Legal

Privacy policy

Last updated: November 2, 2026 (Google data sharing). This page explains what data we store, why, and who can access it.

What we store

  • • Your account: your email, name, optional phone number, country and writing dialect - so we know who we work with and write in your market's dialect.
  • • Your store: the store URL and the product data we read from your store platform (product name, description, price, images) to check, suggest and apply changes.
  • • Work results: your scan score, tasks, the text we suggest to you, your keywords and the writing style you set.
  • • Your messages: if you write to us from the contact page, we store your name, email, store URL and message so we can reply.

Google data (Search Console and GA4)

  • • If you connect your Google account, we request two read-only scopes: Search Console (webmasters.readonly) and Google Analytics (analytics.readonly), and we read your account email to show it in the dashboard. There is no write or edit permission.
  • • We read: your list of Search Console sites (queries, pages, clicks, impressions and average position) and GA4 landing-page statistics (sessions and purchases).
  • • We use it only for features you see: your store's real performance, prioritising improvements, suggesting a keyword for each product, and comparing pages before and after a change. We do not use it for advertising and we do not sell it.
  • • Sharing: when suggesting keywords for a product, we send the search queries that brought visitors to that product's page (from Search Console, with no personal data) to our AI provider (the paid Google Gemini API), which picks the best fit for the product, and to our search-volume provider (DataForSEO), which returns their monthly search volume. They use it only to complete that request, and it is not used to train AI models. We do not share Google data with anyone else.
  • • We keep the Google access token on the server only; it never reaches your browser. Google reports are fetched when you view them and we do not store a copy, except click and impression totals for pages Rutbot changed, kept to show you the before/after comparison.
  • • You can disconnect at any time from the Google data tab (the Disconnect button): we revoke the token with Google and delete it together with the stored comparison numbers. You can also revoke access at https://myaccount.google.com/permissions.
  • • Rutbot's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Why we use this data

  • • Running the service: scanning, suggesting improvements and applying changes after you approve them.
  • • Improving results: comparing your store's score before and after, and measuring how it shows up in AI answers.
  • • Contact: replying to your questions and telling you about important changes to the service.
  • • We do not sell data, and we do not use it for anyone else's advertising.

Who can access the data

  • • Your store platform (Salla, Zid, WooCommerce, EasyOrders): we request the minimum permissions needed and use the platform's official API to read your products and change them after you approve. You can remove Rutbot's access from your platform account at any time.
  • • AI model providers: we send them product text and keywords so they can draft suggestions, and we show you the text before it is published in your store.
  • • Our hosting and database providers: where your account and results are stored.

How we protect the data

  • • Encryption in transit: all traffic between your browser and Rutbot, and between Rutbot and Google, store platforms and our providers, uses HTTPS with TLS 1.2 or later.
  • • Encryption at rest: the database and its backups are encrypted at rest (AES-256) by our database provider.
  • • Sensitive data (Google tokens and store access tokens and keys): kept in tables that neither the browser nor the signed-in user's own database role can read. Only our server reads them, with a secret service key; they are never sent to the browser or written to logs.
  • • Isolation: Row Level Security in the database limits every user to their own data, and each store's data is kept separate.
  • • Sessions and sign-in: sessions live in secure cookies (HttpOnly, Secure, SameSite=Strict) that scripts cannot read, with protection against guessing (attempt limits, CAPTCHA and temporary lockout), a strong password policy checked against known breaches, and two-factor authentication available to every account.
  • • Least privilege: we request read-only access from Google, and from store platforms only the permissions needed to change products after you approve.
  • • Internal access: only a small number of our team can reach the data, when needed to run the service or at your request, and the admin area requires two-factor authentication. No one reads your Google data except with your consent, for security, or to comply with law.
  • • We never use Google data to train any AI model, and we do not send it to a provider that trains on it.
  • • If a security incident affects your data, we notify you and the relevant authorities as required by law, and explain what happened and what we did.

Your rights

  • • See and edit your data: all your account data and tasks are shown in the dashboard and you can edit them.
  • • Delete your data: ask us to delete your account and data, and we delete them within 30 days of your request.
  • • Revoke store access: remove Rutbot from the apps settings of your store platform.
  • • Object to a specific use: write to us from the contact page and we will explain exactly what we use.

How long we keep data

  • • Account data and results: as long as the account is open, and for 30 days after a deletion request.
  • • Contact messages: for 12 months from the date of our reply.
  • • History of changes applied to your store: kept so you can undo any change.

Children

  • • The service is for store owners and their teams and assumes users are adults. We do not knowingly collect children's data.

Changes to this policy

  • • If we change anything material, we notify you before the change takes effect. The last-updated date is shown at the top of the page.

Any request about your data reaches us from the contact page or at [email protected], and we reply within 30 days.