What we collect, and why

From the free visibility check

The domain you enter, the results we generate for it, and a hashed version of your IP address used only for rate limiting. We do not store your raw IP. If you ask us to email the report, we store that email address.

We fetch your site's homepage to work out what you sell, identifying ourselves as PenlidBot. We read only what is publicly served.

From connected accounts

If you connect Google Search Console, we request read-only scopes and store the resulting metrics so we can build your archive and detect decay. We store an encrypted refresh token; we never see or store your Google password.

CMS credentials, where you provide them, are encrypted at rest, scoped to a single site, and used only to publish content you have queued.

What we never do

• We do not sell or rent personal data to anyone, for any purpose.
• We do not pool your Search Console data into a shared or foundational model. Cross-account benchmarks use aggregated outcome statistics only, never your raw data or anything identifying you, and you can opt out in settings.
• We do not use third-party advertising trackers on this site.

Retention and deletion

Free-tool results are cached for 7 days and then expire. Account data is kept while your account is open. Email privacy@penlid.com and we will export or delete your data within 30 days — including the archive, which is yours.

Deleting your account deletes your content history, ledger and archive permanently. We will warn you clearly before doing it, because the archive cannot be rebuilt from Google.

Processors we use

Cloudflare (hosting, storage), Anthropic (language models), and — where you enable them — other AI engine providers for measurement. Payment processing, when billing is enabled, is handled by Stripe; we never see your card number.