Last updated: 5 September 2026
Crawlio ("we", "us", "our") is operated in the United Kingdom and is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains what data we collect, how we use it, and your rights.
1. Who we are
Crawlio is a hosted software service that connects Google Search Console to AI tools via the Model Context Protocol (MCP). We are based in the United Kingdom.
Contact: crawliosearch@gmail.com
2. What data we collect and why
a) Account data (collected when you sign in with Google)
- Email address — used to identify your account, communicate with you about the service, and enforce plan limits.
- Google OAuth access token and refresh token — used solely to make authorised requests to the Google Search Console API on your behalf. These tokens are encrypted at rest and never shared with third parties.
- Token expiry timestamp — used to automatically refresh your access token so the service works without re-authentication.
- Account creation date — used for internal record-keeping and to apply free-plan expiry rules.
b) Usage data
- Query count — the number of MCP tool calls made using your API key. Used to enforce free-plan query limits.
- Last active timestamp — the date and time of your most recent query. Used to display your activity in your account dashboard and to identify inactive accounts.
- Plan type — your current subscription tier (free, personal, or business). Used to determine your access level.
c) Contact form data
- Name, email address, and message content submitted via the contact form. Used solely to respond to your enquiry.
3. What we do NOT collect or store
- We do not store your Google Search Console data (keywords, impressions, clicks, page data, or any query results).
- We do not log or retain the content of MCP tool calls or AI conversations.
- We do not collect payment card details — these are handled directly by Stripe.
- We do not use tracking pixels, fingerprinting, or cross-site tracking technologies.
4. How we use Google user data
Crawlio requests the following Google OAuth scopes:
- webmasters.readonly — to read (never write) your Google Search Console property data in response to your AI tool's queries.
- userinfo.email — to identify your account by email address.
Google user data (email address and OAuth tokens) is used exclusively to operate the Crawlio service as described above. We do not use Google user data for advertising, profiling, or any purpose beyond providing and improving the service. We do not share Google user data with any third party except as required to operate the service (see Section 6).
Our use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements.
5. Legal basis for processing (UK GDPR)
- Contract performance (Article 6(1)(b)) — processing your email, OAuth tokens, and usage data is necessary to provide the service you signed up for.
- Legitimate interests (Article 6(1)(f)) — monitoring usage counts and last-active timestamps to prevent abuse and manage service capacity.
- Consent (Article 6(1)(a)) — for optional communications and cookies where applicable.
6. Third parties we work with
- Google LLC — OAuth authentication and Search Console API access. Google Privacy Policy.
- Hetzner Online GmbH — server hosting in Helsinki, Finland (EU). Your data is stored on their infrastructure. Hetzner Privacy Policy.
- Resend Inc. — transactional email delivery for contact form notifications. Contact form data (name, email, message) is transmitted to Resend to deliver the email. Resend Privacy Policy.
- Stripe Inc. — payment processing for paid plans. Payment data is handled directly by Stripe and is not stored by Crawlio. Stripe Privacy Policy.
We do not sell, rent, or trade your personal data to any third party.
7. Data retention
- Account data (email, tokens, usage counts) is retained until you delete your account or request deletion.
- OAuth tokens are deleted immediately when you disconnect your account.
- Free accounts that have been inactive for 12 months may be deleted after 30 days' notice by email.
- Contact form submissions are retained in email for up to 2 years.
8. Data security
We use industry-standard measures to protect your data: HTTPS/TLS encryption in transit, restricted server access, and access controls on the database. OAuth tokens are stored in a server-side database not accessible from the public internet.
9. Your rights under UK GDPR
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — request deletion of your data ("right to be forgotten"). You can also delete your account directly from your account dashboard.
- Restriction — ask us to restrict processing of your data.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email crawliosearch@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
10. International transfers
Your data is stored on servers in Finland (EU/EEA) operated by Hetzner. Some third-party processors (Google, Resend, Stripe) may process data in the United States. Where data is transferred outside the UK/EEA, we rely on standard contractual clauses or adequacy decisions.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or a notice on the website. Continued use of Crawlio after changes constitutes acceptance of the updated policy.
12. Contact
For any privacy-related questions or requests: crawliosearch@gmail.com