Privacy policy
What personal data CategoryGap collects, including data from Google Search Console when you connect it, why we use it, who we share it with, how long we keep it, and the rights you have under UK data protection law.
Last updated
1. Who we are
CategoryGap is a trading name of TUN Digital Ltd, a company registered in England and Wales (company number 13464714). Our registered office is 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom.
We are the controller of the personal data described in this policy. This means we decide how and why it is used, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
For anything about your personal data, email hello@categorygap.com.
2. What this policy covers
This policy explains how we handle personal data when you visit categorygap.com, request a report, sign in, buy credits, or receive email from us. CategoryGap is a service for businesses, so the people whose data we hold are mostly employees of our customers.
Your use of the service is also governed by our terms of service.
3. The information we collect
Information you give us
- Your work email address. You give it to us when you request a report or sign in. We use the part after the @ to place you in your company’s account.
- Report details. The category page address and country you enter, and the reports you start.
- Messages. Anything you send when you email us.
Information created when you use the service
- Account records. Your role in your company account (owner or member), whether your access is blocked, and a record of important account changes such as blocking someone or granting credits.
- Billing records. What your company bought, its credit balance and history, and the customer and subscription references Stripe gives us. Stripe collects card details directly; we do not receive or store full card numbers.
- Security and technical data. Your IP address and browser type when you sign in, short-lived counters of sign-in attempts and report requests by IP address and email address, and request logs of which pages were opened.
Information from other sources
- Google Search Console. If you or a colleague choose to connect Google Search Console, we receive read-only search performance data for your website. The Google user data section explains exactly what we access and how we use it.
- Public websites and search data. Reports use publicly available web pages and search data from our search data provider. This is information about businesses and searches rather than about individuals. If an analysed page happens to include personal data, we only process it as part of the analysis. We delete copies of other websites’ pages after 30 days and screenshots of their category pages after 90 days. Website icons and homepage screenshots are refreshed every 30 days.
We do not ask for special category data (such as health or ethnicity), and we do not use advertising or analytics trackers.
4. How we use it and our lawful basis
UK GDPR requires a lawful basis for each use of personal data. Where we rely on legitimate interests, we have weighed them against your rights and expectations as someone using a business service.
| What we do | Lawful basis |
|---|---|
| Sign you in, run your reports, manage your company account and credits, and email you about them | Contract with your company, and our legitimate interest in providing the service your company asked for |
| Take payments and keep invoices and credit records | Contract, and legal obligation (UK tax and accounting law) |
| Show your own Google Search Console positions in your reports, when you choose to connect Search Console | Contract with your company, and our legitimate interest in providing the feature you chose to use |
| Keep the service secure, limit sign-in attempts, refuse personal email addresses, and stop abuse of free reports | Legitimate interests in protecting the service, our customers and our costs |
| Fix problems and understand how the service is used, mostly from counts and logs rather than individuals | Legitimate interests in running and improving the service |
| Respond to lawful requests, enforce our terms, and defend legal claims | Legal obligation and legitimate interests |
We only send emails about your account and reports, such as sign-in links, finished reports and failed payments. We do not send marketing emails. If that changes, every marketing email will include a way to opt out.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our automated checks, such as refusing personal email addresses and limiting sign-in attempts, protect the service and can be reviewed by a person if you contact us.
5. Google user data
Connecting Google Search Console is optional. We offer it before a report starts, and the report runs without it if you decline. This section explains how we handle data we receive from Google when you connect it.
What we access
We ask Google for one read-only permission, https://www.googleapis.com/auth/webmasters.readonly, which lets us view Search Console data for sites the Google account can access. We cannot change anything in Search Console. With it we read:
- the list of Search Console properties the Google account can access, and its permission level for each, so we can pick the verified property that covers the website in your report; and
- for that property only, search performance data for up to the last 90 days: search queries, page addresses, country, clicks, impressions, click-through rate and average position.
We do not ask for, or receive, your Google account’s name, email address, contacts, or any other Google data.
How we use it
We use Search Console data only to provide features you can see in your reports: showing the searches your website already ranks for and your positions, so they are not listed as gaps, and flagging when two of your pages compete for the same search.
We do not use Google user data for advertising, we do not sell it, we do not use it to build profiles of people, we do not use it to decide creditworthiness or lending, and we do not use it to develop, improve or train artificial intelligence or machine learning models. We do not send it to our search data, AI model or page classification providers.
How we store and protect it
- Google access and refresh tokens are encrypted before we store them, and never appear in logs or background task records.
- If none of the Google account’s properties match your website, we do not keep its tokens.
- Search Console data is stored in our database, hosted by Cloudflare, and deleted after 18 months.
Who can see it
Search Console data appears in reports for the matching website, so everyone in your company account (everyone with a confirmed email address at your domain) can see it. Once someone at your company has connected a Google account, later reports for that website use it automatically without asking again. Anyone you send a report share link to can also see that report.
We only transfer Google user data to others where it is needed to provide these features, for security (for example, investigating abuse), to comply with the law, or as part of a merger, acquisition or sale of our business, and in that last case only after getting your explicit consent first.
Our staff do not read your Search Console data unless you ask us to for support and agree to it, it is needed for security (for example, investigating a bug or abuse), the law requires it, or the data has been aggregated and anonymised for our internal operations.
Removing access and deleting data
You can remove CategoryGap’s access at any time in your Google Account at myaccount.google.com/permissions. We then cannot read any new data, and the next report will offer to connect Search Console again. To have the Search Console data and tokens we hold deleted, email hello@categorygap.com. We will delete them within one month.
Google API Services User Data Policy
CategoryGap’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. International transfers
Some of our providers process data outside the UK, including in the United States and the European Economic Area. When they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or on the International Data Transfer Agreement or Addendum approved by the Information Commissioner, together with any extra safeguards needed. Email us for more detail on the safeguard for a particular provider.
8. How long we keep it
We keep personal data only for as long as we need it. Our main retention periods are:
| Information | How long we keep it |
|---|---|
| Your email address, role and account membership | While your company account is open, or until you ask us to delete it |
| Sign-in links | 15 minutes, and each link works once |
| Signed-in sessions, including IP address and browser type | About 14 days after you last use the service |
| Report requests that were never confirmed | 7 days |
| Request logs | 30 days |
| Background task records, which can include your email address | 90 days, or 365 days if the task failed |
| Copies of other websites’ pages and unaccepted page previews | 30 days |
| Screenshots of category pages compared in a report | 90 days |
| Google Search Console data | 18 months |
| Encrypted Google Search Console access tokens | Until you ask us to delete them or your company account is closed. They stop working as soon as you remove our access in your Google Account |
| Payment, invoice and credit records | 6 years from the end of the financial year they relate to, as UK tax law requires |
We may keep information for longer if we need it to resolve a dispute, enforce our terms, or meet a legal obligation.
10. How we protect it
All traffic to CategoryGap is encrypted with HTTPS. We store sign-in and session tokens only as one-way hashes, encrypt Search Console tokens, check who is allowed to see each report on every request, limit repeated sign-in attempts, and restrict staff access to what they need. No system is completely secure. If a breach affects your data, we will tell you and the Information Commissioner’s Office where the law requires it.
11. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests;
- ask for data you gave us in a portable, machine-readable format; and
- withdraw consent at any time, where we rely on consent.
Some rights depend on the lawful basis and have exceptions. For example, we must keep billing records for tax purposes even if you ask us to delete them.
You can also remove CategoryGap’s access to Google Search Console at any time in your Google Account, as described in Google user data.
To use any of these rights, email hello@categorygap.com. We may need to confirm your identity first, usually by replying from your work email address. We will respond within one month, and there is normally no charge.
12. Complaints
If you are unhappy with how we have handled your data, please contact us first at hello@categorygap.com so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.
13. Children
CategoryGap is a business service and is not intended for anyone under 18. We do not knowingly collect data from children.
14. Changes to this policy
We will update this policy when the way we handle personal data changes. The date at the top shows when it last changed. If a change significantly affects how we use your data, we will email account members before it takes effect.
15. Contact us
Email hello@categorygap.com, or write to TUN Digital Ltd, 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom.