Privacy Policy
Last updated: July 1, 2026
1. Data controller
The controller of your personal data is:
- Owner: Natan Miquel Marco
- Service: APEspider (
apespider.com) - Contact: hello@apespider.com
For any question about this policy or about the processing of your data, you can write to us at the contact address above. The owner's identification details and address appear in the Legal Notice.
2. What data we process and for what purpose
We process only the data necessary to provide the service to you:
| Data | What for | Legal basis |
|---|---|---|
| Account identity: email, name and user identifier | Create and manage your account, authenticate you and give you access to the service | Performance of contract |
| Your websites: domains, aliases and notes you add | Organize analyses by site | Performance of contract |
| Google Search Console data: search queries, URLs, clicks, impressions, CTR, position and indexing status of your sites | Import and show you the search performance of the sites you connect | Consent (you authorize the OAuth connection) |
| Keywords you choose to track (rank tracker) | Check rankings in search engines | Performance of contract |
| Support messages and screenshots you send us | Handle your help requests | Performance of contract / consent |
| Preferences and usage: language, plan, credits, API usage, feature votes, notifications | Provide and improve the service, apply plan limits | Performance of contract / legitimate interest |
| Payment data: your buyer email (card payments are handled by the payment provider; we do not store card data) | Activate your plan and comply with billing obligations | Performance of contract / legal obligation |
| Technical data: IP address and server access logs | Security, abuse prevention and operation of the service | Legitimate interest |
We do not process special categories of data or build profiles with legal effects on you.
3. Google Search Console connection
When you connect Google Search Console, we use read-only access (webmasters.readonly) to import performance data for the sites you authorize. We do not modify anything in your Google account. The access token is stored encrypted and you can revoke the connection at any time, both from APEspider and from your Google account's security settings.
4. Recipients and data processors
To provide the service we rely on providers acting as data processors, each under its corresponding data processing agreement (DPA):
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Authentication and account identity | European Union |
| Hetzner | Infrastructure hosting | European Union |
| Sentry | Error monitoring | European Union |
| Featurebase | Support widget and user assistance | European Union (Estonia) |
| Google (Search Console / OAuth) | Import of search data for your sites | United States (SCC / Data Privacy Framework) |
| Brevo (Sendinblue SAS) | Transactional email delivery | EU (primary storage); some sub-processors outside the EEA (see §5) |
| DataForSEO | Ranking and search volume data (we do not send it your personal data, only keywords and domains) | EU entity with infrastructure in the US (SCC) |
| Payment provider (Gumroad) | Payment processing and billing | United States (SCC / Data Privacy Framework) |
We do not sell or transfer your personal data to third parties for advertising purposes.
5. International transfers
Your data is hosted primarily in the European Union. Some providers process data outside the European Economic Area:
- Google and the payment provider (US): covered by Standard Contractual Clauses (SCC) and their certification under the EU-US Data Privacy Framework.
- Brevo: stores email in the EU, but uses some sub-processors outside the EEA (e.g. CDN and log monitoring providers in the US, and support staff in the US, India and Canada), covered by SCC and the Data Privacy Framework.
- DataForSEO (infrastructure in the US): covered by SCC. We do not transfer your personal data to it.
You can request information about these safeguards by writing to the contact address.
6. Retention periods
We keep each piece of data only as long as necessary:
| Data | Retention |
|---|---|
| Google Search Console data | According to your plan (1 to 36 months); configurable |
| Crawl analyses (crawls) | The most recent ones according to your plan, plus any you pin manually |
| Ranking history | While you track the keyword, and up to 12 months after you stop tracking it |
| Activity and API usage logs | Up to 24 months |
| Notification queue | 90 days from sending |
| Server access logs | Between 30 and 90 days |
| Your account data | While the account is active (see §7) |
| Billing data | For the periods required by applicable tax and commercial law |
7. Your rights and deleting your account
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw your consent where processing is based on it. To exercise them, write to us at the contact address.
Account deletion. From your account settings you can delete it yourself, with two options:
- Immediate deletion: we delete your account and your personal data right away.
- Deletion with grace period: we schedule the deletion in 15 days, during which you can cancel it; after that period, it is deleted automatically.
In both cases your personal data is permanently deleted, including your identity at our authentication provider, except for information we must keep due to legal obligations (for example, billing records for the applicable tax period).
If you believe we have not processed your data correctly, you have the right to lodge a complaint with the competent supervisory authority (in Spain, the Spanish Data Protection Agency, www.aepd.es).
8. Security
We apply technical and organizational measures to protect your data: encrypted connections (HTTPS), encryption of access tokens for third-party services, per-user access control and hosting in the European Union.
9. Minors
The service is not aimed at minors and we do not knowingly collect their data.
10. Cookies
We use cookies and similar technologies as described in our Cookie Notice.
11. Changes to this policy
We may update this policy to reflect changes in the service or in the law. We will publish the current version on this page, indicating the last-updated date.