Privacy Policy

This Privacy Policy describes how WebsiteCoach SaaS ("WebsiteCoach", "we", "us", or "our") collects, uses, processes, and shares your personal data when you access and use the https://websitecoach.com website, its subdomains, and our automated website auditing, performance analysis, and e-learning services (collectively, the "Service"). WebsiteCoach SaaS is the controller of Personal Data it collects for the Service unless a customer agreement or Data Processing Agreement states otherwise. Our contact page is the primary channel for privacy requests, controller contact details, and any applicable EU/UK representative or Data Protection Officer information. By accessing or using the Service, you acknowledge that you have read and understood the practices detailed in this Privacy Policy.

We collect information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("Personal Data"). The categories of information we collect include:

Account Information

When you register for an account, we collect your name, email address, authentication method, and account settings. For email/password accounts we store password authentication data in protected form; for Google sign-in we receive basic OAuth profile information from Google.

Service Data (User Inputs)

We process the URLs, domain names, API requests, report payloads, search queries, API token metadata, and domain crawl settings you submit to the Service. Domain crawl settings may include custom HTTP headers that you or an administrator configure so WebsiteCoach can access sites protected by firewalls or bot controls. This data is used to generate requested reports and is retained only as described in Section 6.

Automatically Collected Usage Data

When you interact with the Service, we automatically gather certain metadata and usage information via privacy-respecting analytics. This includes pages visited, features utilized, session duration, browser type, and diagnostic data.

We strictly limit the use of your Personal Data to the following purposes:

Service Provision

To operate, maintain, and provide the core functionalities of our automated audit and e-learning services.

Communication

To send you necessary transactional and administrative emails, such as account verifications, password resets, billing notices, and security alerts.

Product Improvement

To analyze aggregate, anonymized usage patterns to troubleshoot issues, enhance the user interface, and optimize the overall performance of the Service.

Security and Compliance

To detect, prevent, and mitigate fraudulent or unauthorized activities, and to enforce our Terms of Service.

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), our legal basis for collecting and using your Personal Data depends on the context in which we collect it:

Performance of a Contract

Processing is necessary to fulfill our obligations under the Terms of Service.

Legitimate Interests

Processing is necessary for our legitimate business interests, such as improving our Service and ensuring its security, provided these interests are not overridden by your fundamental rights and freedoms.

Consent

Where applicable, we may rely on your explicit consent to process specific data.

Purpose-by-Purpose Basis

Account registration, authentication, report credits, paid services, and requested audit reports are processed to perform our contract with you. Security, fraud prevention, diagnostics, abuse prevention, service reliability, and product improvement are processed based on legitimate interests. Analytics, advertising, remarketing, and non-essential cookies are processed only with consent. Tax, accounting, sanctions, dispute, and legal-request handling are processed to comply with legal obligations.

Controller, DPO, and Representative Details

WebsiteCoach SaaS is the controller for account, billing, website, analytics, and marketing data that we determine how to process. If applicable law requires a Data Protection Officer or EU/UK representative, we will identify that role through our contact page or customer documentation.

Supervisory Authority Complaints

EEA and UK users may lodge a complaint with their local data protection authority. We encourage you to contact us first so we can try to resolve the concern directly.

We do not sell your Personal Data for money. We engage trusted service providers and sub-processors who process Personal Data on our behalf under written agreements requiring confidentiality, security, and appropriate data-protection safeguards. The current sub-processors and data recipients are:

International Transfers

If you are located in the European Economic Area, the United Kingdom, or Switzerland, your Personal Data may be transferred to sub-processors in countries such as the United States, Singapore, and Estonia. These transfers rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission and, where applicable, adequacy decisions or the EU-U.S. Data Privacy Framework. You may request information about the relevant safeguards through our contact page.

Legal Requirements

We may disclose Personal Data when required by law, court order, subpoena, or governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of WebsiteCoach, our users, or the public.

We retain your Personal Data only for as long as is strictly necessary to fulfill the purposes outlined in this Privacy Policy:

Audit Results

Generated audit reports and related technical data are retained for a maximum of thirty (30) days unless you save them in your account or a longer period is required by law, after which they are deleted from active systems according to our retention process.

Temporary Page Fetches

Raw fetched or browser-rendered page HTML is used during the audit session. For fresh scans, we may store a limited HTML snapshot with the report and display it to the user for diagnostic transparency, including schema, HTML, and page-quality verification. These snapshots follow the same report-retention rules as audit results unless saved in an account or required for security, abuse prevention, billing, or legal reasons.

Domain Intelligence Cache

Domain analytics, RDAP/WHOIS-derived registration details, DNS, reputation, and similar third-party lookups may be cached for seven (7) days. Report refreshes and credit-based scans do not bypass this cache for paid domain intelligence; this reduces duplicate third-party API requests and improves service reliability.

Billing and Tax Records

Purchase, credit-grant, subscription where applicable, invoice, tax, and payment metadata are retained for the periods required by tax, accounting, chargeback, anti-fraud, and legal obligations.

Account Data

Your name, email, and authentication data are retained for the lifespan of your account. Upon your request for account deletion, this data is permanently erased, subject to any legal obligations requiring extended retention.

Consent and Preference Records

Cookie consent, advertising preferences, Global Privacy Control signals, and related compliance logs are retained as needed to honor your choices and demonstrate compliance.

We use cookies and similar storage technologies (such as localStorage) on the Service. We classify them into three categories. You can manage your preferences at any time using the cookie banner or the “Cookie settings” link in the footer of every page.

Strictly Necessary

Required for core functionality, including session authentication, login state, security and fraud prevention, and remembering your language preference. These technologies cannot be disabled and do not require your consent under applicable law.

Analytics (opt-in)

When you opt in, we use Ahrefs Analytics to measure aggregate, privacy-respecting usage — such as pages visited, broad device categories, and session duration — to understand how the Service is used and improve it. No analytics scripts are loaded without your consent.

Advertising (opt-in)

When you opt in, we use Google Ads (gtag.js, tag ID AW-18117490664) to measure conversions from our advertising campaigns and to build remarketing audiences. Without your consent we operate Google Consent Mode v2 in a default-denied state, meaning Google receives anonymized signals only and does not write advertising identifiers to your device. Google’s practices are described at https://policies.google.com/privacy.

Depending on your location and the laws that apply to you, including the GDPR, UK GDPR, and CCPA/CPRA, you may have the following rights regarding your Personal Data:

California Notice at Collection

For California residents, the categories collected may include identifiers, account and billing information, commercial information, internet or network activity, approximate location derived from IP address, submitted URLs/domains, API token metadata, domain crawl settings, audit-report inferences, and sensitive personal information only where needed for account security or payment processing by Stripe. Sources include you, your browser or device, payment/login providers, security and audit providers, and public web, DNS, RDAP, and WHOIS records. We use these categories for service delivery, billing, security, analytics with consent, advertising with consent, legal compliance, and product improvement. We disclose them to the sub-processors listed in Section 5. We do not sell Personal Data for money; advertising or remarketing with consent may be considered sharing under California law. Retention is described in Section 6.

Right to Access

You may request a copy of the Personal Data we hold about you.

Right to Rectification

You may request that we correct any inaccurate or incomplete Personal Data.

Right to Erasure ("Right to be Forgotten")

You may request the deletion of your Personal Data, subject to certain exceptions.

Right to Restrict Processing

You have the right to request that we limit the processing of your data under certain conditions.

Right to Data Portability

You may request your data in a structured, commonly used, and machine-readable format.

Right to Object or Opt Out

You may object to processing based on legitimate interests and may opt out of sale, sharing, targeted advertising, or remarketing where those rights apply. We honor supported Global Privacy Control signals and cookie choices where required by law.

Sensitive Personal Information

We do not use sensitive personal information to infer characteristics. Where California law applies, you may limit the use and disclosure of sensitive personal information to purposes necessary to provide the Service and comply with law.

Authorized Agents

Where applicable, you may authorize an agent to submit a privacy request on your behalf. We may ask for information needed to verify your identity and the agent's authority.

Appeals and Complaints

If we deny your request, you may appeal where applicable law provides that right. You may also complain to your data protection authority or other privacy regulator.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights, although some Service features may require data that is necessary to provide them.

To exercise any of these rights or request transfer safeguards, please use our contact page.

We implement commercially reasonable technical and organizational measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. However, no method of transmission over the Internet or electronic storage is entirely secure, and we cannot guarantee absolute data security.

We reserve the right to update or modify this Privacy Policy at any time. We will notify you of any material changes by updating the "Last Updated" date at the top of this document or by sending a direct notification to the email address associated with your account. Continued use of the Service following such updates constitutes your acknowledgment of the revised Privacy Policy.

If you have questions, concerns, legal notices, or requests regarding this Privacy Policy or our data practices, please use our contact page: