Privacy Policy

1. Information We Collect

We collect information to provide, secure, and improve our search intelligence services. Based on actual platform operations, categories of collected data include:

• Account Credentials: When you register for an account, we collect your name, work email address, and an encrypted password hash generated using secure one-way salted hashing algorithms (scrypt/pbkdf2).
• Website Scan & Audit Telemetry: When you run an audit or connect a website domain, we scan public HTML DOM elements, metadata tags, HTTP response headers, JSON-LD structured data, and Core Web Vitals metrics.
• Integration Credentials & OAuth Tokens: If you grant access to third-party services (such as Google Search Console OAuth, GitHub OAuth, or CMS API keys for Shopify, Wix, WordPress, or Webflow), access and refresh tokens are encrypted at rest using server-side AES-256-GCM encryption.
• Billing & Payment Data: Subscription billing is processed securely by Stripe. Credit card numbers, CVVs, and billing addresses are submitted directly to Stripe and are never stored on WebDarpan servers.
• Authentication & Session Cookies: We issue essential, encrypted HttpOnly session cookies (seo_atlas_session) to manage authenticated user sessions.

2. How Information Is Used

WebDarpan uses collected information strictly for legitimate operational purposes:

• Authenticating users and maintaining workspace tenant isolation.
• Executing technical SEO, AEO, GEO, LLMO, and VSO diagnostic scans on user-requested domains.
• Retrieving Search Console performance telemetry to display impression and CTR metrics.
• Generating platform-specific code fix recommendations and pull requests upon user instruction.
• Processing subscription billing, invoice generation, and entitlement enforcement via Stripe.
• Detecting and preventing security abuse, bot attacks, or unauthorized SSRF requests.

3. Third-Party Service Processors

We rely on established infrastructure providers to operate the platform securely:

4. Data Security & Encryption Controls

WebDarpan implements robust security measures:

• All integration credentials and OAuth refresh tokens are encrypted using AES-256-GCM.
• Strict Server-Side Request Forgery (SSRF) filters block requests to internal or private IP ranges.
• Strict tenant isolation ensures organizations can only access data assigned to their workspace ID.
• Password reset tokens are cryptographically generated and expire automatically after 1 hour.

5. Account Deletion & Data Retention

Users may request full account deletion at any time via account preferences (/account). Upon confirmation, all user records, workspace associations, audit reports, and encrypted integration tokens are permanently removed from the database.