سياسة الخصوصية

Privacy Policy (English summary)

Last updated: November 2, 2026. Rutbot (رتبوت) is operated at https://rutbot.app.

• • What we collect: your account details (email, name, optional phone, country), your store URL and product data read from Salla, the results of our checks, and messages you send us.
• • Google user data: if you connect your Google account we request two read-only scopes, webmasters.readonly (Search Console) and analytics.readonly (Google Analytics), plus your account email. We read your Search Console sites with their queries, pages, clicks, impressions and average position, and your GA4 landing-page sessions and purchases.
• • How we use it: only for features you see: your store's real search and traffic performance inside Rutbot, prioritising SEO fixes, suggesting a keyword for each product, and the before/after comparison of pages Rutbot changed. We never write to or change your Google accounts.
• • Sharing (data transfer): when you ask Rutbot to suggest keywords for a product, the search queries that brought visitors to that product's page (from Search Console, no personal data) are sent to two service providers only to complete that request: our AI provider (the paid Google Gemini API), which picks the queries that fit the product, and our search-volume provider (DataForSEO), which returns their monthly search volume. Neither uses this data to train AI models. Google user data is not shared with anyone else.
• • No sale, no ads: Google user data is not sold and not used for advertising. Humans do not read it except with your consent, for security, or to comply with law.
• • Storage: OAuth tokens are stored server-side only and never exposed to the browser. Search Console and Analytics reports are fetched on demand and not stored, except per-page click and impression totals for pages Rutbot changed, kept to show you the before/after comparison.
• • Revoking and deletion: use “Disconnect” in the Google tab of the dashboard (we revoke the token with Google and delete it, together with the stored before/after totals), or revoke at myaccount.google.com/permissions. You can ask us to delete your account and data from the contact page or at [email protected]; we delete it within 30 days.
• • Limited Use: Rutbot's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

• • Encryption in transit: all traffic between your browser and Rutbot, and between Rutbot and Google, store platforms and our providers, uses HTTPS with TLS 1.2 or later.
• • Encryption at rest: the database and its backups are encrypted at rest (AES-256) by our database provider.
• • Sensitive data: Google OAuth tokens and store access tokens and keys are kept in tables that neither the browser nor the signed-in user's own database role can read. Only our server reads them, with a secret service key; they are never sent to the browser or written to logs.
• • Isolation: Postgres Row Level Security limits every user to their own rows, and each connected store's data is kept separate.
• • Accounts and sessions: sessions live in HttpOnly, Secure, SameSite=Strict cookies that scripts cannot read; sign-in is protected by rate limits, CAPTCHA and temporary lockout, passwords must be strong and are checked against known breaches, and two-factor authentication is available to every account.
• • Least privilege: read-only Google scopes; store platform permissions only for the product changes you approve.
• • Internal access: limited to the few team members who need it to run the service or help you, and the admin area requires two-factor authentication. No one reads your Google user data except with your consent, for security, or to comply with law.
• • No AI training: Google user data is never used to train AI models, and is only sent to an AI provider whose terms exclude training on it (see Sharing).
• • Incidents: if a security incident affects your data, we notify you and the relevant authorities as required by law and explain what happened and what we did.
• • Other processors: Salla, Zid, WooCommerce and EasyOrders (store data, with your consent), AI model providers (product text only, to draft suggestions), and our hosting, database and network providers (Railway, Supabase, Cloudflare).