Privacy Policy

0. Summary of Data Collection, Handling, Storage, and Sharing

In accordance with Google's Developer Program Policy and the User Data FAQ, the following summary provides immediate transparency regarding all data handled by the extension and its backend:

1. User Data Collection

We strictly adhere to the data minimization principle. We collect only information that is directly necessary to execute website SEO audits, authenticate user sessions, and maintain user audit histories.

1.1 Personal and Account Identification Information

When you choose to sign in to unlock comprehensive in-depth reports, we collect:

• Personal Data Google Account Profile: When you authenticate via Google Sign-In, we receive your Google unique account identifier (`sub` ID), full name, verified email address, and profile picture avatar URL through Google's official UserInfo API endpoints.
• Personal Data Mobile Phone Number: Following Google Sign-In, users are prompted to provide their mobile phone number. This number is collected directly from user input for account registration verification, profile completeness, and duplicate account prevention.

1.2 Webpage Content & Browsing Activity Analyzed

When you trigger an audit or browse an active website with the extension enabled:

• Audit Data Audited Webpage URL & Domain: The URL of the webpage you choose to audit (e.g. `https://example.com/page`).
• Audit Data On-Page Technical SEO Elements: Page title tag, meta description, meta robots directives, canonical tags, character encoding (`charset`), HTTP vs HTTPS status, and favicon declarations.
• Audit Data Content Architecture & Hierarchy: Heading structure (H1 through H6 count and text hierarchy) and word count.
• Audit Data Media Assets: Image tags (``), image alt attributes, aspect ratios, responsive `srcset` markup, and image formats (WebP, AVIF, SVG, PNG).
• Audit Data Social & Structured Data: OpenGraph meta tags (og:title, og:description, og:image), Twitter/X Card tags, and Schema.org JSON-LD structured data blocks.
• Audit Data Performance & Core Web Vitals Indicators: Client-measured DOM node counts, render-blocking scripts, resource reference counts (CSS, JS, fonts), and lab estimates for Largest Contentful Paint (LCP), Interaction to Next Paint (INP), and Cumulative Layout Shift (CLS).

1.3 Technical, Device & Connection Data

When the extension communicates with our backend API at https://seo-checker.unikainfocom.in:

• IP Address: Logged automatically by server web logs and reverse proxy for cybersecurity, rate-limiting, and geographic abuse prevention.
• Operating System & Platform: Detected platform metadata (e.g., Windows 10/11, macOS, Linux) and client identifier (`device_name`) used to maintain session compatibility.
• Session State: Login status flag (`is_logged = 1`) and login timestamp (`last_login_at`) to manage multi-device sessions and active logins.

1.4 Local Storage Data

The extension uses Chrome's `storage.local` API to store local preferences, your current active session user object, and cached diagnostic reports so you can access previous audit results instantly without redundant network queries.

2. User Data Handling and Purpose of Processing

We handle and process user data solely to provide, support, and secure the specific features of SEO Tool - Website SEO Checker:

2.1 Strict Single-Purpose Handling

The data collected is used exclusively for the single purpose of providing website SEO diagnostics and user account management. We never repurpose, cross-reference, or monetize this information.

3. User Data Storage and Retention

We implement industry-standard physical, technical, and administrative safeguards to protect your data across all storage environments:

3.1 Storage Locations

• Local Browser Storage: Local extension settings, authorization state, and temporary audit caches are stored on your local computer using the Chrome Storage API (`chrome.storage.local`). This data never leaves your device unless you sign in and sync your session.
• Backend Cloud Database: Authenticated user account data (Google ID, name, email, avatar, mobile number), session tokens, and saved audit histories are stored in a secured MySQL relational database hosted on dedicated cloud servers provided by Hetzner Online GmbH in secure data centers located in Germany/Finland.

3.2 Data Retention Schedule

3.3 Security & Encryption

All communications between the Chrome Extension and our backend APIs (https://seo-checker.unikainfocom.in) are enforced over encrypted HTTPS using modern TLS 1.2 and TLS 1.3 with robust cipher suites. Database records are protected behind strict firewall configurations, private networking, and token-based bearer authentication.

4. User Data Sharing and Disclosure

Unika Infocom Pvt. Ltd. does NOT sell, rent, barter, or trade personal or sensitive user data under any circumstances.

We do not disclose your personal information or audited website content to any third parties, except in the specific, limited operational situations described below:

4.1 Service Providers (Subprocessors)

We work only with reputable infrastructure and authentication providers strictly necessary to operate the Service:

• Google LLC (Google Identity Services): Used exclusively to facilitate OAuth 2.0 user authentication and identity verification. Google processes authentication credentials in accordance with the Google Privacy Policy.
• Hetzner Online GmbH: Our cloud hosting and server infrastructure partner. Hetzner provides ISO 27001-certified data center hosting. Data processed on Hetzner servers remains confidential and is protected under strict Data Processing Agreements (DPA).

4.2 Legal and Regulatory Compliance

We may disclose personal data only if required to do so by applicable law, court order, subpoena, or lawful governmental authority, or where necessary to investigate fraud, enforce our Terms of Service, or protect the vital safety and security of our users.

4.3 Business Transfers

In the event of a merger, acquisition, corporate reorganization, or sale of company assets, user data may be transferred as part of the transaction, provided that the acquiring entity agrees to honor the commitments made in this Privacy Policy.

5. Prominent In-Product Disclosure & User Consent

In accordance with Chrome Web Store User Data FAQ policy on Prominent Disclosure:

By clicking "Sign Up with Google", submitting your phone number, or initiating an audit, you provide affirmative consent to the collection and handling of data as described herein.

6. User Choices, Rights, and Data Deletion

We believe in giving you full ownership and control over your data. You have the following rights:

• Right to Access: You can view all saved audit reports and profile information directly inside the extension's "History" and "Profile" tabs.
• Right to Rectification: You can update or correct your profile details by contacting our support team.
• Right to Delete Individual Audits: You can immediately delete any single audit report from your account by clicking the trash/delete icon in the "Audit History" tab.
• Right to Clear All Audit History: You can wipe your entire audit history at any time using the "Clear History" button in the dashboard.
• Right to Full Account & Phone Number Deletion: You can request the permanent deletion of your complete account profile, including your name, email, Google identifier, mobile number, and all associated audit data, by emailing our privacy team at:
  [email protected] (Subject: "Data Deletion Request - Ultimate SEO Checker")
• Turnaround Guarantee: Verified deletion requests are reviewed and permanently processed within 30 calendar days.

7. Chrome Extension Permissions Justification

The extension declares only the minimum necessary permissions in its manifest.json to perform its core SEO audit functions:

8. Data Security & Storage Safeguards

We employ robust technical and organizational security protocols:

• Transport Layer Security: All API requests use HTTPS with modern TLS encryption to prevent eavesdropping and man-in-the-middle attacks.
• Access Controls: Server administration access is restricted to authorized engineers via SSH keys and IP whitelisting.
• Brute-Force & Bot Mitigation: Rate-limiting guards protect API endpoints from brute-force attempts and denial-of-service traffic.
• No Password Storage: Authentication uses tokenized OAuth2 delegations. We never solicit or store your Google password.

9. Chrome Web Store Limited Use Certification

10. Children's Privacy

The Service is intended for website administrators, developers, digital marketers, and general adult audiences. We do not knowingly solicit or collect personal information from children under the age of 13 (or under 16 in the European Union). If you believe a minor has provided personal information to us, please notify us immediately at [email protected], and we will delete the data promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our service features, server infrastructure, or applicable regulatory guidelines. When changes are made, we will update the "Last Updated" date at the top of this document. Continued use of the extension after any modifications constitutes acceptance of the updated policy.

12. Contact Us & Grievance Redressal