Legal information
Privacy Policy
Last updated on July 6, 2026
This policy describes how PimpSEO processes personal data as part of the web audit service, in accordance with the GDPR.
This is a courtesy translation. The French version prevails.
Data controller
The data controller is Jean Magné. For any question regarding your data: jeanmagne.dev@gmail.com.
Data collected
- Account: email address and identity provided at sign-up (authentication is optional).
- Audits: analyzed URLs and the results of generated, saved reports.
- Billing: subscription data managed by Stripe (PimpSEO does not store card numbers).
- Google connections: read-only Search Console OAuth tokens, used to import the data you authorize.
- Imported data (Search Console, Bing, GA4, Umami): processed in memory to produce the report and never stored on our servers.
- Audience measurement: anonymized browsing statistics via Umami (cookie-free); session recording only with your consent.
Purposes and legal bases
- Provide the audit service and display reports — performance of the contract.
- Manage accounts and the Premium subscription — performance of the contract.
- Improve the quality of recommendations via AI — legitimate interest, with personal data masking.
- Measure audience anonymously (Umami, cookie-free) — legitimate interest; session recording relies on your consent.
- Ensure security and prevent abuse — legitimate interest.
Processors and recipients
PimpSEO relies on the following providers. No audited content is transmitted to any third party other than these:
| Provider | Role | Purpose | Location |
|---|---|---|---|
| Neon (Neon Auth + Postgres) | Authentification et base de données | Comptes, audits sauvegardés, propriétés et connexions Google | Union européenne / États-Unis (clauses contractuelles types) |
| Stripe | Paiement et gestion d'abonnement | Souscription et facturation de l'offre Premium | États-Unis (clauses contractuelles types) |
| Anthropic (Claude) | Enrichissement IA de l'audit | Analyse d'agrégats top-N avec masquage des données personnelles | États-Unis (clauses contractuelles types) |
| OAuth Search Console (lecture seule) + API CrUX | Import des données Search Console mandatées, Core Web Vitals terrain | États-Unis (clauses contractuelles types) | |
| Umami (auto-hébergé) | Mesure d'audience respectueuse de la vie privée | Statistiques de fréquentation anonymisées sans cookie ; enregistrement de session soumis à consentement | Union européenne (instance auto-hébergée) |
Transfers outside the European Union
Some processors are located outside the European Union. These transfers are governed by the European Commission's standard contractual clauses or an equivalent protection mechanism.
Retention periods
- Account and saved audits: kept as long as the account is active, then deleted on request.
- Publicly shared report: ephemeral link deleted after 24 hours.
- Imported data: not retained (in-memory processing only).
- Billing data: retained per legal and accounting obligations.
Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection. To exercise them: jeanmagne.dev@gmail.com. You may also lodge a complaint with the CNIL (cnil.fr).
Cookies
Cookie management is detailed in our cookie policy.