Privacy

Draft, as of 23 October 2026. This policy describes what the website, the customer account and the SEO Bee app actually process. It will be reviewed by a lawyer before launch. The German version is the binding one.

1. Controller

Rankerra, owner Ahmed Mahmutovic (sole proprietorship)
Roedersteinstraße 29, 94538 Fürstenstein, Germany
Email: info@seo-bee.de · Phone: +49 157 592 682 98

We are not required to appoint a data protection officer.

2. The short version

• The website has no analytics, no ads and no tracking. Fonts and scripts are served from seo-bee.de itself.
• We only set cookies when you sign in to your account, and only the ones that sign-in needs.
• The app crawls on your computer. Crawl data and your Search Console, Analytics and AI data stay with you and are not sent to us.
• Payment happens at Paddle. We never see your payment details.

3. Hosting and server log files

The website, customer account and licence server run at IP-Projects GmbH & Co. KG, Am Vogelherd 14, 97295 Waldbrunn, Germany, on servers in Germany. We have a data processing agreement with IP-Projects (Art. 28 GDPR).

For every request the web server records: IP address, date and time, requested address, status code, amount of data sent, referrer and user agent. We need this to run the website securely and reliably and to detect attacks (Art. 6(1)(f) GDPR). Log files are deleted after 7 days.

4. Cookies and browser storage

Without signing in, the website sets no cookies. After you sign in to your account:

• sb_session: keeps you signed in. Contains a random identifier and lasts 30 days or until you sign out.
• sb_in: contains only the value "1", so the menu shows "My account" instead of "Log in". Lasts as long as sb_session.

In your browser's local storage the website remembers whether you chose the light or dark design (seo-bee-theme) and which billing period you looked at on the pricing page (seo-bee-period). After a purchase, the email address from checkout is kept briefly in session storage (sb-buy-email) so we can prefill it when you sign in. It is gone when you close the tab.

All of this is strictly necessary for the function you asked for (§ 25(2) no. 2 TDDDG), which is why there is no consent banner.

5. Customer account and sign-in

For your account we store your email address, optionally your name, the language of our emails, and the dates you registered and last signed in. Sign-in works without a password, with a six-digit code sent by email. We store the code only as a hash; it is valid for 15 minutes and deleted one day after it expires.

To prevent abuse we count requests per email address and per IP address. We do not store the IP address in plain text for this, only as an encrypted hash, which we delete after one day.

The legal basis is the contract for the account and licence (Art. 6(1)(b) GDPR). The data is kept until you ask us to delete your account; statutory retention obligations remain unaffected.

6. Licence and app

The app only contacts our server about the licence: when you activate it and then about once a week. It sends your email address or the licence file, a device ID, the device name, the operating system and the app version. The device ID is a hash the app creates on your computer; serial numbers and MAC addresses are never sent. For each device we store when it was activated and last seen, so you can see your devices in your account and sign them out.

The licence file is signed with our key and stays on your computer. That lets the app check the licence offline, for up to 14 days without a connection.

The legal basis is the licence agreement (Art. 6(1)(b) GDPR). The data is kept until your account is deleted.

Everything else the app connects to (crawls, Google Search Console and Analytics with your own credentials, AI providers with your own key, Telegram) goes directly from your computer to that service, not through us. [PRÜFEN: describe the app's update check once it exists (which address, which data, whether it can be switched off).]

7. Buying through Paddle

Licences are sold by Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as reseller (merchant of record). Your purchase contract is with Paddle, and Paddle processes payment and invoice data as an independent controller. Paddle's privacy policy: paddle.com/legal/privacy.

The Paddle payment window only loads when you click "Buy a licence". Only then does your browser connect to cdn.paddle.com.

After a purchase Paddle sends us: email address, customer, transaction and subscription IDs, the plan you bought, the number of licences and the term. We use this to create the licence in your account (Art. 6(1)(b) GDPR). The European Commission has issued an adequacy decision for the United Kingdom.

8. Withdrawal and cancellation through the website

When you use "Withdraw from contract" or "Cancel contracts here", we store what you enter in the form (name, email address, contract, date, note) and the time we received it. You get a confirmation of receipt by email straight away. The purpose is to carry out your declaration and to be able to prove we received it (Art. 6(1)(c) and (f) GDPR). We delete the data when the regular three-year limitation period has passed.

9. Contact form and email

What you send through the contact form (name, email address, topic, order or licence number, message) arrives as an email in our mailbox at IP-Projects. The website does not store it. We use it only to answer your request (Art. 6(1)(b) or (f) GDPR) and delete the email once the request is dealt with and no retention obligation applies.

10. Emails about your account, the beta and your licence

Emails with sign-in codes and confirmations of purchase or receipt are sent from our mailbox at IP-Projects.

Anyone who creates an account, accepts a beta invitation or buys a licence is also added to our email system. Through it you receive messages that belong to the contract: a welcome and introduction to the app, notes for beta testers, and a reminder seven days before a beta or cancelled licence ends (Art. 6(1)(b) GDPR). For this we pass on your email address, name, language, plan and licence end date.

11. Newsletter: tips, news and offers

You only get the newsletter if you order it yourself (the box when you sign up, in your account, or the form on the home page) and click the link in the confirmation email (double opt-in). As proof we store the wording of your consent and when you ordered and confirmed. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time through the link at the end of every email; we then remove your address from the list and keep the proof of consent for up to three years.

Our email system is software made by Rankerra. [PRÜFEN: add where the email system is hosted (currently Vercel Inc., USA, with the database at Neon), the database region, the email sending service, the data processing agreements and the legal basis for transfers to the USA (EU-US Data Privacy Framework).]

12. Recipients

Your data only goes to IP-Projects (hosting and email), Paddle (purchases) and the service providers of our email system (section 11). We do not sell data or pass it on for advertising.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to info@seo-bee.de.

You can complain to a data protection authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Whether you must provide data; automated decisions

Without an email address we cannot create an account or a licence. The free version of the app works without an account. We do not make automated decisions or use profiling within the meaning of Art. 22 GDPR.