Privacy Policy

1. Who we are

The controller of personal data processed for the HuskyScout website, waitlist and accounts is the operator of huskyscout.net, trading as HuskyScout. A registered legal entity is not yet in place. When one is registered, it will be named here and will become the controller.

When you use HuskyScout to process data about your own site, customers or content (for example crawl results, Google Search Console data, CMS credentials, generated articles), you are the controller of that data and we are your processor. The Data Processing Addendum at https://huskyscout.net/dpa applies to that processing.

Contact: [email protected]. There is no separate data protection officer yet. That address reaches a human.

2. Personal data we collect

We collect only what the product needs. Today that is:

• Waitlist: email address and an optional source tag (for example a UTM or form label).
• Domains and public web content you ask us to audit, probe or generate for: the hostname, crawled HTML we fetch, robots.txt, sitemaps, and the scores and evidence we derive.
• AI-visibility probes: the prompts we send, the answers returned by third-party engines, and mention or citation findings.
• Insights and competitors: keywords, SERP snapshots, People Also Ask questions, and competitor hostnames you add.
• Google Search Console, if you connect it: OAuth tokens and search-analytics rows (queries, pages, clicks, impressions) for the linked property.
• CMS publishing, if you connect it: credentials you supply (application passwords, API keys, webhook secrets) and the article records we create or update.
• Generated articles and quality scores, including the brief, brand-voice samples taken from your crawl, and publish status.
• Technical: IP address used for in-memory rate limiting (not stored as an account record), browser user agent on ordinary HTTP logs of the host, and timestamps.
• Accounts, when auth is enabled: email, name, image (if you use Google sign-in), and a password hash if you set a password.
• Billing, when checkout is enabled: Stripe customer and subscription identifiers. Card numbers go to Stripe, not to our database.

3. Data we do not collect on purpose

We do not sell personal data. We do not run advertising pixels. We do not currently run a product analytics vendor (Plausible or equivalent is planned for launch measurement and will be named here before it is switched on).

Free tools and the keyless audit do not require an email. Submitting a domain is enough. We do not ask for special-category data (health, politics, religion, and similar) and you should not send it to us.

4. Why we use the data

We use personal data to:

• Run the service you asked for: audits, probes, insights, generation, publishing, and the public tools.
• Hold a waitlist place and, when email is live, send the invite and operational messages (alerts, reports, billing).
• Secure the product: rate limits, abuse detection, encryption of stored credentials when a key is configured.
• Improve the product using aggregated measurements (for example how often a check fails), not by selling your reports.
• Meet legal obligations (tax, accounting, responding to a lawful request).

5. Legal bases (GDPR)

Where the GDPR or UK GDPR applies, we rely on:

• Contract (Art. 6(1)(b)): providing the service you requested, including a free audit you submitted a domain for.
• Legitimate interests (Art. 6(1)(f)): securing the service, keeping rate limits honest, improving reliability, and telling waitlist addresses about launch. You can object by emailing support.
• Consent (Art. 6(1)(a)): optional connections such as Google Search Console and CMS publishing, which you can disconnect. Also any non-essential cookies, if we add them later.
• Legal obligation (Art. 6(1)(c)): records we must keep under bookkeeping or similar law.

6. How long we keep it

Waitlist emails stay until you ask to be removed or we shut the list down after launch. Scan results, scores, probes and generated articles stay for as long as the site record exists so trends and the content calendar work. You can ask us to delete a domain's history.

OAuth tokens and CMS credentials stay until you disconnect the integration or delete the site. In-memory rate-limit counters expire with the process and are not a warehouse of IP addresses.

If you delete an account we remove or irreversibly anonymize personal data we do not need to keep for legal or security reasons, within 30 days, except backups that rotate out on the host's normal cycle.

7. Named subprocessors

We use the companies below to run HuskyScout. Each one is limited to the purpose listed. The same list is part of the DPA.

No email vendor is live yet. When we start sending product email (waitlist invites, alerts, report delivery), the provider will be Resend (Resend, Inc., United States) or SMTP through the Girder host. The live choice will be named in this list before the first message is sent.

8. International transfers

The application, database and queue run on Hetzner in the EU. Several subprocessors are in the United States or Canada. When we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum where needed) that those vendors offer, plus their security documentation.

OpenRouter sends prompts to model providers in order to return an answer. Do not put secrets, special-category data or other people's personal data into a prompt field if you can avoid it. A public website we crawl is, by definition, already public.

9. Your rights

If you are in the EEA, UK or another region with similar rules, you can ask us to access, correct, delete or export the personal data we hold about you, to restrict or object to certain processing, and to withdraw consent for optional connections. You can also lodge a complaint with your local supervisory authority.

Email [email protected] from the address we should look up. We may need to confirm it is you. We will answer within one month, or tell you if we need more time.

Some records (for example a published article on your CMS, or a search engine's own copy of a page) are not ours to delete. We will tell you if a request is outside what we control.

10. Security

We host on Hetzner, talk to the app over HTTPS, and encrypt Google Search Console tokens and CMS credentials at rest when CREDENTIAL_KEY is set. Without that key (local development, CI, a misconfigured deploy) those values are stored in plaintext, which is a reason not to connect real CMS or GSC accounts to a non-production environment.

No method of transmission or storage is perfectly secure. If we become aware of a personal-data breach that affects you, we will notify you and, where required, the supervisory authority, without undue delay.

11. Children

HuskyScout is a business tool. It is not directed at children under 16, and we do not knowingly collect their data. If you believe we have, email support and we will delete it.

12. Changes

We will post changes on this page and update the effective date. If we add a subprocessor that processes personal data in a material new way, we will update the list here first. The DPA describes how processor-side subprocessor changes are handled for customers.

13. Contact

Privacy questions, rights requests and notices: [email protected].

Related documents: Terms of Service (https://huskyscout.net/terms) and Data Processing Addendum (https://huskyscout.net/dpa).