Legal
Privacy notice
What data SearchDone holds about you, why it holds it, and what you can make us do about it.
Last reviewed
Who we are
SearchDone is a product of No Fear Tech Ltd, company number 16758357, registered in England and Wales at 6 Mallard Way, Dereham, Norfolk NR19 1FJ. For the personal data described here, No Fear Tech Ltd is the data controller. Contact us through the contact page.
What we collect
When you contact us
Your name, email address, website and the content of your message. We use this to reply to you. Our lawful basis is legitimate interests — responding to someone who has deliberately written to us.
When you ask to join
Your email address, the domain of the site you want analysed, and any note you add. We use this solely to decide the request and to tell you the outcome. Our lawful basis is legitimate interests — answering someone who has asked to join. Declined requests are deleted automatically after 90 days; approved ones become account records.
When you hold an account
Your email address, name, organisation, and authentication records including login times. Our lawful basis is performance of a contract.
When you connect a service
Access tokens for services you connect, such as Google Search Console. These are encrypted before storage and are never written to logs. We also process the search performance data those services return — page URLs, queries, impressions, clicks and positions. That data is about your website rather than about identifiable individuals, though search queries can occasionally contain personal information typed by a searcher, which is why it is treated with the same care.
When you use the website
Analytics on how the site is used. See the cookie policy for what is set and how to refuse it.
What we do not do
- We do not sell personal data.
- We do not add you to a marketing list because you contacted us.
- We do not enrich your record from third-party data brokers.
- We do not build advertising or lookalike audiences from customer data.
Who we share it with
Only the processors needed to run the service — hosting, storage, email delivery and the AI providers used to analyse and explain findings. Each is bound by a data processing agreement. The current list is on the data processing page, and that page is updated before a processor is added or replaced, not after.
Where it is processed
Your account data and search performance data are stored on servers we run ourselves in Germany, inside the EEA, which UK adequacy regulations cover without any further safeguard. Some providers process data outside that area; where that applies it is named on the data processing page along with the safeguard relied upon, such as standard contractual clauses.
How long we keep it
| Data | Retention |
|---|---|
| Contact messages | Two years from last correspondence |
| Requests to join (declined) | Deleted automatically after 90 days |
| Account records | For the life of the account, then 30 days |
| Connected-service tokens | Deleted immediately on disconnection |
| Search performance data | For the life of the account, then 30 days |
| Audit and action logs | Retained after account closure where needed as a record of changes made to a website |
Your rights
Under UK GDPR you may ask us to:
- confirm what we hold about you and give you a copy;
- correct anything inaccurate;
- delete it, where we have no overriding reason to keep it;
- restrict or object to how we use it;
- provide it in a portable format;
- withdraw consent at any time, where consent is what we relied on.
Ask through the contact page. We will respond within one month. If you are unhappy with the outcome you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you gave us the chance to put it right first.
Changes
Material changes will be dated at the top of this page, and account holders will be told directly rather than left to notice.