SEO NEURONS SPIDER - PRIVACY NOTICE Version 1.0 | Last updated: 26 October 2026
1. WHO IS RESPONSIBLE AND WHAT THIS NOTICE COVERS
Ashok Kumar, sole proprietor trading as SEO Neurons, is responsible for the personal information we handle to operate Spider's account, licensing, update and support services. Our address is 252/6, Barwala, Hisar, Haryana, India - 125121. Contact: contact@seoneurons.com. Ashok Kumar is also the contact for privacy requests and grievances at that address and email.
This notice describes the Windows desktop Application and its related account and licensing functions. Our general website has its own privacy notice at https://seoneurons.com/privacy-policy/. This document provides the additional information specific to Spider. The Application's EULA and terms.external-services.txt describe use conditions; this notice explains data handling and does not provide blanket consent to optional processing.
When you crawl or analyse data for yourself or a client, you decide the targets, settings, lawful purposes and recipients. You are responsible for those decisions and any notices or permissions they require. We remain responsible for our own handling of information and applicable duties.
2. PROJECT DATA ON YOUR COMPUTER
Spider saves crawl projects in the storage location you choose. Depending on your settings and work, these can contain URLs and query strings, metadata, headers, links, extracted text, raw/rendered HTML, structured data, screenshots, custom extractions, imported analytics, AI outputs and vectors. Pages and screenshots may contain personal, confidential or client data. Projects, report files and logs are not all encrypted by the Application. Protect them with appropriate Windows access controls and disk security.
The app also keeps a local agreement-acceptance record for your user account: the agreement version, a document identifier, acceptance time and app version. The acceptance flow does not send this record to us. Keeping this record avoids asking again for the same unchanged agreement.
Optional integrations also keep local sharing-permission records: service, an opaque connection/project identifier, notice version and document identifier, decision time and app version. These permission records are not sent to SEO Neurons and do not contain API keys, selected page URLs, page text or project paths. They let Spider remember your setup choice instead of asking before every request. Saved credentials or accepting the EULA alone do not grant optional-service sharing permission.
Review the complete notices and withdraw saved service permissions under About > Privacy & Data Sharing. Withdrawal blocks future requests and MCP tool reads; it cannot recall information already sent or erase provider copies. Forget Google accounts and separately revoke Google's access when appropriate. Ordinary requests with unchanged settings do not prompt again; changed credentials, AI recipients/endpoints, MCP project or notice content require a new choice. PageSpeed screens remind you that complete selected URLs and query parameters are sent to Google before you choose Fetch.
The reviewed desktop implementation has no automatic project-cloud-sync, product-analytics tracker or automatic crash-report uploader. Licensing and update checks do not upload your crawl database, page content or API keys. Optional integrations, website requests, connected clients and information you send to support have the separate flows described below. A storage location backed up or synchronised by your own software follows its rules.
3. REQUESTS TO WEBSITES AND WEBSITE LOGIN
Crawling, live checks and login verification contact the selected websites and resources. Their operators and network providers may receive your IP address, requested URL, browser/request headers and any applicable login information. Browser rendering can also load scripts, images, fonts, CDNs, identity providers and other resources used by a page, subject to your settings. Those websites can set cookies and operate their own tracking. Website terms, privacy practices and your crawl settings apply to them.
If you configure authentication, the app uses the credentials and browser session you supply to access the configured sites. A captured browser login can include cookies, local storage and IndexedDB state. Remembered login material is protected for the current Windows user using Windows DPAPI; AI settings use encryption with a DPAPI-protected key, and saved Google refresh tokens, PageSpeed keys and the device signing private key also use Windows-user protection. This does not encrypt all project contents or protect against every program running as that Windows user. Custom extractions, URLs, ordinary headers and debug output can still be sensitive.
Use HTTPS where available. An HTTP website or custom HTTP API endpoint does not provide HTTPS transport protection. Removing a remembered login requires applying and saving the authentication change; clearing a current session and forgetting its saved copy are separate actions. Sign out or revoke website sessions at the website as needed.
4. ACCOUNT, LICENSING AND UPDATES
Registration and account functions handle your username, email address, password/authentication records, email verification and recovery messages, session/security records, licences and activated devices. Account passwords belong in the account service, not the desktop licence activation form.
Desktop activation sends the account identifier you enter, licence key, app version, a randomly generated installation/device ID, computer name, device public key, and signed request fields including a timestamp and nonce. Refresh and deactivation send the device ID, app version and signed request fields. The signing private key stays on the computer. The current identity is generated for the installation; it is not a hardware serial- number inventory. Your computer name can itself identify you.
Our services use this information for account access, licence/device limits, validation, fraud/security controls and support. They record activation and validation times, status and audit events. Licence audit events use hashed IP/actor identifiers; hashing does not make linked records anonymous. Hosting, network and security systems may also handle ordinary IP addresses, request times and request/browser details. Account email is used for verification, recovery and necessary service communications.
The app checks licence access at startup when a saved activation needs validation and when you activate, refresh or deactivate it. It also checks our HTTPS update manifest automatically after startup and on an explicit update check on supported Windows systems. The update request sends the app user agent/version and ordinary network metadata, without project cookies or crawl credentials. The update checker offers available release information; it does not silently install an installer.
5. OPTIONAL GOOGLE CONNECTIONS
Google Search Console: after Google authorisation, the app can read the connected account email, available site properties and selected date-range page performance: clicks, impressions, click-through rate and position. Permissions are webmasters.readonly, openid and userinfo.email. It sends Google authorisation/token requests, an authenticated identity lookup and selected property/date-range queries.
Google Analytics 4: after Google authorisation, the analytics.readonly permission allows reading account/property/web-stream information, metric metadata and selected date-range reports. Page reports return complete recorded page URLs, including query strings; landing-page reports return landing-page paths and query strings. Google receives the selected property, web stream, website host, dates, metrics and any selected traffic filters (channel, source, medium, device and country). These reports are used to match website performance with your local crawl. GA4 also requests openid and userinfo.email for the account-identity check described below. This integration reads your analytics; it is not a tracker of desktop use.
Google sign-in takes place through Google's authorisation flow. For both integrations, the app reads Google's stable account identifier and verified email to identify the account and prevent reconnecting a saved entry to a different Google account. Google may also confirm an organisation domain, used to assess ownership of an older email-only saved entry; that domain is not saved as a separate account field. The stable identifier, email, property choices and report settings are saved in local preferences. Reusable refresh tokens are protected for the current Windows user. Identity details and imported reports do not share that token encryption. For an existing login, the saved verified email can be sent back to Google as a sign-in hint. Retrieved metrics can be saved in projects and reports. The desktop integration sends these requests directly to Google rather than through our licence server. Only use accounts/properties you may access.
SEO Neurons Spider's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. We use that information for the visible account/property-selection, reporting and SEO-analysis features you request. We do not sell it, use it for advertising or general AI-model training, or allow routine human access. Human access is limited to your specific permission, necessary security investigation, legal requirements or other access permitted by the applicable Google policy. Transfers must support a permitted, disclosed purpose; connecting a client does not waive these restrictions. See https://developers.google.com/terms/api-services-user-data-policy.
PageSpeed Insights: when you request a test, the selected complete URL, test strategy and API key are sent to Google's PageSpeed service. Google can fetch that URL and its resources. Key validation tests example.com, rather than uploading a crawl project. Do not submit confidential or token-bearing URLs without appropriate authority. A local website login session is not forwarded to PageSpeed.
6. OPTIONAL AI AND CUSTOM ENDPOINTS
When you configure and run AI tasks, the selected provider receives the API credentials needed for the request, model choice and input. Input can include your prompt and selected URL, title, headings, descriptions, alt text or saved page text. Embeddings send extracted saved page text. Outputs, generated images, vectors and related task records can be stored in your project. AI tasks can run for selected saved pages or during a crawl when configured. A connection test normally requests the model list; it does not itself send a project for generation. An enabled connect-on- launch setting can perform connection checks without a fresh click.
OpenAI: requests go to its API, not a consumer ChatGPT conversation. API data is not used for training by default unless you opt in. OpenAI can retain abuse-monitoring data; Responses also stores application state by default. Spider currently does not set store=false, and does not promise zero retention. Account-specific controls and exceptions apply. Read: https://developers.openai.com/api/docs/guides/your-data
Gemini: Google's unpaid-service terms permit product improvement and human review of inputs/outputs and prohibit sensitive, confidential or personal submissions. Paid-service handling differs. Check your project/tier before sending any client or private content. Read https://ai.google.dev/gemini-api/terms.
Custom endpoints: if you change an API URL, its operator receives the credentials and content sent to it. The provider name in the interface does not prove the endpoint belongs to that provider. Verify every configured endpoint and use HTTPS for remote services. SEO Neurons does not operate or approve an endpoint merely because you enter it.
7. MCP, EXPORTS AND SUPPORT
MCP is optional read-only access to a saved project. The desktop HTTP server binds to this computer's loopback address and is started/stopped by you; a standalone local-client connection is also available. There is no separate per-client password or per-tool approval in this local server. Other local programs able to connect may read the exposed project data. This can include page records, saved HTML, clean text, links, structured data and findings. Read-only access still discloses that data. Connected clients may send results to a cloud/AI service under their own terms. Connect only trusted clients; stop MCP when you do not need it. Do not expose it through a remote tunnel/proxy without a separately secured setup.
Exports and copied projects go to the destinations you select. Review them for private content, embedded identifiers and third-party restrictions before sharing. If you contact support, we receive the contact details, message and files you choose to send. Logs can contain URLs, local paths, account labels, errors and, with explicit diagnostic body logging, snippets of submitted content. Review/redact files before sending them; do not send passwords, API keys, recovery codes or full private projects unnecessarily. The app does not automatically send diagnostic files to support.
8. STORAGE, RETENTION AND STOPPING ACCESS
Local projects and exports remain until you delete them or replace/reset their data. Project snapshots can retain up to three rolling database backups; recovery can preserve additional damaged copies. Screenshots, exports, manually copied projects and OS/cloud backups are separate copies. There is no general automatic age-based project erasure promised here. Uninstalling the app does not guarantee removal of all user data.
Application logs normally rotate at about 5 MiB with three archives. This is size-based rotation, not deletion after a fixed number of days. Close the app before manually removing logs or complete project folders and related backups that you no longer need.
Disconnecting Google with a saved token retained permits later reconnect. Use the integration's forget/remove account option to remove its saved token, saved identity details and associated account caches; also revoke Spider in your Google Account's third-party connections to stop Google's grant. Imported project metrics and exports are separate copies and must be deleted separately. Google's guidance: https://support.google.com/accounts/answer/14012355
Stop/disable AI tasks and connect-on-launch to prevent further requests; remove/reset saved AI settings or clear the relevant API key as appropriate, and revoke/rotate the key with its issuer. Clearing local results or credentials does not delete data already held by a provider. Use that provider's controls or contact it for its retention/deletion options.
We retain account, licence and support records for the time needed to provide the service and address security, licence-abuse, dispute and legal requirements. Deactivation releases device access; it is not account or audit-record deletion. There is no automatic fixed-period purge of all these records in the reviewed implementation. You can request closure or deletion at contact@seoneurons.com. We assess each retained category, delete information no longer necessary and explain any lawful reason to retain specific records. Required retention is limited to that purpose.
9. PURPOSES, RECIPIENTS AND INTERNATIONAL PROCESSING
We process information to provide the functions you request, administer accounts and licences, secure the service, respond to support and comply with law. Depending on applicable law, the basis may be a contract, necessary permitted use, consent or a legal obligation. Where consent is required, obtain it separately for that purpose. Providing a policy or accepting the EULA does not authorise unrelated processing.
Authorised personnel and providers of hosting, database, security, email and support infrastructure may process service information as necessary. We may disclose information when required by law or to resolve a lawful claim. We do not sell your personal information or local project contents. For optional services, the chosen provider or client is an additional recipient. Google/OpenAI and infrastructure providers may process data outside your country, including outside India. The app does not guarantee India-only or EU-only storage. Contact us about our service providers and applicable transfer safeguards; check your own provider account agreement before submitting restricted data.
10. YOUR REQUESTS, SECURITY AND CHANGES
Contact contact@seoneurons.com for access, correction, deletion, account closure, consent withdrawal or a privacy grievance. Include enough context to locate the account, without sending secrets. We may verify identity or authority proportionately. We will address grievances within one month, or an earlier applicable legal deadline, and explain restrictions on a request. Withdrawal can affect the feature needing that information and does not undo earlier lawful processing. Applicable law may also provide objection, restriction, portability, nomination or regulator-complaint rights. Contact the relevant website/controller for data collected by it; we cannot remotely erase local projects we do not hold.
Spider is intended for professional SEO work and is not directed at children. Gemini use requires users to be at least 18. Do not send children's or sensitive personal data without the permissions and safeguards required by law and the service involved.
We use appropriate safeguards, including protected credential storage and HTTPS for our account/licence/update services, but no system guarantees complete security. Report suspected exposure to contact@seoneurons.com; revoke affected credentials promptly. We will handle and notify relevant incidents as required by applicable law.
We will date policy changes and provide any notice or renewed permission required before materially different data use. This notice does not reduce mandatory rights, third-party licence rights or our own legal obligations.