SearchedBy: Privacy Notice

Version 0.10 · 31 Oct 2026 · under legal review

1. Controller

Pablo Pavon (SearchedBy), Zähringerstraße 24, 10707 Berlin, Germany · [email protected].

There is no data protection officer: German law requires one from 20 people regularly processing personal data (§ 38 BDSG).

2. What data we process and where it comes from

Visiting the website: every request passes through Cloudflare, which connects our server to the internet and processes the IP address, the time, the address requested and browser details. Our server keeps technical logs of the requests to run and secure the service.
Step 1 of the scan: the website and the email address.
Step 3 of the scan: brand, market, what is sold, city and competitors (city and competitors are optional) and, when one is asked for, an invitation code.
For verification: the 6-digit code (we store only its cryptographic fingerprint), when it was sent and how many attempts were made.
To stop abuse: a keyed fingerprint (made with a secret key) of the IP address, or of its IPv6 /64 block, and of the email address, to count requests per network, per mailbox and per email domain. Our database keeps the fingerprint, not the IP address.
Cloudflare's anti-bot check (Turnstile): it loads only once someone starts using the scan form, not when a page opens. Cloudflare processes browser signals such as the IP address, TLS fingerprint and User-Agent.
From the website analysed: a few public pages, which may contain third parties' data. We keep only what the report needs. Links to social media profiles found on those pages are listed in the report; we do not visit the social networks.
The AI engines' answers: they may name companies and, sometimes, people, for example a professional who works under their own name. We keep them as part of the report.
Request for the 48-hour diagnosis (optional): markets, goal, who maintains the site, platform, competitors, links to reviews and to social profiles, which tools are in use, planned changes, budget and whether a call is wanted, together with a keyed fingerprint of the IP address.
Feedback form under the report (optional): a rating, a name if given and free text.
Emails to our address: the sender's address and what the message contains.

The email address is stored encrypted: each record has its own random value and an integrity check, and the key stays on the server. A copy of the database cannot be read without it.

3. Purposes and legal bases

Sending the code, running the scan, showing the report and sending its link: performance of the service requested (Art. 6(1)(b) GDPR).
Fingerprints, limits, Turnstile and the server's technical logs: legitimate interest in protecting the service and its costs against abuse (Art. 6(1)(f) GDPR). Turnstile also because it is necessary for the service requested (§ 25(2) no. 2 TDDDG).
Quality review: the operator receives an internal control message for each scan, with the result and the requester's email address, to check the result and, if needed, write to them about that scan. Basis: legitimate interest (Art. 6(1)(f) GDPR).
The 48-hour diagnosis request: steps prior to a contract, taken at the requester's request (Art. 6(1)(b) GDPR).
Feedback: legitimate interest in improving the service with what its users say (Art. 6(1)(f) GDPR).
People named in the AI answers: legitimate interest in showing what the engines say about a market (Art. 6(1)(f) GDPR).
Marketing emails: only with consent, which can be withdrawn at any time (Art. 6(1)(a) GDPR and § 7(2) UWG); see section 8.

4. Recipients

We use these providers, which act as processors (Art. 28 GDPR) unless stated otherwise:

Hetzner Online GmbH, Germany: the server, in a data centre in Germany.
Cloudflare, Inc., USA: the connection between the internet and our server, the domain's name service, the anti-bot check (Turnstile) and the forwarding of emails sent to our address. To improve Turnstile, Cloudflare acts as a controller in its own right.
Sending emails (the code, the report link and replies): Zoho Corporation B.V., Netherlands, which stores the data in the EU; its support staff in India may access it under standard contractual clauses. Sending is moving to Brevo (Sendinblue SAS, France); from then on, Sendinblue SAS receives the same data for the same purpose.
Google: emails sent to our address are forwarded to the operator's mailbox at Google (Gmail).
Fontshare (Indian Type Foundry): when the pages open in English, Spanish or German, the browser requests the typefaces from it, which passes it the IP address. The Hebrew pages do not load these typefaces.
Google (Chrome UX Report), only when real-user speed data is requested: it receives the website's address, never the email address.
For the AI sample, the questions, which carry the website, brand, market, what is sold, city and competitors, go to: Anthropic Ireland, Limited (Claude, with web search; processing takes place in the USA, where its search providers, among them Brave, are also located); OpenAI (ChatGPT; USA); Perplexity AI, Inc. (USA); and, when Google's AI answers are measured, DataForSEO OÜ (Estonia). They never receive the email address.

5. Transfers outside the European Economic Area

Several providers are in the USA (Anthropic's processing and its search providers, OpenAI, Perplexity and Cloudflare) or access data from outside the EEA (Zoho's support in India). The transfer relies on the European Commission's standard contractual clauses (Decision 2021/914); for Cloudflare, which is certified, also on the EU-U.S. Data Privacy Framework. A copy of the safeguards can be requested at [email protected].

6. How long we keep data

Verification code fingerprint: deleted when the email is verified or, if nobody uses it, at the latest one day after it expires (it expires after 15 minutes).
Abuse counters: the IP and email fingerprints in them are deleted after 30 days. Those in each scan's record are kept while the scan exists.
Report, input data, email address, AI answers, diagnosis requests and feedback: kept to provide the service and follow up on it. There is no automatic deletion yet: until there is, we delete them at any time on request, and we will state the period here.
Proof of consents and the suppression list: only a fingerprint of the email address, kept for as long as we must be able to prove a consent or honour an unsubscribe.
At the providers: each keeps requests under its own terms. According to their published terms, Anthropic and OpenAI keep them up to 30 days (longer if a request is flagged for abuse) and DataForSEO up to 12 months.

7. Rights

At [email protected] anyone can ask for:

access, rectification, erasure, restriction, portability and objection (Art. 15 to 18, 20 and 21 GDPR);
withdrawal of consent, at any time, without affecting what was done before.

Anyone may also complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit); the authority where the person lives can also be used.

Anyone named in a report can ask us to correct or remove the mention: how we read sites.

8. Marketing emails

We do not send marketing emails at the moment. If we offer them, we will ask separately, after the email is verified, with two independent choices (Yes / No) and nothing pre-selected; the scan is provided without agreeing, and every marketing email will have a one-click unsubscribe link.

You can object at any time to the use of your data for marketing.

9. Is giving the email address required?

No law requires it, but without it we cannot send the code or the report link, so there is no scan.

10. Automated decisions

We make no automated decisions with legal effects on people (Art. 22 GDPR). The abuse limits only stop repeated requests.

11. Browser, cookies and pixels

We set no cookies of our own and use no advertising or analytics cookies, and the emails contain no tracking pixels. Turnstile loads only once someone starts using the scan form.

12. The report link

The report is at an unlisted link: anyone who has it can open it. Report pages are not indexed by search engines and do not pass their address on to other sites.

13. Changes and version

Version 0.10 of 31 October 2026. We update this notice when the service or its providers change; earlier versions remain archived.