Privacy Policy
Last updated: 19 September 2026
This page explains which personal data we process when you visit traffalyzer.com, use Traffalyzer or when we contact you, why we do so, on which legal basis, who receives the data and how long we keep it.
1. Controller
Santos Cid & Fischer GbR represented by the partners Nikolai Fischer and Andre Santos Cid Greveler Straße 39, 44329 Dortmund, Germany Phone: +49 231 570 265 7 Email: info@traffalyzer.com We have not appointed a data protection officer because we are not legally required to do so. For any data protection questions, you can reach us at the email address above.
2. Overview
• When you visit the website: technical access data and necessary cookies (sections 3 and 4). • When you use the free check: the address checked, a fingerprint of your IP address and, if you wish, your email address (section 5). • When you create an account and use Traffalyzer: account, usage and content data (sections 6, 7 and 9). • When you connect data sources: access credentials and metrics of your website (section 8). • When you receive emails from us: email address, sending and delivery data (sections 10 and 11). • When you book a subscription: billing and payment data (section 13). • When you use the API, MCP or our modules: keys, call logs and data from your content management system (section 14). • When we contact you as a business: company and contact data from public sources (section 15). • When you consent to analytics: usage and conversion data for Google Analytics and Google Ads (section 16).
3. Hosting and access data
The website and application are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. With every request, Vercel processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system as well as status codes. Without this data, the site cannot be delivered or protected against attacks. Vercel processes the data in data centres in the EU or the USA and keeps access logs only briefly, for no more than 30 days. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation. Vercel is our processor. For transfers to the USA, see section 19.
5. Free website check
When you check an address, we process: • the address of the website checked and the result of the check, • a fingerprint of your IP address (hash value with a secret key) so that nobody can trigger the check on a mass scale. We do not store the IP address itself, • where the check came from (homepage, knowledge article, external link), • campaign information from the link (utm parameters). With your consent (section 16), your browser keeps it for the session, and we additionally store the Google click ID. Without consent, your browser stores nothing and only transmits the utm parameters of the address currently open; we store these with the check as information on where it came from, • the goals you select on the results page, • if you wish, your email address when you use it to unlock the full result. We then create an account (section 6). For the check, our crawler requests the page, the robots.txt and the sitemap. The address is sent to Google PageSpeed Insights (Google Ireland Limited) to measure loading times. Anthropic (section 9) creates a growth plan from the result. For this we transmit technical findings and page content, not data about you. Legal basis: Art. 6(1)(b) GDPR (you request the check), (f) (protection against abuse and evaluating which routes lead to us) and, for the Google click ID and the campaign information stored in your browser, (a) (consent). Retention: 90 days after the check, we delete the fingerprint of your IP address, the Google click ID and the raw data of the check. We delete the email address at the same time unless there is an account with that address; section 6 then applies. What remains is a record without personal reference that we use for statistics.
6. Account and sign-in
For your account, we process your email address, your language and the times of sign-up and of your last activity. If you sign in with Google, we also receive your name and profile picture from Google (Google Ireland Limited; scope: email address and basic profile). Account and sign-in are managed by Supabase, Inc. as our processor. The database is located in a data centre in London, United Kingdom. We send sign-in links and codes via Brevo (section 10). To prevent abuse of the sign-in process, such as mass mailings to other people's inboxes, we store the address, a fingerprint of your IP address, the origin of the request and the sending result for every sign-in email requested. Supabase logs sign-in events with IP address for a limited time for security purposes. Legal basis: Art. 6(1)(b) GDPR (user contract) and (f) (protection against abuse). Retention: account data until the account is deleted, logs of sign-in emails 90 days. If you delete your account, we also delete your domains, conversations and MCP logs, your contact at Brevo and your email address from earlier free checks. Invoices are kept as set out in section 13.
7. Using Traffalyzer
When you add domains, we process scan results, findings, suggestions, plans, quests, completed actions and your settings. For this, our crawler requests the publicly accessible pages of your domain. It identifies itself as Traffalyzer and is described on the crawler page. Content of your website: If your pages contain personal data, such as names in the team section, we process it on your behalf. You are then the controller, and we act under the data processing agreement. Legal basis for your own data: Art. 6(1)(b) GDPR. Retention: until you delete the domain, the subscription for it ends (terms § 8) or you delete your account.
8. Connected data sources
If you connect Google Search Console or Google Analytics 4, we receive read-only access via Google's sign-in procedure (OAuth) and store the access tokens in our database. We retrieve metrics of your website: clicks, impressions, positions, search queries, page views and bounce rates. For Plausible, Fathom and Matomo, we store the API key you give us and use it to retrieve metrics. This data consists almost always of aggregated values without reference to individual visitors. Where it is personal in individual cases, such as a name in a search query, we process it on your behalf. You can disconnect any connection at any time. We then delete the access credentials. Metrics already retrieved remain stored until the domain is deleted. Google data: Traffalyzer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide Traffalyzer's features to you, not for advertising, not to train general AI models and not for statistical evaluations under terms § 13. If you ask the AI assistant about your search data, we transmit the values needed for this to Anthropic (section 9). Legal basis: Art. 6(1)(b) GDPR.
9. AI features
For the AI assistant, the growth plan, wording suggestions, quests and translations, we use language models from Anthropic, a provider based in the USA. Depending on the feature, we transmit: • your questions to the assistant and the conversation so far, • data the assistant retrieves to answer: findings, page data, metrics, Search Console queries and your plan, • content and findings of scanned pages for the plan and suggestions, • texts we have translated. Anthropic processes the data as our processor, keeps inputs and outputs only for a limited time under its terms for API customers and does not use them to train its models. We store your conversations until the domain is deleted or you delete your account. Legal basis: Art. 6(1)(b) GDPR. For transfers to the USA, see section 19.
10. Emails
We send emails via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) as our processor. Brevo processes your email address, the content of the email and delivery data (delivered, bounced, reported as spam). We log sent messages with recipient, type and status so that we can trace what we have sent you and avoid sending anything twice (Art. 6(1)(f) GDPR). We delete this log together with your account. • Necessary emails (sign-in links and codes, payment notices, cancellation reminders): Art. 6(1)(b) GDPR. • Product emails (scan results, weekly reports, alerts about deterioration, success messages about your domains): part of the service, Art. 6(1)(b) GDPR. • Tips and offers (introductory series after sign-up, notes on Pro features): We use your email address to inform you about our own similar services (§ 7(3) UWG, Art. 6(1)(f) GDPR; legitimate interest: direct marketing). We point out your right to object when you sign up and in each of these emails. You can object to this at any time via the unsubscribe link in each of these emails or by email to info@traffalyzer.com, without incurring any costs other than transmission costs at basic rates. The unsubscribe link works without signing in, including as one-click unsubscribe directly in your email program. It stops all emails about your domains, meaning weekly reports, success messages and alerts as well as tips and offers, because there is one shared switch for them. You will still receive necessary emails such as sign-in links and payment notices. Contact management at Brevo: We keep your account as a contact at Brevo with information such as language, number of your projects, sign-up date and whether you are or were a customer. This lets us choose suitable emails and, for example, not send Pro offers to customers who already have Pro. Legal basis: Art. 6(1)(f) GDPR. If you delete your account, we also delete the contact at Brevo.
11. Report recipients
Account holders can add other people who should receive reports about a domain. The person added first receives a confirmation email from us. We only send reports once they click the link in it (double opt-in). The link is valid for 14 days. As proof, we store the time and IP address of the confirmation and who added the person. We are responsible for this processing ourselves. Legal basis: your consent (Art. 6(1)(a) GDPR), for the proof Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. You can withdraw your consent at any time via the unsubscribe link in every email. This does not affect the lawfulness of processing before the withdrawal. We keep the entry including the proof for as long as the domain exists and delete it together with the domain or the account it belongs to.
12. Invitations
If we personally invite someone to Traffalyzer, we process the invited person's name and email address to send the invitation and to unlock access when it is accepted. Legal basis: Art. 6(1)(f) GDPR (contacting people we are already in touch with). We keep accepted invitations with the account. We delete invitations that have not been accepted no later than twelve months after sending.
13. Payments
Billing is handled by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). During checkout, you enter payment data, billing address and optionally your VAT identification number directly with Stripe. From this we receive the customer number, subscription status, invoice data and the type of payment method, not full card or account details. Stripe processes the data for payment processing on our behalf and for fraud prevention and legal obligations under its own responsibility (Stripe privacy policy: stripe.com/privacy). Legal basis: Art. 6(1)(b) GDPR (subscription) and (c) (tax and commercial law). We keep invoices and accounting records for ten years (§ 147 AO, § 257 HGB), even if you delete your account earlier.
14. API, MCP and modules for content management systems
• API keys: We store only a hash value and a prefix, plus the time of last use and the client name sent (user agent, for the WordPress plugin including the address of your website). • MCP: Sign-in works via OAuth with your Traffalyzer account. For each call, we log the tool, the parameters passed, the domain concerned, the result, the duration and the name of the connected program so that we can trace usage and errors. We do not see your question to your AI assistant. We delete the logs after 90 days. • Drupal module and WordPress plugin: The module transmits addresses, publication and indexing status, content types and modification data of your pages as well as editing events, for the Drupal module also the revision note if one is set. This is data from your system that we process on your behalf. The module does not transmit authors' names. • Connected AI assistants and systems: If you connect a third-party system via the API or MCP, we transmit the retrieved data to that system. You initiate this transfer. The system is subject to its provider's terms. Legal basis: Art. 6(1)(b) GDPR, for the logs (f) (operation, abuse protection, troubleshooting).
15. Contacting businesses (cold outreach)
We approach businesses to offer them a free website analysis. If you received such an email from us, this section explains where the data came from and how to object. You can object to the processing of your data for advertising purposes at any time. We will then no longer process it for this purpose. The unsubscribe link in the email is enough: one click, no confirmation needed. Alternatively, write to info@traffalyzer.com. Where the data comes from: We became aware of your business through the openly licensed OpenStreetMap dataset (ODbL, openstreetmap.org/copyright). We took the contact address from the imprint of your own website. We do not buy address lists and do not scrape social networks. We only use role addresses (such as info@ or kontakt@). Personal addresses of the firstname.lastname@ pattern are not stored in plain text, only as a checksum, so that a re-check does not process them again. Categories of data: Company name, legal form, address, phone number, website, the imprint email address, where applicable the representative named in the imprint, plus the technical result of our website analysis and the contact history. Your website: For the analysis, our crawler with the identifier Traffalyzer-Prospect requests a few publicly accessible pages of your website, like a visitor (see the crawler page). Purpose and legal basis: A single contact regarding a free website analysis. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in direct marketing, recital 47). Recipients: Brevo (sending, EU), Supabase (database, data centre in London, United Kingdom), Vercel (hosting, USA, see section 19), our own instance of Trigger.dev on servers of Hetzner Online GmbH (background processing, Germany), and Google PageSpeed Insights, which only receives the public address of your website. To Anthropic we transmit only a sector label, a city and a technical finding code in order to phrase a single sentence, no personal data, no company name and no contact details. Retention: Businesses we never contacted are deleted six months after discovery. Contacted businesses are deleted six months after the last contact. Analysis results older than twelve months are removed, and public analysis pages expire after 90 days. Suppression list: If you object, we store your email address and your domain permanently on a suppression list, solely so that we do not contact you again. Deleting that entry would defeat the very purpose of your objection. Your rights: You have the right to information, rectification, erasure, restriction of processing, data portability and to lodge a complaint with a supervisory authority (section 23). Location data © OpenStreetMap contributors (ODbL).
16. Analytics and ad measurement with consent
Only if you choose "Accept all" in the cookie banner do we use: Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): GA4 records which pages you visit, how you move around the website, device, browser, approximate location and certain events such as sign-up and booking. GA4 does not store IP addresses. Cookies: _ga and _ga_ with our property identifier, lifetime up to two years. Google deletes event data after the retention period we have set, no more than 14 months. Google Ads conversion tracking with enhanced conversions (Google Ireland Limited): We measure whether visitors who come via an ad sign up or book a subscription. Cookie: _gcl_au, lifetime 90 days. When you purchase, we transmit the amount, currency and a transaction ID and additionally your email address in hashed form (SHA-256) so that Google can attribute the purchase to an ad click. We do not transmit an email address when you sign up. If you arrive via an ad or a campaign link, we store the Google click ID and the campaign information with your website check so that we can distinguish paid from unpaid visits. We use Google's consent mode (Consent Mode v2). Personalised advertising is switched off: we do not use your data for remarketing or ads tailored to you. Google also processes this data in the USA (section 19). Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future via the cookie settings at the end of this page. If you withdraw it, we delete the click ID and campaign information stored in your browser. Click IDs already stored with a check are deleted after 90 days (section 5), or earlier on request.
17. Internal notifications
We notify ourselves of new sign-ups, bookings and free checks by push message to our mobile phones via the ntfy.sh service. For a free check, the message contains the address of the website being checked, so we can see which website is being checked; otherwise only the type of event, the type of origin, counters and the plan. The messages never contain email addresses, IP addresses, names or click identifiers. If the checked website belongs to an individual, its address may be personal data; the legal basis is then our legitimate interest in responding promptly (Art. 6(1)(f) GDPR). ntfy.sh stores messages only briefly for delivery.
18. Background processing and database
Scans, email sending and other scheduled tasks run on our own instance of Trigger.dev on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. The database is operated by Supabase (section 6). Both are our processors.
19. Recipients and transfers to third countries
• Vercel Inc. (hosting): processor, USA; processing in the EU or the USA. • Supabase, Inc. (database, sign-in): processor; database in London, United Kingdom, for which an adequacy decision of the EU Commission applies. • Hetzner Online GmbH (background processing): processor, Germany. • Sendinblue GmbH (Brevo; email sending, contact management): processor, EU. • Anthropic (AI features): processor, USA. • Google Ireland Limited and Google LLC (sign-in with Google, Search Console and Analytics connection, PageSpeed, with consent Analytics and Ads): partly processor, partly independent controller; Ireland and USA. • Stripe Payments Europe, Limited (payments): partly processor, partly independent controller; Ireland, with processing also at Stripe, Inc. in the USA. • ntfy.sh (internal notifications): receives no personal data. • Plausible, Fathom and Matomo: only if you connect them; at your request, we retrieve your metrics there. Where data is transferred to the USA or another country outside the EU and the EEA, this is based on the adequacy decision for the EU-US Data Privacy Framework to the extent the recipient is certified under it, and otherwise on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR). We have concluded agreements under Art. 28 GDPR with our processors. You can obtain a copy of the standard contractual clauses on request.
20. Retention at a glance
• Account, domains, scans, chats: until you delete them; cancelled domains after the end of the paid period • free check: personal data 90 days, afterwards only without personal reference • logs of sign-in emails: 90 days • log of sent emails: until the account is deleted • MCP call logs: 90 days, at the latest with the account • report recipients with proof of consent: until the domain or account is deleted • invitations not accepted: no more than twelve months • invoices and accounting records: ten years • cookie choice: 180 days • cold outreach: see section 15
21. Do you have to give us data?
For the free check, we only need the address of the website. For an account, we need your email address, for a subscription the billing and payment data. Without this information we cannot conclude the respective contract. All other information is voluntary. There is no legal obligation to provide us with data.
22. Automated decisions
We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Scores and suggestions assess websites, not people.
23. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). This does not affect the lawfulness of processing before the withdrawal. Write to us at info@traffalyzer.com. Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. Where we process data for direct marketing, you can object at any time without giving reasons. We will then no longer process it for this purpose. You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
24. Changes
We update this privacy policy when our service or the legal situation changes. The version published here applies. This is a translation for your convenience; in case of doubt, the German version prevails.
Change cookie settings
You can withdraw or change your consent to Google Analytics and Google Ads at any time.