Privacy

Who is responsible

AnteSEO is a product of Query OÜ, a company registered in Estonia under registry code 14857299, at Teeveere tee 11, Vääna-Jõesuu küla, 76909 Harku vald, Harju maakond.

Query OÜ is the controller of everything this page describes: what is collected, what it is for and who else sees it are all decided here. For anything on it, write to hello@anteseo.com.

What you give us

The website address you type in. Four optional answers about your business, where optional means you can leave every one of them empty and still buy the report. One email address, at the last step before payment, which is where we send your finished report.

At that same step we ask who the invoice is for: your company name, your registry code and your country, and, if you want them on it, your VAT number and your address. We ask because we issue the invoice ourselves and it has to say who bought the report. They are printed on your invoice and used for nothing else.

The email address is used for delivery and for the paperwork that goes with it, and for nothing else. We do not pass it to anybody. Your card goes to EveryPay and never to us; your invoice comes from us and goes to this same address.

Buying a report creates no account and asks for nothing else.

If you have an account

There is a second thing you can buy: a package, which is one website for a year, and that one does have an account. You sign in with your email address and a six digit code we send to it, so there is no password, and nothing for us to store that could be the same password you use anywhere else. What the account holds is your address, the domains you have added, who the invoices are made out to, and when your year ends.

We keep the code only as a one-way hash of it, for ten minutes, and the same for the token in your browser that keeps you signed in. Reading our database does not let anybody sign in as you.

You can give your own address and a different billing address, and if you do, the second one is where the invoice and the renewal notice go. Leave it empty and both go to the address you sign in with.

We will email you about the service itself: your sign-in codes, your invoices, and a notice before a year ends. That is the thing you bought rather than mail about it. Before we send a notice like that, we may look at your site again so the message can say something useful; that is our own doing, it is not part of what you paid for, and it is covered by the same crawler rules as everything else on this page.

There is no mailing list, for a report or for an account, and nothing anywhere asks you to join one. The messages above are the whole of what we send, and every one of them is about something you bought. If that ever changes we will ask you first, on purpose and in plain words, and until you answer we will not send it.

What we collect without asking

Your IP address, briefly, so that we can rate limit the forms on this site. It is stored as a counter against your address and nothing else, and if you are on IPv6, against the network your address belongs to rather than the address itself, which is less about you than the address would be. It is never attached to a report or to anything you typed, and it is deleted automatically once it goes stale.

Our server keeps ordinary request logs: the address the request came from, the page it asked for, and what we answered. They are what somebody reads when the site breaks, and they are the one place your address is written down rather than counted. They stay on that machine: they are never copied anywhere, never joined to a report, and never read for anything but fixing a fault. The machine rotates them away as it fills, and until we can put a figure here that the server is actually set to, this sentence will not invent one.

There is no advertising pixel, no analytics and no tracking script on this site, and nothing whatever is put in your browser by any page of it. There is no consent banner in front of this page because there is nothing to consent to. This paragraph used to carry an exception for the checkout, which was a third-party script on the report page that stored what a card window needs; paying now happens on our payment provider's own site rather than on ours, so the exception has gone with it.

Two scripts remain and both are ours, written into the page rather than fetched from anybody. One asks our own server how far along your report is, while you are watching it being written. The other would rewrite a price into your local currency, and today it never fires: everything is priced in euro, so it finds nothing to change. Neither sends anything anywhere.

How we count what happens on this site

We record the steps of this funnel as they happen, on our own server: that a page was seen, that a domain was typed, that the questions were answered, that a report was bought. Each of those is one row, and what it holds is the time, the step, what happened at it, and the website address you typed, which is the subject of the work you are asking for rather than a name for you. On the first two steps it also holds the host your browser said you came from, if it said anything: example.com, never the page on it.

There is deliberately no identifier for a person in any of it. We do not store your IP address or your browser's user agent against these rows, and we do not create any code, cookie or number that would let us recognise you or join one page you looked at to the next. Where a form was refused we keep the reason, which rule an address broke or which box was too long, and never what you typed into it.

If you arrived from an advertisement, the address you arrived on carries an identifier for that click, put there by the advertising network. We keep it, together with the campaign the link names, so that we can tell which advertisements bring people who go on to buy a report. It arrives in the link itself: nothing is read from your browser to obtain it, and the only identifiers we keep are the ones belonging to networks we actually buy clicks on. An fbclid we could never use is somebody else's identifier for you, and it is dropped.

That identifier is the one thing here that can outlast the ninety days. When a click goes on to buy a report, it is copied once more onto the report itself, because a sale has to be reported to the network against the sale rather than against a page view, and that copy lives as long as the report does. It is deleted when the report is.

Everything else described in this section is deleted after ninety days.

What we fetch from your website

One request happens before you have bought anything. When you type a domain we fetch its home page, to find out whether a report is possible at all: whether the name resolves, whether the server answers, whether there is a page there rather than a parking screen. It is the same crawler carrying the same header, it reads that one page and nothing else, and what we keep is the verdict rather than the page: reachable, refused, or nothing there. It is made before robots.txt has been read, which the terms name as one of three exceptions along with the other two.

When you buy a report we crawl the site you named. We read its robots.txt and obey it, we identify ourselves in the header x-anteseo on every request, which points at a page describing the crawler, and we open the pages that are publicly available, which are the same pages a search engine reads. We read them in an ordinary browser rather than announcing ourselves as a crawler, because the report is about what a browser and a search engine can see, and we do not attempt to reach anything behind a login.

We keep the rendered HTML of every page we read, the text of the site as one document, and the finished report and its PDF. These are the evidence behind the report, and they are what makes a finding checkable afterwards.

Some of what a site publishes is about people rather than about the site, and the crawl reads it with the rest: the email addresses and telephone numbers printed on a contact page or in a footer, and the name a site gives for whoever runs the business. We pull them out because one of the things the report checks is whether a site states the same contact facts everywhere. A number in the footer that disagrees with the one in the markup is a finding, and it cannot be found without reading both. They are kept with the report, they go to Anthropic in the text of the site, and they are deleted when the report is. We do not write to them, and there is no list of them anywhere.

We do not contact the people whose details those are to tell them we have read them. Writing to everybody whose address appears on a site somebody else asked us to read would take an effort out of all proportion to a crawl of pages already published to the world. That disproportionate effort is the ground we rely on for not writing, and the condition it comes with is that the processing is explained publicly instead, which is what this paragraph and the one above it are.

Who else sees it

The text of your site and your four answers are sent to Anthropic, whose model writes the parts of the report that are prose. This is the one place your information leaves our servers as content, and it is unavoidable: it is how the report gets written. How a report gets made says what the model is and is not allowed to do with it.

Anthropic is a company in the United States, so the text of your site and your four answers leave the European Economic Area when they are sent. We would rather be exact about that transfer than reassuring about it. The model is reached through Anthropic's own command-line client on an ordinary subscription login, not through a business account bought by the call, so what governs what we send is their privacy notice and the terms of that subscription. There is no separate agreement between us and them about your information, and no document of ours to send you if you ask for one. We are not in a position to tell you whether what we send is used to train their models, and we would rather say so than say it is not.

What we can tell you is what leaves and what does not. What goes is the text of the site we crawled and the four answers, once, at the moment the report is written. Your email address does not go, your IP address does not go, and nothing about the payment goes. If sending your site's text to a company in the United States is not something you want, the moment to decide is before you buy, because it is how the report gets written and there is no version of this product without it.

Our servers are rented from Hetzner and are in the EU. The payment is taken by EveryPay, an Estonian payment provider, on a page of theirs: your card details are entered there and never reach us, and we never see or store a card number. What we send them when a payment is opened is the amount, the domain you typed, your email address and your IP address — the last two because the card networks require them for the security check that authorises the payment, not because we need them there. What comes back to us is that the money moved, which report it was for, their reference for the payment and how it was paid, such as card or a bank name. Those stay on the report for as long as the report does, and they are how a support question or a refund gets from a report to the record of the money.

Because Query OÜ is the seller rather than a supplier to one, the record of the sale is ours and stays here. That is the change from what this page said until recently, when a merchant of record stood between us and held it instead.

The emails that deliver a report are sent from the same Hetzner machine the site runs on, by its own mail server. This page used to say that the provider would be named here when report emails began; they have begun, and there is no provider to name. The same mail server carries the alerts that tell us a report is stuck.

We do not sell anything to anybody, and there is no other recipient. Nothing we count on this site is sent to an advertising network today. If that changes, so that we can tell an advertising network that a click it sent us led to a sale, this page will say so, and will say which network, before it happens.

Except the one report we publish

The report at /sample is a real report about a real company, published with that company's permission. Nobody else's report is public, and yours will not be unless you ask us to publish it.

How long we keep it

Your report and the material behind it are kept indefinitely, and the material is the part that needs a reason. The refund policy says a report stating something untrue about your site is a fault of ours whenever you find it, and puts no window on the word whenever. The rendered pages are how that gets checked: without them a disputed finding is our word against yours. So the evidence is kept for as long as the promise it answers, and the link you bought keeps working. Nothing in the code deletes any of it, and putting an expiry in this sentence that is not in the software would be a promise to nobody.

Ask us to delete a report and we will delete it by hand, along with everything the crawl kept: the rendered pages, the text of the site, the PDF, and the contact details pulled out of the site with them. The one thing that cannot go with it is the record of the sale. An invoice is an accounting document and Estonian law requires it to be kept for seven years, which outranks the request. What stays is the invoice: who bought, what they paid and when. The report it billed for goes.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us and we will do it.

If you think we have handled your information badly, you can complain to us, and you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the authority where you live.

Why we are allowed to hold it

Because you asked us to produce something and we cannot produce it otherwise: the crawl, the answers, the report and the address we send it to are the performance of the contract you entered when you paid. Keeping the evidence afterwards is that same contract rather than a second reason bolted to it: a promise to correct a wrong finding whenever you find it is not one we could keep without the pages we read.

The rate limiting, and the request logs beside it, are our legitimate interest in a service that is not abused and can be repaired when it breaks. The accounting records are a legal obligation.

Reading the contact details a site publishes about the people who work there is our legitimate interest, and our customer's, in a report that can say whether the site contradicts itself about how to reach the business. We have weighed that against those people by using the details for that comparison and nothing else, never writing to them, and deleting them when the report goes.

Counting the steps of this funnel is our legitimate interest in knowing whether the thing we built works and whether the advertising we pay for reaches anybody. We have weighed that against your privacy by taking the option that collects least: no identifier for you, nothing stored in your browser, nothing shared, and ninety days.