Privacy Policy
Last updated: 10 November 2026
Search Scanner AI is a Ucartz service
The app is operated by Ucartz Online Private Limited. The pages here describe this app. The Ucartz company policies also apply, and for anything these pages do not cover, they govern. Where this app page is more specific, it takes precedence for this app.
1. Who we are and how this relates to Ucartz
Search Scanner AI ("the app", "we") checks websites for SEO problems. It is a service of Ucartz Online Private Limited ("Ucartz"), which decides why and how the app's personal data is processed: Ucartz is the data controller (GDPR) and the Data Fiduciary (India's DPDP Act) for it.
This policy covers the app at search-scanner.ucartz.com. It adds detail to the Ucartz Privacy Policy, which also applies. More on your rights: our GDPR and DPDP pages.
Your app account is separate from a Ucartz client area (hosting) account. We do not copy app data into the Ucartz client area, billing system or mailing lists, and the app does not send marketing email.
2. Google sign-in and the data we get from Google
You sign in with Google. We ask for the scopes openid, email and profile only. From Google we receive:
- your email address (we require that Google has verified it),
- your name,
- your profile picture address,
- your Google account identifier (the "sub" value).
We use this only to create and recognise your account, sign you in, and show your name and picture in the app. We do not access Gmail, Drive, Calendar or contacts.
Google Search Console (optional). If you choose "Connect Search Console" for a site, we ask Google for one more permission, webmasters.readonly, with offline access so we can refresh the data daily. We use it only to list your Search Console properties and read search performance (clicks, impressions, click-through rate and average position per page) for the site you connected. We never change anything in Search Console. The Google refresh token is stored encrypted, is never shown, and is deleted and revoked at Google when you disconnect the last site that uses it. The search data is shown only to you, next to your audit results.
Our use of information received from Google follows the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, do not transfer it to data brokers, and nobody reads it except as needed for security, to follow the law, or with your agreement.
3. What we store
| Data | What it is |
|---|---|
| Account | Email, name, picture address and Google account id; your plan limits. For the few accounts given a password login, a bcrypt hash of the password (never the password). |
| Your sites | The domains you add, sitemaps you list, a verification token per site and how it was verified, and, if you use IndexNow, its public key and the last submission result. |
| Search Console data | If you connect Search Console: the Google account email used, an encrypted refresh token, the chosen property, and per-page clicks, impressions, click-through rate and average position for the last 28 days. |
| Scan results | Facts about pages of your sites (see section 4), the problems found, scores, and decisions you make such as setting a problem aside. |
| PageSpeed results | Speed, accessibility and best-practice scores for some pages, when an administrator has turned this on. |
| Session | A random token in a cookie. We store only a SHA-256 hash of it. |
| AI connections | If you connect an AI assistant (section 7): the app name it registered, the permission you granted, and hashes of its access tokens. |
| System log | Short messages about scans and sign-in attempts. For sign-in events we keep only a shortened IP address (last part removed). Secrets are stripped before anything is logged. |
| Homepage check (no account) | The domain entered, the totals shown, and a salted hash of your IP address to limit abuse. No readable IP address is kept. |
| Server logs | Our web server records requests (IP address, time, address requested, browser) for security and operation. |
4. Websites you scan
When you add a site, our crawler (UcartzSEOBot, see /bot) fetches its public pages, obeying robots.txt. We store addresses, status codes, titles, descriptions, headings, text statistics with short text samples, structured data, links, and facts about images, scripts and stylesheets. Links to other websites are listed but never visited. We also note which Google tags (Tag Manager, Analytics, Ads) a page loads, from its HTML only. We do not log in to sites, fill in forms, or read anything that is not publicly served.
Public pages can contain personal data (for example a staff name on a contact page). We process that only to produce your report, on your instruction, and for no other purpose. You are responsible for having the right to scan the sites you add (see the Terms).
5. Why we use it (purposes and legal bases)
| Purpose | GDPR basis | DPDP basis |
|---|---|---|
| Create your account, sign you in, run scans and show reports | Contract (Art. 6(1)(b)) | Consent you give at sign-in, and data you provide voluntarily for this purpose (Sec. 6, 7(a)) |
| Apply plan limits, prevent abuse, secure the service, fix faults | Legitimate interest (Art. 6(1)(f)) | Legitimate use (Sec. 7) |
| Homepage check without an account (hashed IP for rate limits) | Legitimate interest | Legitimate use |
| Keep records and answer lawful requests | Legal obligation (Art. 6(1)(c)) | Legal obligation (Sec. 7) |
We do not use your data for advertising, profiling or automated decisions about you, and we do not sell it.
6. Who we share it with
- Ucartz. The app is run by Ucartz staff on Ucartz-operated servers; access is limited to people who need it to run and support the service.
- Google sign-in. When you sign in, Google knows you signed in to our service.
- Google PageSpeed Insights. Only if an administrator has enabled it, addresses of some pages of your sites are sent to Google's PageSpeed API to measure them. No account data is sent.
- Google Search Console. Only if you connect it: we call Google's Search Console API with your permission to read your search data. We send Google nothing but the requests for your own properties.
- IndexNow. Only if you switch it on for a verified site: after each scan, the addresses of new or changed public pages of that site are sent to the IndexNow service (api.indexnow.org), which shares them with participating search engines such as Bing, Yandex, Seznam and Naver. No account data is sent.
- AI assistants you connect. Only what you allow, see section 7.
- Legal. Authorities, when the law requires it.
We use no analytics, advertising or tracking provider in the app.
7. AI assistants you connect
In Settings, "Connect AI" lets you link an AI assistant (for example Claude) to your account through OAuth. You approve it on a consent screen. With read permission it can read your sites, scan results and problems; with write permission it can also start, stop and resume scans. It cannot delete anything. Data it reads is then handled by that assistant's provider under its own privacy policy. You can disconnect it at any time in Settings; access tokens expire after 1 hour and refresh tokens after 30 days.
8. Where your data is stored
The app runs on a server operated by Ucartz in the United States. If you use the app from India, the EU or the UK, your data is transferred there. We protect transfers as described in the GDPR and DPDP pages.
9. Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you signed in (HttpOnly, Secure, SameSite=Lax). | 7 days, or until you sign out |
g_oauth | Protects Google sign-in against forgery (state, nonce, PKCE). | About 10 minutes |
Both are strictly necessary, so no consent banner is needed. We set no analytics or advertising cookies. Your browser also remembers which site you picked and similar view settings in local storage; that stays on your device. The ucartz.com website has its own cookie notice in the Ucartz Privacy Policy.
10. How long we keep it
- Site data and scan results: until you remove the site or use Clear data on it.
- System log events: deleted 30 days after they were last seen.
- Homepage check records: 30 days.
- AI connection tokens: until they expire or you disconnect.
- Account data: while your account exists; deleted when you ask us to close it, except what the law requires us to keep.
- Server and security logs: as set out in the Ucartz DPDP policy (section 9), which follows the CERT-In directions.
11. Security
All traffic uses HTTPS. Session and access tokens are stored only as hashes. API keys saved by administrators are never shown again or written to logs. The crawler cannot reach private or internal networks. Access to the server is restricted to authorised Ucartz staff. If a breach affects your personal data, we will tell you and the authorities as the GDPR and the DPDP Act require.
12. Your rights and deleting your data
You can ask for a copy of your data, a correction, or deletion of your account, and you can object to or restrict processing or withdraw consent. In the app, Settings lets you remove a site (this deletes its data) or clear a site's data. Deleting the whole account is not a button yet: email compliance@ucartz.com from your account address and we will do it. You can also revoke our access in your Google account settings at any time. We reply within 30 days. Full details: GDPR rights, DPDP rights.
Site owners who do not want to be crawled can disallow UcartzSEOBot in robots.txt or write to abuse@ucartz.com.
13. Children
The app is for businesses and people aged 18 or older. We do not knowingly collect data from anyone under 18.
14. Changes
We may update this policy. The date at the top shows the latest change. Material changes are announced in the app before they take effect. If we change how we use Google data, we will ask you first.
15. Contact
| Operator | Ucartz Online Private Limited (CIN U72200KL2017PTC048470, GSTIN 32AACCU0519P1ZA) |
|---|---|
| Registered office | Near LP School, Agasthiyacodu, Anchal, Kollam, Kerala 691306, India |
| Operations | Opposite to Phase 3 Gate, Technopark, Trivandrum, Kerala, India |
| Privacy requests, DPO (EU and UK), Grievance Officer (India) | compliance@ucartz.com (grievance desk: grievance@ucartz.com) |
| Support | info@ucartz.com or a ticket in the Ucartz client area; phone and WhatsApp +91 7034004444 |
| Abuse and crawler complaints | abuse@ucartz.com |
Privacy Policy · Terms of Service · Acceptable Use · GDPR · DPDP (India) · Contact