days) and login_nonce (15 minutes, while you sign in), the language cookie i18n_locale (1 year), your cookie choice st_analytics_consent (browser storage), settings you choose, such as the colour theme or a dismissed banner (browser storage), the stid cookie — set only for guest visitors once a free audit is queued, for the free-audit limit and abuse prevention, for 30 days — and Cloudflare security cookies (__cf_bm, cf_clearance). Plausible Analytics sets no cookies and stores nothing on your device. Google Analytics, through which our Google Ads conversions are measured (see “Recipients / third-party processors”), serves two purposes: statistics — Google Analytics cookies _ga and _ga_7JXB8Q2BTC (by default up to 2 years) and browser storage entries that keep the same report event from being counted twice; ad measurement (only together with statistics) — Google Ads cookies and browser storage entries starting with _gcl or _gac, if set (for example, _gcl_au — by default 90 days), and our st_utm cookie with UTM campaign tags (30 days; without permission for ad measurement, the tags are kept only in the memory of the open page). We determine the country from your IP address via Cloudflare (the CF-IPCountry header). In Ukraine, Google Analytics with ad measurement loads from your first visit, with the same cookies and signals as after “Allow all”; the cookie banner says so and offers “Decline”, “OK” and “Choose what to allow”; “OK” saves permission for both purposes; in “Choose what to allow” both purposes are switched on at first, which is how the site works until you opt out. To find out whether it can save your choice, in Ukraine the site writes and immediately deletes a technical entry, st_consent_probe, in browser storage when a page loads. In all other countries, and when the country cannot be determined, no Google script is loaded until you allow statistics; the banner offers “Decline”, “Allow all” and “Choose what to allow”. Any permission saved in the banner in Ukraine does not count as consent in other countries — the banner there asks again; a refusal is respected everywhere. If your browser sends the Global Privacy Control signal, we treat it as a refusal of ad measurement: it stays off even if you allowed it, and in Ukraine the site then, as in other countries, loads nothing from Google without your consent. If your browser does not let the site save your choice in browser storage (for example, when site data is blocked), the site works as it does in countries where consent is required: it applies a previously saved valid choice if the browser returns it, and otherwise asks; a new choice that could not be saved applies until the page is reloaded. Where consent is required, your choice is valid for 12 months; in Ukraine, for as long as it is stored in your browser. If there is no saved choice — you cleared site data, opened the site in another browser or a private window, or the browser deleted the entry itself (this happens, for example, in Safari) — in Ukraine the site treats you as a new visitor: Google Analytics with ad measurement loads straight away, and the banner again offers to opt out. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of this page or of the site's homepage. If you withdraw or decline a purpose, from then on Google Analytics stops on our site for statistics, and for ad measurement the site sends the ad_storage and ad_user_data signals as “denied” and, if statistics keep running, removes ad click identifiers from the page address; we delete the cookies and entries for that purpose that the site can access. Data already sent to Google is not deleted (see “Retention period”).

Your rights

Under the GDPR and, for users in Ukraine, Art. 8 of the Law of Ukraine No. 2297-VI, you have the following rights:

  • Right of access (Art. 15 GDPR) — to know what data we hold about you.
  • Right to rectification (Art. 16 GDPR).
  • Right to erasure / "right to be forgotten" (Art. 17 GDPR).
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR).
  • Right to object (Art. 21 GDPR) and right to withdraw consent at any time.

To exercise any of these rights, contact us at info@seoport.com.ua.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. In Ukraine, the supervisory authority is the Ukrainian Parliament Commissioner for Human Rights.

Changes to this policy

We may update this privacy policy from time to time. The current version always applies and is published on this page.