Data controller

Septeo Digital Services, a division of Septeo SAS.
19 rue Marc Seguin, 34000 Montpellier, France.
SIRET: 450 811 443 00040
DPO contact: [email protected]

1. Data collected

When using GEO-Auditor, we collect :

Scan invite (without account): URL of the site scanned only. No personal data. Ephemeral results, not stored.
Registration: email address (encrypted via Fernet, AES-128-CBC + HMAC), password (bcrypt hashed).
In-depth audit request: name, email, telephone (encrypted via Fernet, AES-128-CBC + HMAC), site URL, message.

2. Purpose and legal basis

Provision of the GEO audit service - analysis of the site, generation of the report and recommendations. Legal basis: performance of the contract (art. 6.1.b RGPD).
User account management - registration, authentication, audit history. Legal basis: performance of the contract.
Sending transactional emails - email verification, password reset, audit notifications. Legal basis: contract performance.
Commercial contact - only with explicit consent (separate checkbox on registration). Legal basis: consent (art. 6.1.a RGPD).
Usage statistics - anonymised audience measurement via Google Analytics. Legal basis: consent (via Axeptio cookies banner).
Service security - logging of connection attempts, anti-abuse protection. Legal basis: legitimate interest (art. 6.1.f RGPD).

3. Shelf life

Active accounts: account lifetime
Audit results: retained as long as the account is active, deleted with the account
Deleted accounts: immediate deletion (personal data + audits)
Leads (contact requests): 24 months maximum
Connection logs: 12 months (legal obligation)
Guest scans (no account): ephemeral results, not retained beyond the session

4. Your rights (RGPD)

In accordance with the RGPD, you have the following rights:

Access: consult your data from "My account"
Rectification: change your information
Deletion: delete your account and all your data
Portability: export your data in JSON format
Opposition: withdraw your consent at any time

5. Sub-contractors and recipients

As part of the service, certain data may be transmitted to the following service providers:

Brevo (Sendinblue) - transactional emails (verification, notifications). Hosting: France.
Google - APIs PageSpeed, Places, Gemini (AI analysis). Hosting: United States.
OpenAI - AI analysis and recommendations. Hosting: United States.
Perplexity - AI answer engine queried to measure the site's visibility. Hosting: United States.
Infomaniak - application hosting. Hosting: Switzerland (EU adequacy decision).
Cloudflare - DDoS protection and CDN. Hosting: global network.

Only the data strictly necessary for each processing operation is transmitted. No personal data (email, password) is sent to the AI analysis services: only the publicly accessible content of the audited sites is processed.

6. Transfers outside the European Union

Some subcontractors (Google, OpenAI, Perplexity, Cloudflare) are located in the United States. These transfers are governed, depending on each subcontractor's certification, by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or, failing that, by the European Commission's standard contractual clauses.

7. Security

Personal data is encrypted with Fernet (AES-128-CBC + HMAC). Passwords are hashed using bcrypt. Communications are encrypted using HTTPS. Access to data is restricted to authorised administrators.

8. Cookies

GEO-Auditor uses the following categories of cookies:

Essential cookies: authentication session (JWT), language preferences. Always active.
Analytics cookies: Google Analytics (GA4) for anonymised usage statistics. Subject to your consent via the Axeptio banner.

You can change your cookie preferences at any time by clicking on the Axeptio widget at the bottom of the page.

9. Contact DPO

To exercise your rights or if you have any questions:
Email : [email protected]

Privacy policy