How we process data

Data controller

The operator of SEOInstrumenti.com is the controller for the processing described in this notice. At the end of the page you can use the contact form or reveal the public contact email.

Tool submissions

Submitted URLs, domains and text are processed to run the selected check. They are not published or attached to an account unless a signed-in user explicitly saves a report.

A short-lived technical cache may prevent repeated external requests. Production cache retention is capped at 45 minutes and physical cleanup runs at least every 15 minutes.

Do not submit personal, confidential or contractually protected data unless it is necessary for the check.

Verified text-match corpus

Text submitted for a match check is processed transiently for the current request. At most the first 12,000 normalised words are used for comparison and the percentage; the remainder is outside the measured coverage. We do not add the text to the corpus, use it for training, or write the full text to application logs or the crawl queue. If you save a report to an account, the result, checked URLs, local excerpts and evidence are retained, not the complete submitted text.

A bounded HTML response is fetched temporarily for public pages included in the corpus and visible text is extracted. The complete third-party HTML and article text are not retained after indexing. We keep the necessary text fingerprints, URL and operational records such as crawl date, scope, permission or licence basis, and the outcome of access-rule checks.

A source is included after verified site control, explicit permission or a documented applicable basis. Crawling is restricted to the declared HTTPS origin, path and sitemap, observes robots.txt and applicable TDM signals, and uses a clearly identified crawler. A site owner can withdraw permission or request removal through the contact form.

The corpus has operational limits for sources, pages, response size and refresh frequency. New, private, excluded, unavailable or unlisted publications may therefore be absent from a result.

Security and abuse prevention

The server processes an IP address, User-Agent, time and minimum request data to deliver the service, limit automated attacks and investigate technical incidents. Rate-limit keys are hashed instead of keeping a readable IP history.

Forms use CSRF tokens, honeypots, signed timestamps, minimum completion time, request limits and adaptive temporary blocking. We do not use Google reCAPTCHA or Cloudflare CAPTCHA.

Accounts, favourites and reports

Registration stores your email, username, display name, a secure password hash, preferred language, verification status and operational dates. We record the date and version of the terms accepted when the account is created. Passwords and tokens are never stored in readable form.

Favourites and recent tools can remain in your browser. When signed in, selected favourites and reports you save are associated with the account. You can view, download and delete your own reports.

Contact and service email

The contact form processes your name, email, subject and message so we can reply and protect the form from abuse. We do not use this information for marketing without separate consent.

We send only service messages needed for account verification, access recovery, security changes or a reply to your request.

External sites, analytics and advertising

When you submit a public URL, the relevant tool may make a bounded request to that website. Its server receives the ordinary technical request data. The text-match check searches the first-party verified corpus automatically and can optionally compare additional URLs you supply.

Only when you select the optional box for that individual check does the system send LangSearch 2–3 separate nine-word fragments selected from at most the first 12,000 eligible words. The query field, including quotation marks and OR separators, is no more than 500 bytes; this is not the size of the complete HTTP request. Recognisable email addresses, phone numbers, URLs, IP addresses, IBAN-like values and long identifiers are removed first. Automated filtering cannot reliably identify every name, postal address or free-form phrase, so those may remain. The complete submitted text is never sent to LangSearch.

LangSearch processes the submitted phrases as search queries and the ordinary technical data of the API request under its own privacy policy. This site does not retain the raw provider response, snippets or submitted query phrases. Our protected client checks permitted candidate URLs and our system calculates matches and coverage locally. Checked URLs, local excerpts and evidence may remain only in a report that a signed-in user explicitly saves. Candidate URLs are not added to the corpus automatically.

Google Analytics loads only with a valid configuration and analytics consent. When Google AdSense is configured, eligible public pages use Google Privacy & messaging as the single interface for advertising and analytics purposes. The local analytics banner is used only when AdSense is not configured.

Google and its selected advertising providers may process the IP address, browser and device data, requested page and consent signals to select, deliver, measure and protect ads according to the visitor’s choice. Advertising and analytics do not restrict access to the tools.

Legal grounds and retention

Requests, accounts and service messages are processed to provide the requested service. Optional transfer of filtered phrases to LangSearch occurs only after your separate consent for that individual check. Minimal technical security data is processed under our legitimate interest in protecting the platform. Analytics and advertising storage and personalisation are used only when the applicable consent choice permits them, while data required by law is processed to meet a legal obligation.

Technical records, messages, tokens and saved reports are retained only for their stated or configured periods, then deleted or anonymised. A backup may remain until its scheduled rotation and is not reused for another purpose.

Your rights

You may request information, access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. With AdSense configured, the single “Privacy and cookie settings” control reopens Google Privacy & messaging; without AdSense, the same control manages analytics only.

We may request sufficient information to verify identity and scope. You may complain to the Bulgarian Commission for Personal Data Protection or your local EU supervisory authority.