Data controller

AudiScale is the controller for data collected through the website and application.

For any question about your data or to exercise your rights, write to contact@audiscale.com.

Data collected

We collect the data you provide, the data produced by the features you use, and technical data required for the operation and security of the service.

Account data : Name, email, settings and billing information.
Site data : URLs, audit results, screenshots of your pages and of the competitors you track.
Content : Posts, images, ideas, reports and conversations with the agents.
Connected inbox : Sender, subject, date and classification of messages. Email bodies are read on the fly and never stored.
Security data : IP address and device type (User-Agent), recorded at account creation and sign-in.
Usage data : Technical logs required for the operation of the service.

Purposes and legal bases

Each processing activity relies on a specific legal basis.

Service provision : Account creation, audits, content and action execution. Legal basis: performance of the contract.
Security and fraud prevention : We log the IP address and device at account creation and sign-in to detect abuse (multiple accounts, intrusions) and protect accounts. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
Prospecting : Replies to your contact requests and emails about our offers, which you can object to at any time. Legal basis: our legitimate interest.
Legal obligations : Accounting and billing. Legal basis: compliance with a legal obligation.

Retention and deletion

When you delete your account, your data is deleted or anonymized without delay, except for the invoices the law requires us to keep (Art. 17(3)(b) GDPR). It then leaves our backups at the end of their 30-day rotation.

Data	Retention period	Justification
Account (identity, email, settings, sites and connections)	For as long as you subscribe or use the service. An account with no sign-in for 3 years and no active subscription is deleted, after 30 days’ notice by email. An account our team has disabled (abuse, fraud) is excluded: it is kept as evidence.	Performance of the contract; CNIL “commercial management” guidelines.
Invoices and accounting records	10 years from the close of the financial year, including after account deletion.	Legal obligation (French Commercial Code, Art. L123-22).
Security logs (IP address, device)	12 months, then anonymized; without delay if you delete your account. The action type and date are kept without personal data.	Legitimate interest: account security.
Audits, history, action plan, aggregated Google and Stripe indicators	For the life of the account. Google data is deleted as soon as you revoke the connection.	Performance of the contract.
Screenshots (your sites, competitors, consent banners, experiences)	12 months after capture.	Performance of the contract; data minimization.
Connected inbox (metadata)	12 months after the message is received, and without delay if you disconnect the mailbox.	Performance of the contract.
PDF reports	12 months. Share links expire after 30 days.	Performance of the contract.
Posts, images and ideas	For the life of the account; you can delete them at any time.	Performance of the contract.
Conversations with the agents	24 months after the last message. Displayed reasoning trails are erased after 7 days.	Performance of the contract.
Log of requests sent to AI models	30 days for request content; only volumes and costs are kept beyond that.	Legitimate interest: diagnostics and cost control.
Export archive of your data	48 hours, then deleted.	Right to data portability (Art. 20 GDPR).
Prospects (contact requests, sales emails)	3 years after your last contact.	Legitimate interest; CNIL “commercial management” guidelines.
Free-audit prospects (email address, analysed domain, result)	12 months after the address was entered, then deleted. If you unsubscribe, we keep only an irreversible fingerprint of the address (not the address itself), solely so that we never write to you again.	Legitimate interest; honouring your objection.
Website conversion measurement	13 months.	Legitimate interest: improving the journey.
Cookie choice	6 months, after which we ask again.	CNIL cookie guidelines.
Backups	Database: encrypted daily backup, kept 30 days. Server: weekly backup by the host, kept in the Netherlands and replaced on rotation.	Legitimate interest: service continuity and security.

Subprocessors and transfers

We rely on the contractually bound providers below, who access your data only to perform their service. Any change to this list is published here, with the update date.

Where a provider processes data outside the European Union, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or on the European Commission’s standard contractual clauses.

Provider	Service	Data involved	Location and safeguards
Hostinger International Limited (Cyprus)	Server and database hosting, server backups, email delivery	All service data	France (Paris); backups in the Netherlands
Backblaze, Inc. (United States)	Storage of files and encrypted database backups	Screenshots, images, reports, backups	EU-Central region (Amsterdam, the Netherlands); data processing agreement built into its terms, with the European Commission’s standard contractual clauses; Data Privacy Framework certified
Stripe Payments Europe Ltd (Ireland)	Payment, subscriptions and invoices	Billing identity; card data is held by Stripe only	European Union; transfers to Stripe, Inc. covered by the Data Privacy Framework
OpenRouter, Inc. (United States), with models from OpenAI, Google and Perplexity	Artificial intelligence features: analysis, writing, web search, agents	Content sent to AI: pages of your sites, audit data, conversation messages	United States; standard contractual clauses
AI engines queried for visibility measurement, through OpenRouter: ChatGPT (OpenAI), Perplexity, Gemini (Google), Claude (Anthropic), Grok (xAI), Mistral (Mistral AI), Llama (Meta) and DeepSeek, depending on the engines included in your plan	Measuring how your brand appears in AI answers	Only public questions about your brand and sector; no personal data	Outside the European Union depending on the engine
DataForSEO OÜ (Estonia)	Rankings, keywords, backlinks and online reviews	Domains, keywords, business name and location	European Union
Google Ireland Ltd	reCAPTCHA (bot protection), PageSpeed Insights; Google Analytics with your consent	IP address and browser signals; public URLs	European Union and United States; Data Privacy Framework
Microsoft Ireland Operations Ltd	Clarity (marketing site analytics, including anonymised session replay: clicks, scrolling and mouse movements replayed, input fields masked), with your consent	Browsing on the marketing site	European Union and United States; Data Privacy Framework
OpenStreetMap Foundation (United Kingdom)	Base maps and address search (local SEO)	Address entered, IP address	United Kingdom; adequacy decision

Services you connect

When you connect a third-party service (Google Search Console, Analytics or Ads, Gmail or an IMAP mailbox, LinkedIn, WordPress, Stripe), AudiScale exchanges data with it only at your request. That service remains responsible for the data it holds, under its own privacy policy.

Some services receive no personal data: the Pixabay and Pexels image libraries (only search keywords are sent) and Wordfence Intelligence (we receive its vulnerability feed without sending anything). Push notifications travel, encrypted, through your browser’s push service.

Users of your WordPress site (user management)

User management is an optional permission, off by default, that you enable site by site through an explicit choice. Once enabled, AudiScale retrieves on demand, through the AudiScale Connector plugin, the user accounts of your connected WordPress site. For this data, you (the site owner) are the controller and AudiScale acts as processor within the meaning of Article 28 GDPR.

AudiScale processes this data only on your documented instructions: enabling the permission, then each action you approve in AudiScale. No change is applied without that approval.

It is your responsibility to inform your site’s users of this processing and to ensure it rests on a legal basis.

People and data concerned : The users of your WordPress site. For each: ID, login, display name, email address, roles, registration date, last sign-in date, two-factor authentication status and number of application passwords.
Purpose : Account security and administration of your site: role change, sign-out, revoking application passwords, WordPress’s own password-reset email, requiring a new password at next sign-in, disabling or re-enabling sign-in, deletion with reassignment of content.
No storage of the list : The user list is not saved in AudiScale’s database; it is held in memory only, for about one minute. AudiScale never sees, sets or transports a password.
No transfer to AI providers : Email addresses are masked by default in the interface and are never sent to AI models. Agents receive only counts, roles, inactivity indicators and numeric IDs.
Action journal : Each change is recorded in AudiScale’s action history (ID and display name of the targeted user, what changed, who approved, when) and in the plugin’s audit log on your site. AudiScale’s history entries follow the action history retention period (see “Retention and deletion”).
Processor commitments : Confidentiality of authorised personnel, the security measures described in the “Security and protection of your data” section, assistance with data subjects’ rights requests, and deletion or return of the data at your request or at the end of the service. The providers involved are listed in the “Subprocessors and transfers” section.

Security and protection of your data

The data you entrust to us, including sensitive data obtained through Google APIs, is protected by the technical and organisational measures described here without ambiguity.

All data in transit is encrypted with TLS 1.2 or above; no cleartext access is possible over the network. OAuth access and refresh tokens are encrypted at rest with AES-256-GCM, using a key held outside the database; they are never written to our logs, never exposed to the browser, and never shared with a third party.

Our servers are hosted in France (Paris). Administrator access is restricted to those who need it and logged: server access uses SSH keys only, with password authentication and direct root login disabled; access to the administration back-office requires two-factor authentication (TOTP). Every query is filtered by account: a customer only reaches their own data. Passwords are stored as salted hashes, never in cleartext. The database is backed up daily in encrypted form and the server weekly, with all backups retained within the European Union; we apply security patches to our dependencies continuously.

In the event of a data breach likely to create a risk to your rights, we notify the supervisory authority within 72 hours and inform you without delay where the regulation requires it.

Encryption in transit : TLS 1.2 or above on every communication, without exception.
Encryption at rest : OAuth tokens encrypted with AES-256-GCM, key held outside the database; database backups encrypted; application secrets isolated from the code.
Restricted access : Servers reachable through SSH keys only (password and root login disabled); administration back-office protected by two-factor authentication.
Partitioning and EU hosting : Data isolated per customer account; servers in France, backups within the European Union.

Google data (Search Console, Analytics & Ads) and Limited Use

When you connect your Google Search Console and Google Analytics 4 properties, AudiScale reads your search-performance and audience data and — on your explicit action — submits your sitemap and requests reindexing of your URLs. When you connect your Google Ads account, AudiScale only reads your advertising performance metrics (cost, clicks, impressions, conversions, conversion value, per campaign): no campaign, ad, bid or budget is created, modified or deleted. These accesses are used solely to produce your audits, action plan, dashboards and the fixes you approve.

Data obtained through Google APIs is protected by the measures described in the “Security and protection of your data” section: encryption in transit and at rest, restricted and logged administrator access, per-account partitioning. We retain only the aggregates needed for your dashboards; they are deleted when you revoke the connection or delete your account. You can revoke access at any time from AudiScale or from your Google account security settings.

AudiScale’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data — raw, aggregated or derived — to develop, train or improve generalized or foundational AI/ML models. Our AI features are limited to analyzing your own data to advise you; that data is neither shared with nor sold to third parties.

Your rights

Under the GDPR, you have rights of access, rectification, erasure, objection, restriction and portability. To exercise them, write to contact@audiscale.com or, if you are not a customer, use the form on the “Exercise my rights” page (audiscale.com/en/exercise-my-rights).

You may also lodge a complaint with your supervisory authority (in France, the CNIL).

Cookies

The site uses strictly necessary cookies (including remembering your language and session) and, only with your consent, the Google Analytics and Microsoft Clarity audience measurement tools. Your choice is kept for 6 months and can be changed at any time through the “Manage cookies” link in the footer.