This Privacy Policy explains how Tapio Kauranen (“we”, “us”) processes personal data when you visit susannadashboard.com, use the Susanna Dashboard app (together “the Service”), or contact us. It is our privacy notice under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), in Finnish tietosuojaseloste.
In short:
- We use your data to run the Service for you, and for nothing that you wouldn’t expect.
- We never sell personal data, and we don’t use your data for advertising or to train general AI models.
- Our servers and backups are in the European Union.
- You can see, download and delete your data, and you can disconnect Google at any time.
Who is responsible
The controller is Tapio Kauranen, Rua da Trindade 31, 4000-220 Porto, Portugal.
For anything about personal data and your rights, write to privacy@susannadashboard.com. We haven’t appointed a data protection officer, because the law doesn’t require one for a provider like us, so the same address reaches the person responsible.
Our two roles
- Controller. We decide how the data about our users and visitors is processed: your account, your sign-in, billing, support, security and the website.
- Processor. The Search Console data of the sites you connect, and the content you add to your reports, belong to you as our customer. If they contain personal data, for example a name in a search query or the email address of someone you send reports to, you are the controller of it and we process it for you, following your instructions. For business customers, our Data Processing Agreement applies.
If your personal data is in the data of one of our customers, for example because a website’s search queries contain your name, please contact that customer. We help them handle your request.
The personal data we process
Your account
- Your email address, and the identifier of your Google account. Google gives us these when you sign in with Google. We ask Google only for them (the “openid” and “email” permissions). We never receive your Google password, and we don’t get your contacts, files or anything else in your Google account.
- When your account was created and when it was last used.
- If you sign in with an email link: your email address, and a one-time sign-in code that expires after 15 minutes.
- During the private alpha: if you ask for an invite, the email address you give us is kept on our invite list until you sign in or ask us to remove it. If someone who isn’t invited signs in with Google, we hand the access back to Google at once and keep nothing except a line in our technical logs (see How long we keep data).
Your connection to Search Console
- The access Google gives the Service when you connect Search Console: an access token and a refresh token. They allow the Service only to read Search Console data (the permission
webmasters.readonly). The refresh token is stored encrypted. - The list of Search Console properties your Google account can see, and your permission level for each, so that you can choose which ones to add.
Search Console data
For each site you add: clicks, impressions, click-through rate and average position, by day, search query, page, country, device and search appearance.
This is statistics about websites, not about people. But search queries are typed by the people who search, so a query can contain personal data, such as someone’s name. Google hides rare searches that could identify the person searching before the data reaches us.
Your reports and settings
The names and settings of your reports, their layout, colors and fonts, your widgets, notes, tags, lists and brand words, the logos and other images you upload, your share links and their settings, and the schedules, recipients and settings of your email reports and alerts.
Billing
If you choose a paid plan: your name or company name, billing address and VAT number, your plan and its history, invoices and payment status. Payments are handled by Stripe. We don’t receive or store your full card number.
Messages
The emails you send us and our replies, and the messages we send to you, such as sign-in links, reports, alerts and notices about the Service.
Use of the Service and technical data
- Records of how the Service is used, kept in our own database: events such as signing in, connecting a site or using a feature, with the time and your account. We collect them ourselves, without third-party tracking tools. They never contain your Search Console data.
- Security data, such as failed or unusual sign-in attempts.
- Technical logs. Our application doesn’t store IP addresses. Our hosting providers can keep standard server logs, which record the IP address, the time and the address of each request.
Visitors to our website
The website susannadashboard.com doesn’t use analytics or advertising cookies, and it doesn’t track you. If we add website analytics later, such as Google Analytics, it will run only if you accept it in a cookie banner, and we update this policy and the Cookie Policy before that.
Why we process it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, and signing you in | Account | Contract, Article 6(1)(b) |
| Connecting Search Console, fetching your data, and showing your reports, recommendations and alerts | Search Console connection and data, reports and settings | Contract, Article 6(1)(b) |
| Sharing reports and sending the email reports and alerts you set up | Reports and settings, the recipients you choose | Contract, Article 6(1)(b) |
| Billing, accounting and taxes | Billing | Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c) |
| Answering your questions | Messages, account | Contract, Article 6(1)(b), or our legitimate interest in helping you, Article 6(1)(f) |
| Messages about your account and the Service, such as a lost Google connection or a change to our terms | Account | Contract, Article 6(1)(b), and legitimate interest, Article 6(1)(f) |
| Keeping the Service and its users safe, and preventing misuse and fraud | Security and technical data | Legitimate interest, Article 6(1)(f) |
| Finding out which features are used, to improve the Service | Records of use | Legitimate interest, Article 6(1)(f) |
| News about the Service by email, if we send it | Email address | Consent, Article 6(1)(a), or for our customers, legitimate interest where the law allows it |
| Website analytics, if we add it | Use of the website | Consent, Article 6(1)(a) |
| Establishing, exercising or defending legal claims, and following the law | What the case needs | Legal obligation, Article 6(1)(c), and legitimate interest, Article 6(1)(f) |
Where we rely on legitimate interest, we have weighed it against your rights and freedoms, and you can object to the processing (see Your rights). Every email with news has an unsubscribe link.
You need to give us your email address to have an account, and Search Console access for the reports. Without them we can’t provide the Service.
Google user data
This section explains how the Service accesses, uses, stores and shares the data it receives from Google (“Google user data”).
What we access
- With Sign in with Google: your email address and the identifier of your Google account.
- With Connect Search Console: read-only access to Search Console (
https://www.googleapis.com/auth/webmasters.readonly). With it the Service reads the list of your Search Console properties and your permission levels, and the search performance data of the properties you add. The same read-only permission would also allow reading your sitemaps and URL inspection results; the Service doesn’t use them today, and we update this policy before it does.
How we use it. Only to provide and improve the features you see in Susanna Dashboard: to sign you in, list your sites, build your reports, recommendations and alerts, and send the reports you schedule.
What we never do with it
- We don’t sell Google user data.
- We don’t use it, or transfer it, for advertising, including retargeting and personalized or interest-based ads.
- We don’t use it to determine creditworthiness or for lending.
- We don’t use it to develop, improve or train general AI or machine learning models.
- We don’t transfer it to others, except as needed to provide or improve the features you use (for example to the providers that store our data), to comply with the law, for security, or as part of a merger, acquisition or sale of our business, after telling you.
Who can read it. Nobody on our side reads your Google user data, unless you allow it for a specific purpose (for example when you ask us for help with a report), it is needed for security (for example to investigate abuse), the law requires it, or the data has been aggregated and anonymized for our internal operations.
How we keep it. On our servers in the European Union. All traffic is encrypted (HTTPS). Google’s refresh tokens, which give lasting access, are stored encrypted (AES-256-GCM); the access tokens made from them expire within an hour.
How long, and how to delete it. We keep it for as long as your account and the site are in the Service, within the history your plan includes. When you disconnect a Google account, we revoke our access at Google and stop fetching data. When you remove a site, its data is deleted. When you delete your account, everything is deleted. Backups are deleted within 30 days. You can also remove our access in your Google account at myaccount.google.com/permissions.
Susanna Dashboard’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies and browser storage
The app uses two cookies that are strictly necessary: one keeps you signed in, and the other protects the sign-in with Google from forged requests. The app also remembers in your browser whether you chose its light or dark mode. The website uses no cookies. The details are in the Cookie Policy.
Content your browser loads from Google
To show some parts of the app, your browser loads them directly from Google. Google then receives your IP address, as with any request on the internet.
- Site icons. The app shows the icon of each site, its favicon, from Google’s favicon service (t1.gstatic.com). Your browser sends Google the address of the site.
- Fonts. Our own fonts are served by our server. If you open the list of Google Fonts or a report uses one of them, your browser loads the font from Google Fonts (fonts.googleapis.com and fonts.gstatic.com).
- Links to Google. The reports link to Google’s search results and announcements. When you open such a link, you are on Google’s site.
We use these to show recognizable site icons and the fonts you choose, which is our legitimate interest, Article 6(1)(f). Google’s own privacy policy applies to them.
Who we share data with
- Our service providers. Companies that host the Service, store our backups, deliver email or handle payments for us. They process personal data only on our instructions and under data processing agreements. They are listed on the Subprocessors page.
- Google. When you sign in with Google or connect Search Console, Google processes your data under its own terms, and the Search Console data comes from Google.
- Stripe. If you choose a paid plan, Stripe processes your payment details. For some purposes, such as preventing fraud and meeting its legal obligations, Stripe acts as a controller under Stripe’s own privacy policy.
- The people you choose. Reports that you share with a link or send by email can be seen by their recipients.
- Authorities. When the law, a court or an authority requires it, or when it is needed to protect our rights or the safety of others.
- A new owner. If our business or a part of it is sold or merged, the data can move to the new owner, who must follow this policy. We tell you in advance.
We don’t sell personal data, and we don’t share it for advertising.
Where your data is
Our servers and our backups are in the European Union; the Subprocessors page says where each provider processes data. Some of our providers are companies based outside the EU and the EEA, for example in the United States, and they or their subcontractors may access the data from there. Then the transfer relies on a decision of the European Commission that the country protects personal data adequately, such as the EU–U.S. Data Privacy Framework for certified companies, or on the Commission’s Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of these safeguards.
If we move our servers out of the European Union, we update this policy and tell you before the move.
How long we keep data
| Data | How long |
|---|---|
| Your account | For as long as you have an account. When you delete it, it is deleted at once, and from backups within 30 days. If a free account isn’t signed in to for 24 months, we may delete it after telling you 30 days in advance. |
| Google access tokens | Until you disconnect Google or delete your account. When you disconnect, we also revoke the access at Google. |
| Search Console data | For as long as the site is in your account, within the history your plan includes. When you remove the site, its data is deleted. |
| Reports, settings and images | For as long as your account exists. An image that no report uses any more is deleted automatically. |
| Billing records | As long as accounting and tax laws require: in Portugal, 10 years. |
| Messages with us | For as long as needed to deal with the matter, and then up to 24 months. |
| Records of use | Up to 25 months. Statistics that don’t identify anyone can be kept longer. |
| Technical logs | Only as long as needed for security and fixing errors, at most 90 days, unless they are needed to investigate a security incident. |
| Backups | 30 days. |
How we protect your data
All traffic to the Service is encrypted. Google’s refresh tokens are stored encrypted, and you stay signed in with a cookie that scripts on a page can’t read. Our servers get security updates automatically, accept only the connections the Service needs, and can be managed only with personal keys. Only the people who need it for their work can access the production systems, and they are bound by confidentiality. Backups are kept continuously with a separate provider and tested every day. More on the Security page.
If a data breach puts your rights at risk, we tell the data protection authority within 72 hours and you without undue delay, as the GDPR requires.
Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it,
- have incorrect data corrected,
- have your data erased,
- restrict the processing of your data,
- receive the data you gave us in a machine-readable format and have it moved to another service (data portability),
- object to processing based on our legitimate interest, and at any time to direct marketing,
- withdraw your consent at any time, where processing is based on consent. This doesn’t affect the processing done before.
We don’t make decisions based solely on automated processing that would have legal or similarly significant effects on you. The recommendations of the Service are about the performance of websites, not about people.
Much of this you can do yourself in the Service: remove sites, delete your account and disconnect Google. For anything else, write to privacy@susannadashboard.com. We answer within one month. If the request is complex, we can extend this by two months, and we tell you if we do. We may ask you to confirm that you own the account, for example by writing from its email address. Using your rights is free of charge.
You also have the right to lodge a complaint with a data protection authority. Ours is the Portuguese Comissão Nacional de Proteção de Dados (CNPD). You can also turn to the authority of the country where you live or work, for example in Finland the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
If you live in the United States
Some U.S. states, such as California, give their residents rights over their personal information. This section explains how we handle them.
What we collect. In the past 12 months we have collected these categories of personal information, from the sources described in The personal data we process: identifiers (such as your email address and account identifier), commercial information (your plan and payments), internet or other electronic network activity (how you use the Service), and professional information (such as your company name). We use them for the purposes described in Why we process it, and we keep them as described in How long we keep data.
No selling or sharing. We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We haven’t done so in the past 12 months, and we don’t knowingly sell or share the personal information of anyone under 16. We don’t use sensitive personal information to infer characteristics about you. We disclose personal information to service providers only for the business purposes described in Who we share data with.
Your rights. Depending on your state, you may have the right to know what personal information we have about you and get a copy of it, to have it deleted or corrected, and to opt out of the sale or sharing of your personal information, targeted advertising and profiling (which we don’t do). We won’t treat you differently for using your rights.
How to use them. Write to privacy@susannadashboard.com with the subject “U.S. privacy request”. We confirm your identity by email, using the email address of your account. You can also use an authorized agent, who must show us your written permission. We answer within 45 days, or tell you if we need another 45 days.
Appeals. If we turn down your request, you can appeal by replying to our answer. We answer your appeal within 45 days. If you are not satisfied, you can contact the attorney general of your state.
Global Privacy Control. We treat a Global Privacy Control signal from your browser as a request to opt out of the sale and sharing of your personal information. If we add website analytics, the signal also turns it off.
We don’t disclose personal information to third parties for their own direct marketing.
Children
The Service is meant for adults and businesses, and it is not directed at children. We don’t knowingly collect personal data from children under 16. If you think a child has given us personal data, write to privacy@susannadashboard.com and we delete it.
Changes to this policy
We update this policy when the way we process personal data changes, and we change the date at the top. We tell you about important changes in advance, by email or in the Service.
Contact
Tapio Kauranen, Rua da Trindade 31, 4000-220 Porto, Portugal.
Privacy questions and requests: privacy@susannadashboard.com.