Política de privacidade

Version: publication date

This policy applies to the website zu prüfen: production domain of mavirank, the mavirank app on the same address, the public SEO tools and the public reports, which appear on an address of their own (reports.…) or on a customer’s domain (together: “mavirank”). mavirank is an SEO service: you have web pages checked for on-page SEO, technical quality and security (audits), have websites checked on a schedule and through their sitemap, share the results as a report, get notified through channels you choose, can connect Google Search Console, have AI summaries generated and analyze the access logs of your web server. We only process the data that is needed for this. There is no tracking and there are no analytics tools.

Controller

Global Solutions Systems GmbH, Bessemerstraße 51, 1st floor, 12103 Berlin, Germany, represented by the managing director Ünal Aydin.
E-mail for data protection questions: info@global-solutions-systems.com

We have not appointed a data protection officer; there is no obligation to do so (Section 38(1) BDSG, fewer than 20 persons constantly engaged in automated processing). For all data protection questions you can reach us at the address above.

Our two roles

Our own responsibility. We are the controller for the data of your account, for sign-in, memberships, billing, system e-mails, the logs of our own servers, protection against abuse and the use of the public tools without an account.

Processing on behalf. For the content your organization has processed in mavirank, your organization is the controller: audited addresses and audit results, reports, notification contacts, data from Google Search Console, AI summaries and the log data of the log analysis. We process it as a processor only on instruction and not for our own purposes. The details are set out in our data processing agreement (Art. 28 GDPR). This policy describes what happens technically; informing the persons whose data appears in audited pages, reports or logs (for example the visitors of your website) is the task of your organization.

What data we process and why

Server logs of the platform

When you open mavirank (website, app, tools or a report), our web server processes technically necessary data: IP address, date and time, the address requested, status code, amount of data transferred and the identifier of your browser. We need it to deliver the pages, find errors and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). The log data is deleted after 14 days at the latest OFFEN-4: confirm the retention of server logs. At sign-in, at the public tools, when a password-protected report is unlocked and at the API we keep IP addresses for a short time to limit abuse and password guessing (rate limits; legal basis also Art. 6(1)(f) GDPR).

These logs of our own servers are something different from the logs customers deliver from their servers for the log analysis (section “Log analysis”).

Cookies and local storage

mavirank only sets cookies and entries in your browser’s local storage that are needed for operation: your sign-in cookie, a cookie for live updates in your organization, your language, your appearance (light/dark, color), the organization you opened last and the record of your choice in the cookie dialog. The full list with purpose and duration is in the cookie settings (button at the bottom left of every page). When you unlock a password-protected report, the report address sets a short-lived cookie that is valid for this report only and remembers that the password was correct; the report address receives no cookies of the app. The legal basis is Section 25(2) no. 2 TDDDG (technically necessary for the service you asked for) and Art. 6(1)(f) GDPR. We do not need consent for these entries; we show you the dialog anyway so that you can see what is stored. We do not use statistics or marketing cookies.

Account, organization and members

When you register, we process your e-mail address, your name, your password (as a hash only, never in plain text), your language, the name of your organization, and memberships and roles (Owner, Admin, Member, Viewer). Added to this are sign-in sessions, invitations to further members (e-mail address of the invited person, role, inviting member), which version of the legal texts was accepted for the organization and when, and, if you set them up, API tokens (stored as a hash only). Platform administrators additionally sign in with a second factor. We process this data to provide your account and perform the contract (Art. 6(1)(b) GDPR) and to keep the service secure (Art. 6(1)(f) GDPR). We delete unconfirmed accounts after 72 hours.

Access by platform administrators to customer data, for example in a support case, and security-relevant actions of members (for example issuing and revoking API tokens and collector tokens, connecting and disconnecting Google Search Console, state changes of custom domains) are recorded with the acting account, time and IP address in an audit log (legal basis Art. 6(1)(f) GDPR: evidence of interventions with far-reaching rights and defence against abuse); we delete the entries after two years. This audit log is a record of actions in mavirank and has nothing to do with the SEO audits.

Audits, websites and crawling

When you create an audit, we store the address of the page to be checked and your settings for it (for example additional headers, credentials for HTTP basic authentication, timeout, expected status code; headers and credentials encrypted). When you create a website, we additionally store its hostname, the audit intervals, the address of the sitemap and the addresses found there.

Our crawler then fetches the page from our servers: the page itself, redirects and a few secondary requests (such as robots.txt, the sitemap, the favicon, a deliberately non-existent address to check the error page). It identifies itself with its own, honest identifier as MavirankBot; the operator of the audited page sees the IP address of our servers and this identifier. The crawler only fetches publicly reachable addresses; private networks and internal addresses are blocked.

From the fetch we produce the audit result: status code, redirect chain, response times, size, details of encryption and certificate, response headers and, per test, the evaluated values (for example title, description, headings, word count, links, images without alternative text), the score and the list of findings. We do not store the audited page as a copy, but evaluated values that are limited in length and number. These values can contain personal data if the audited page shows it publicly: one test, for example, reports e-mail addresses in the visible text of the page and stores up to ten examples of them; addresses, titles and headings can contain names as well.

Your organization is the controller for this data, we are the processor (see “Our two roles”). Please only audit pages you are allowed to audit.

Retention depends on your plan: audits with their history 30, 90, 365 or 730 days, archived audits 30, 365, 730 or 1,825 days (Free, Starter, Pro, Agency); after a change to a smaller plan these periods keep the higher value for 30 days. After that the data is deleted automatically. What you delete yourself is removed from the application immediately.

Reports and custom domains

You can share the result of an audit or a website as a report: publicly through a link or protected by a password. A public report can be read by everyone who knows the link; a protected one only after the password has been entered. We store the password as a hash only. The report shows only what has been shared and is marked as not to be indexed by search engines. On the Pro and Agency plans the report can carry your logo and colors and appear on a custom domain of your organization; for this we store the domain, the state of its verification through DNS records and the certificate issued for it.

Whoever opens a report produces server logs with us (see above) and, for protected reports, the cookie described above; we limit attempts to enter a password per IP address and report. We collect no further data about readers. Your organization is responsible for the content of a report and for the decision to publish it.

Public SEO tools

You can use the tools under /tools without an account. You enter an address, a hostname or a text; for tools that examine a third-party page, our crawler fetches that page as in an audit and shows you the evaluated result. We do not permanently store inputs and results of anonymous calls; per tool and day we only count how often it was used and how often a call was rejected.

To keep the tools from being abused, we limit the number of calls per IP address, per tool and per audited target; the IP address is processed briefly for this. From a certain number of calls on, your browser solves a small computing task before another call is accepted; the procedure runs on our servers, without a third-party service and without cookies. If you rate a tool, we store the rating together with a check value formed from your IP address and the day, so that only one rating per day counts; we do not store the IP address itself. The legal basis is our legitimate interest in providing the tools and protecting them against abuse (Art. 6(1)(f) GDPR). If you are signed in, the limits of your plan apply and the usage is attributed to your organization (Art. 6(1)(b) GDPR).

Some tools query third-party data sources (for example for details of an IP address or domain) OFFEN-24: data sources of the tools, providers and locations.

Notification channels

If you wish, we notify you when something changes in an audit or a website (new findings, a jump in the score, page not reachable) or when a quota is nearly used up. For this we process the contacts you enter as a channel: e-mail addresses, phone numbers (SMS, call), webhook addresses and identifiers for Slack, Discord, Microsoft Teams, Google Chat, Telegram (through your own bot zu prüfen: Telegram – the customer’s own bot or a bot of the platform) or ntfy (configuration stored encrypted), and we keep a delivery log (channel, event, time, result). A notification contains the name or address of the website or audit, the event, the time, the score and a link into the app. E-mail addresses outside your organization must confirm receipt first and can unsubscribe at any time.

You decide which services receive notifications; by setting up a channel you instruct us to send there. For webhooks and chat services the chosen service is your contractual partner, not our sub-processor; if it is located outside the EU, this is a transfer on your instruction, and you check its requirements. We deliver SMS and calls (Pro and Agency plans) through Twilio OFFEN-22: Twilio – contracting entity, processing location and transfer safeguard; we send e-mails through OFFEN-20: sending service for system and notification e-mails. We delete the delivery log and notifications in the app after 90 days. The legal basis is performance of the contract with you (Art. 6(1)(b) GDPR) or processing on your behalf (Art. 28 GDPR).

Google Search Console

An Owner or Admin can connect the organization to a Google account that has access to Google Search Console properties. The connection uses sign-in with Google (OAuth) with read-only access. We store the identifier and the e-mail address of the connected Google account, which member made the connection, the properties shared and the access token (encrypted). Through the connection we regularly retrieve, for the properties you assign to a website, the indexing status of individual addresses and search analytics figures (queries, clicks, impressions, position, by day, country and device) and show them in the app.

We use data from Search Console only to show and evaluate it for your organization in mavirank. We do not pass it on to AI providers, and we do not use it for advertising or for our own purposes. If you disconnect, we revoke the access at Google and delete the access token; data already retrieved stays until its retention ends or until you delete it. You can also revoke the access in your Google account at any time. Google is an independent controller for Search Console; the Google privacy policy applies. Your organization is the controller for the retrieved data, we are the processor; for the connection itself the legal basis is performance of the contract (Art. 6(1)(b) GDPR).

AI summaries

AI summaries are switched off by default. If an Owner or Admin switches them on for the organization, mavirank generates a summary of an audit or a website at the click of a button and, if additionally set so, when findings have changed. For this we send only the findings of the audit (test results with their evaluated values, including the audited address) to an AI provider and store its answer as structured text together with provider, model and usage. The default is Claude by Anthropic; depending on the setting of the platform or your organization, OpenAI or Gemini by Google is used. Not transmitted are data from Google Search Console, log data of the log analysis, account and member data, notification contacts, and stored credentials and headers.

The providers process the data on our behalf and outside the EU OFFEN-21: AI providers – contracting entities, processing locations and transfer safeguard per provider. Owners and Admins can switch AI summaries off again at any time; while they are switched off, we transmit no data of this organization to an AI provider. The summary is an automatically generated text and can contain errors. Your organization is the controller for the transmitted findings, we are the processor.

Ahrefs Domain Rating and Google Web Risk

For websites on plans with this feature we query the Domain Rating at Ahrefs at intervals; we transmit the hostname of the website for this. For the “Safe Browsing” test we ask Google (Web Risk) whether the audited address is known to be harmful; we transmit the address for this. In neither case do we transmit account or member data OFFEN-24: Ahrefs and Google Web Risk – contracting entities and processing locations.

Log analysis

For the log analysis your organization installs our collector on its web server. It reads the access logs and, if switched on, the error logs of the web server and delivers them to mavirank over an encrypted connection. The collector replaces IP addresses with a pseudonym on your server already; the pseudonym is formed from the address and a key that changes daily, and the key is created on your server and never leaves it. We receive no full IP addresses of visitors and cannot compute an address back from the pseudonym. The pseudonym changes daily, so a sender can only be recognized again within one day.

Delivered per request are: time, domain, method, path, status code, size, the pseudonym, the identifier of the requesting program (browser or bot), the referring address without parameters, whether it is a known bot and whether its origin is confirmed (the collector checks this with the real address before pseudonymization). Values of parameters in the address are masked by default because they can contain identifiers. For rejected scan requests the shortened network of the address can be included in addition (for IPv4 the first three blocks) to recognize attacker networks; this can be switched off per source. Messages from the error log are shortened and can contain file paths; they too can be switched off per source. User names from the log are not transmitted.

We evaluate the logs for you (requests, errors, scans, behavior of search engine bots, comparison with the sitemap) and build daily statistics from them. Pseudonymized data still counts as personal data. Your organization is the controller for it, we are the processor; informing the visitors of your website and the legal basis of this evaluation lie with your organization. We cannot find individual visitors in this data.

Retention: We delete the delivered log lines after 30 days on all plans. We keep the daily statistics for 30 days, 6, 12 or 24 months depending on the plan (Free, Starter, Pro, Agency). If you remove a log source, a website or the organization, we delete the statistics immediately; the log lines expire after 30 days at the latest.

Payments

You buy paid plans from Paddle.com Market Limited (“Paddle”), 30 Old Bailey, London EC4M 7AU, United Kingdom, which acts as reseller and Merchant of Record. Paddle processes your payment and invoice data (e.g. name, address, payment method, tax details) as an independent controller and issues your invoice; the Paddle privacy policy applies. The Paddle checkout is only loaded when you click “Buy” in the app; Paddle then sets its own cookies that are needed for the purchase. We receive from Paddle only what we need for the subscription: customer and subscription identifiers, the plan booked, the subscription status, billing periods and the billing address. We never receive card or bank account data. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and, for keeping billing data, our obligation under commercial and tax law (Art. 6(1)(c) GDPR).

System e-mails

We send confirmation, invitation and password-reset e-mails and notices about the trial, the subscription and quotas through OFFEN-20: sending service for system and notification e-mails. Your e-mail address and the text of the e-mail (confirmation link etc.) go there. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). We do not send promotional e-mails.

Hosting

mavirank runs on servers that we administer ourselves OFFEN-5: hosting provider, location of the data center and data processing agreement. The application, the database, the store for the logs of the log analysis and the crawlers are located there. The legal basis is Art. 6(1)(b) and (f) GDPR.

Recipients and transfers to third countries

Recipient	Purpose	Seat / processing	Role
Hosting provider OFFEN-5: hosting provider, location of the data center and data processing agreement	servers for application, database, log store and crawlers	OFFEN-5: location	processor
E-mail sending service OFFEN-20: sending service for system and notification e-mails	sending system and notification e-mails	OFFEN-20: seat	processor
Offsite backup provider OFFEN-7: offsite backup provider	encrypted backups	OFFEN-7: seat	processor
Paddle.com Market Limited (and Paddle companies)	payment, invoicing, taxes	United Kingdom, possibly USA, Ireland, Canada	independent controller
AI providers: Anthropic (Claude), OpenAI, Google (Gemini), depending on the setting	AI summaries from audit findings	OFFEN-21: contracting entities and processing locations per provider	processor or sub-processor
Twilio	delivery of SMS and calls if you set up such channels	OFFEN-22: contracting entity and processing location	processor or sub-processor
Google (Search Console)	source of the Search Console data after your authorization	OFFEN-24: contracting entity and processing location	independent controller
Google (Web Risk)	query whether an audited address is known to be harmful	OFFEN-24: contracting entity and processing location	recipient of the audited address
Ahrefs	query of the Domain Rating	OFFEN-24: contracting entity and processing location	recipient of the hostname
Chat and webhook services chosen by you	delivery of your notifications	as chosen by you	your recipient, on your instruction

A transfer to third countries takes place at Paddle, at the AI providers and at Twilio as far as you use these features, and at the chat and webhook services you choose for notifications (on your instruction, see “Notification channels”). For the United Kingdom there is an adequacy decision of the EU Commission (renewed on 19 December 2025, valid until 27 December 2031); for transfers to Paddle companies in other third countries (e.g. the USA), Paddle states that it uses standard contractual clauses and further safeguards. Source: https://www.paddle.com/legal/privacy. Which safeguard (adequacy decision or standard contractual clauses, Art. 45, 46 GDPR) we rely on for the transfer to the AI providers and to Twilio will be named here as soon as the contracts are settled OFFEN-21: safeguard per AI provider OFFEN-22: safeguard for Twilio. You can get a copy of the safeguards from us on request. Data is not passed on to other third parties unless we are legally obliged to do so.

Retention

Data	Duration
Server logs of the platform	14 days at the latest OFFEN-4: confirm the retention of server logs
Account and organization data	until you delete your account or organization; unconfirmed accounts after 72 hours
Audits with history	by plan 30, 90, 365 or 730 days; 30 days of grace after a change to a smaller plan
Archived audits	by plan 30, 365, 730 or 1,825 days; grace as above
Websites, reports, shares, channels, custom domains, stored credentials, API tokens	until you delete them
Access token of Google Search Console	until you disconnect or delete the organization
Retrieved data of Google Search Console	OFFEN-26: retention of the Search Console data per plan
AI summaries	as long as the audit or website they belong to
Log lines of the log analysis	30 days
Daily statistics of the log analysis	by plan 30 days, 6, 12 or 24 months; immediately when the source, website or organization is deleted
Count of tool usage	no personal reference (daily values per tool)
Ratings of the tools	check value from IP address and day, without the IP address itself
Billing data (subscription, invoices)	statutory retention periods, up to ten years (Section 147 AO, Section 257 HGB)
Audit log (administrators and security-relevant actions of members)	two years
Delivery log and notifications in the app	90 days
Backups	OFFEN-23: retention of the local and the offsite backups

Deletion and backups

When you delete data in the app or it expires under your plan, it disappears from the running application. Our backups are encrypted and are overwritten after fixed periods OFFEN-23: retention of the local and the offsite backups. A deletion therefore only takes effect in the backups when the respective copy expires. After a restore we promptly delete data again that had already been deleted.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) to processing based on legitimate interests. You can withdraw a consent at any time with effect for the future. Write to us at the address above. If your request concerns data that an organization has processed in mavirank (for example a report or the logs of a website), please contact that organization; if such a request reaches us, we forward it to the organization as far as we can attribute it. You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, https://www.datenschutz-berlin.de, or the authority at your place of residence. Providing data is necessary for registration; without an e-mail address and a password we cannot create an account. We do not make automated decisions within the meaning of Art. 22 GDPR.

Changes to this policy

We adapt this policy when mavirank or the legal situation changes. The current version is always here; the date at the top shows its state. In case of material changes we inform signed-in users by e-mail or in the app.