OctaneAudit, a service operated by Nguyen Van Bao, an individual, at Tri Thuy 2, Ninh Hai, Ninh Hoa Town, Khanh Hoa 652900, Vietnam ("OctaneAudit", "we", "us") respects your privacy. This Privacy Policy explains what personal data we collect when you visit octaneaudit.com (the "Site") or use our audit and monitoring services (the "Services"), how we use it, who we share it with and the choices and rights you have.
For visitors and customers in the European Economic Area, United Kingdom and Switzerland, OctaneAudit (operated by Nguyen Van Bao) is the data controller for the processing described here. Where we process website data on your instructions as part of an audit or monitoring engagement, we act as your processor under our Data Processing Agreement.
1. Data we collect
Data you give us directly
- Order and account data: name, email address, company name, target website URL, competitor domains and any special instructions you provide at checkout or in your dashboard.
- Payment data: handled by Stripe. We receive the last four digits of your card, the card brand, billing country and postal code, and transaction identifiers. We never receive or store your full card number.
- Communications: messages you send through the contact form, email or support channels, including attachments.
- Newsletter: your email address and the page where you subscribed.
- Free checks and tools: the website address you enter and, if you unlock the full result, your email address and your marketing choice.
- Alert channels: email addresses and webhook URLs (for example Slack or Discord) you add to receive monitoring alerts.
- Reviews: the rating and comments you submit after an order.
Data we collect automatically
- Usage data: pages visited, referring URL, approximate location derived from IP address, browser and device type, and interactions with emails (opens and clicks), collected through server logs and Google Analytics 4 with IP anonymization enabled.
- Cookies and similar technologies: see Section 6.
- Security data: IP address (stored only as a one-way hash for free checks) and user agent for rate limiting, fraud prevention and anti-spam verification (Cloudflare Turnstile).
Data about websites you ask us to audit or monitor
When you order an audit or register a site for monitoring, we crawl publicly accessible pages of that website and collect technical data about them: HTML, response headers, performance metrics, structured data, links and page content. This data may incidentally include personal data published on your website (for example, names on a team page). We process it only to deliver the Services. The latest overall score of a domain checked with our free SEO check may be shown publicly on a score page and badge for that domain; this is data about the website, not about you.
We do not knowingly collect personal data from children under 16, and the Services are not directed at them.
2. How we use personal data
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Deliver audits and monitoring, send reports and alerts | Order, account, website data | Performance of a contract |
| Process payments, issue refunds, prevent fraud | Order and payment data | Contract; legitimate interests |
| Provide customer support | Communications, order data | Contract; legitimate interests |
| Send transactional emails (confirmations, delivery, receipts, security notices) | Account data | Contract |
| Send the newsletter and product updates | Email address | Consent (withdraw any time) |
| Send service emails about your account, such as a reminder about an unfinished checkout, low credit balance or a request to review a delivered order (unsubscribe link in every email) | Account and order data | Legitimate interests |
| Deliver alerts to the channels you connect | Alert channel data, website data | Performance of a contract |
| Improve the Site and Services, measure performance | Usage data (aggregated where possible) | Legitimate interests |
| Secure the Site, rate limiting, anti-spam | Security data | Legitimate interests |
| Comply with legal obligations (tax, accounting, lawful requests) | Order and payment data | Legal obligation |
We do not sell personal data and we do not use personal data for automated decision-making that produces legal or similarly significant effects.
3. Who we share data with
We share personal data only with service providers that help us run the business, under contracts that restrict their use of the data:
- Stripe, Inc. (United States): payment processing and subscription billing.
- Zoho Corporation (United States / EU data centers) and Resend, Inc. (United States): transactional email delivery.
- Cloudflare, Inc. (United States): DNS, CDN, DDoS protection, Turnstile anti-spam and object storage for report files.
- Google LLC (United States): Google Analytics 4 for usage analytics and Google Search Console.
- Destinations you choose: when you connect Slack, Discord, a webhook or another email address as an alert channel, we send alert content (site name, issues found and a link) to that destination on your instruction. Their own privacy terms apply.
- Public data services: we query Google PageSpeed Insights and public registration (RDAP) services with website addresses only, to measure performance and domain expiry.
- Hosting provider: our application and database run on virtual servers in the United States or European Union operated by a reputable infrastructure provider.
- Professional advisers: accountants and lawyers, where necessary.
We may also disclose data when required by law, to enforce our Terms, to protect the rights, property or safety of OctaneAudit, our customers or the public, or in connection with a merger, acquisition or sale of assets (in which case we will notify you).
4. International transfers
OctaneAudit is operated from Vietnam, and most of our service providers are based in the United States. If you are in the EEA, United Kingdom or Switzerland, your data will be transferred to Vietnam and the United States. We rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and, where the recipient is certified, the EU-U.S. Data Privacy Framework. You can request a copy of the relevant safeguards by emailing [email protected].
5. Data retention
| Data | Retention |
|---|---|
| Account data | Until you delete your account, then 30 days |
| Orders, invoices, payment records | 7 years (tax and accounting law) |
| Audit reports and crawl data | 24 months after delivery, or until you request deletion |
| Monitoring check results | 12 months rolling |
| Contact form messages | 24 months |
| Free check results and the email used to unlock them | 24 months |
| Alert channels | Until you remove them or delete your account |
| Newsletter subscription | Until you unsubscribe |
| Server logs and security data | 90 days |
| Analytics data | 14 months (Google Analytics default) |
When retention ends, data is deleted or irreversibly anonymized.
6. Cookies
We use a small number of cookies and similar technologies:
- Strictly necessary: session cookie for logged-in customers, CSRF protection, theme preference and the Cloudflare security cookie. These cannot be disabled.
- Analytics: Google Analytics 4 cookies (
_ga,_ga_*) to understand how the Site is used. IP addresses are anonymized. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser. - Payment: Stripe sets cookies on checkout pages for fraud prevention.
We do not use advertising or cross-site tracking cookies. Where required by law, we ask for consent before setting non-essential cookies.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to legal retention requirements;
- Restrict or object to processing based on legitimate interests;
- Port your data to another provider in a machine-readable format;
- Withdraw consent at any time where processing is based on consent (for example, the newsletter);
- Lodge a complaint with your local data protection authority.
To exercise these rights, email [email protected] from the address on your account or use the Settings page of your dashboard. We respond within 30 days (45 days for CCPA requests) and may ask you to verify your identity. We will not discriminate against you for exercising your rights.
8. California residents (CCPA/CPRA)
In the preceding 12 months we have collected the categories of personal information described in Section 1: identifiers, commercial information, internet activity and, for website data, any categories published on the audited website. We collect it from you, your devices and the websites you ask us to audit, for the purposes in Section 2, and disclose it to the service providers in Section 3.
We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes requiring a right to limit. You have the right to know, delete, correct and opt out, and the right to non-discrimination. Authorized agents may submit requests on your behalf with written permission. Contact [email protected].
9. Security
We protect personal data with technical and organizational measures appropriate to the risk: TLS encryption in transit, encryption at rest for databases and report storage, hashed passwords, two-factor authentication for staff, least-privilege access, rate limiting, dependency and vulnerability monitoring, and daily encrypted backups. No method of transmission or storage is completely secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as required by law.
10. Third-party links
The Site and our reports contain links to third-party websites and tools. We are not responsible for their privacy practices. Review their policies before providing personal data.
11. Changes to this policy
We may update this policy from time to time. We will post the new version here with an updated date and, for material changes, notify you by email or a notice on the Site. The "effective" date at the top indicates when the current version took effect.
12. Contact us
Privacy questions and requests: [email protected]
OctaneAudit Operated by Nguyen Van Bao Tri Thuy 2, Ninh Hai, Ninh Hoa Town Khanh Hoa 652900, Vietnam
EU and UK residents may also contact their local supervisory authority. A list of EU authorities is available at edpb.europa.eu; the UK authority is the Information Commissioner's Office at ico.org.uk.