Privacy Policy

This policy explains what data KWScanner ("we", "us") collects, how we use it, and the choices you have. We've kept it short and direct - if anything is unclear, email us at [email protected].

1. Who we are

KWScanner is operated as a software-as-a-service. The service is available at kwscanner.com, the dashboard at app.kwscanner.com, and via our browser extension. References to "the Service" in this policy mean any of those surfaces.

2. What we collect

Account data

• Email address and authentication identifiers, provided through our sign-in partner.
• Account preferences: notification settings, auto top-up configuration, and any other preferences you set in your account.
• Browser extension tokens: when you generate a token to authenticate the extension, we store its hash (not the plaintext token) plus a short prefix for display purposes.

Payment data

We use Stripe to process payments. We never see or store your full card number - Stripe handles the card data directly. We retain the Stripe customer ID, payment method ID (for auto top-up), and transaction metadata required to issue receipts and refunds.

Account activity

• Credit ledger: every purchase, charge, refund, and adjustment is recorded as an immutable ledger entry tied to your account so we can show you accurate balances and history.
• Sign-in events: timestamps and approximate location of recent sign-ins, used for security alerts.

Technical data

• Standard server logs (IP address, user agent, request path, response status) retained for up to 30 days for security and abuse prevention.
• Error reports from your browser when something breaks. We do not attach these to your identity unless you choose to email us about a specific issue.

Analytics and advertising measurement

We advertise KWScanner, and we need to know whether those ads work. For that we collect:

• Site analytics through Google Analytics: pages viewed, approximate location, device and browser type, and how you arrived. Google Analytics sets its own cookies (see section 7).
• Where you first landed: the address of the first page you visited on kwscanner.com and the site that referred you, kept in a first-party cookie for 30 days and, if you sign up, stored against your account so we can tell which pages and campaigns lead to real customers.
• Advertising events sent to Meta (Facebook and Instagram ads): when you view a page, see our pricing, sign up, run your first paid lookup, and buy credits, along with the purchase amount. Events sent from our servers include your email address and account identifier only as a SHA-256 hash, plus your IP address, browser type, and the Meta cookie values from your browser, so Meta can match the event to the ad you clicked. Meta cannot read the hash back into your email address.

Where the law requires it (EU, EEA, UK and Switzerland), none of this is set or sent until you accept it in the cookie banner. Section 7 explains how to change your choice.

Google Ads integration (optional)

If you choose to connect a Google Ads account to push researched keyword lists into your own ad groups, the following additional data is involved:

• Google account email of the account you authorise - stored so you can identify which connection is which.
• OAuth refresh token issued by Google for the Ads scope (https://www.googleapis.com/auth/adwords). The token is encrypted at rest using AES-256-GCM and is used only to act on the Google Ads accounts you explicitly chose.
• Google Ads account metadata we read on your behalf - customer ID, descriptive name, currency, time zone, and the list of your campaigns and ad groups - so the dashboard can render the Campaigns page. We do not store campaign performance metrics, conversion data, or billing data from your Ads account.
• Keywords you push: when you click "Push Keywords to Ad Group", we send the selected keywords, match type, and bid you chose to the Google Ads API on your behalf. From that point on, those keywords are part of your Google Ads account and are subject to Google's own privacy policy and your own Google Ads account controls.

You can disconnect any Google Ads account from the Campaigns page at any time. Disconnecting deletes the encrypted refresh token from our database and revokes our ability to call the Google Ads API on your behalf. It does not remove keywords already pushed into your ad groups - those live in your Google Ads account and must be managed from there.

3. How we use it

• To deliver the service you signed up for: authenticating you, applying credit charges, sending receipts, processing refunds.
• To prevent abuse: rate limiting, fraud detection, account-takeover protection.
• To improve the product: aggregate analytics on which features are used and what error rates look like. Always done on aggregated, anonymised data - never on individual users.
• To communicate with you: transactional emails (purchase receipts, low-balance alerts, refund notifications). You can opt out of non-essential email in your account settings.
• To measure our advertising: to learn which ads and pages bring people who go on to use the product, and to let Meta show our ads to people similar to our customers. We never send Meta what you searched for, your keyword lists, or your balance - only that a signup, first lookup, or purchase happened and the amount paid.

We do not sell your data. Beyond the advertising events described above, we do not share your data with anyone except the processors listed below.

4. Sub-processors

We share account data with these processors to operate the service:

• Authentication provider - sign-in and session management.
• Stripe - payment processing.
• Email delivery provider - transactional email (receipts, account alerts).
• Cloud hosting providers - compute, database storage, and backups.
• Google LLC (Google Ads API) - only if you connect a Google Ads account. We send your selected keywords, match type, and bids to Google to push into ad groups you choose, and we read campaign / ad-group metadata from the accounts you authorised. Use is governed by Google's own Privacy Policy and the Google Ads API policies.
• Google LLC (Google Analytics) - site usage analytics on kwscanner.com. Governed by Google's Privacy Policy; you can opt out with the Google Analytics opt-out add-on or through our cookie banner.
• Meta Platforms Ireland Ltd (Meta pixel and Conversions API) - advertising measurement as described in section 2. Meta acts as a joint controller for this data under its Business Tools terms; its use is governed by the Meta Privacy Policy. You can control how Meta uses data from other websites in your Meta ad preferences.

Each sub-processor has a data processing agreement in place that limits how they may use the data we share with them. Your email address is shared for marketing measurement only with Meta, only as an irreversible hash, and only where you have accepted it if your location requires consent.

5. Your rights

Wherever you live, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong.
• Delete your account and the data attached to it. Deletion is irreversible - your account record and transaction history are removed within 30 days, except where we are legally required to retain certain records (such as tax invoices).
• Export your data in a portable format.
• Object to processing for analytics or marketing, and withdraw consent to analytics and advertising cookies at any time (section 7).

To exercise any of these, email [email protected]. We respond within 30 days.

If you're in the EU/EEA, GDPR applies. The lawful bases we rely on are: contract (delivering the service you signed up for), legitimate interest (preventing abuse, improving the product, knowing which of our own pages lead to signups), and consent (where required, such as marketing email and the analytics and advertising cookies in section 7).

If you're in California, CCPA applies. We do not sell personal information as defined by the CCPA.

6. Security

• All traffic is encrypted in transit (TLS 1.2+).
• Sensitive secrets (API keys, refresh tokens) are stored in a managed secrets store, not in code or version control.
• Production database access is restricted to a small set of operator accounts and audited.
• Browser extension tokens are stored as SHA-256 hashes; the plaintext is shown to you exactly once.
• Google Ads OAuth refresh tokens are encrypted at rest with AES-256-GCM under a key held outside the database; they are decrypted only in memory to make API calls on your behalf.

No system is perfect. If we ever discover a breach affecting your data, we will notify affected users within 72 hours and explain what happened, what we're doing, and what you should do.

7. Cookies

Essential cookies (authentication session, CSRF protection, and kws_consent, which remembers your cookie choice for 180 days) are always set; the service cannot function without them.

Analytics and advertising cookies are set only with your consent where consent is required, and can be declined or withdrawn at any time:

• _ga, _ga_* - Google Analytics, up to 2 years.
• _fbp, _fbc - Meta pixel: a browser identifier and, if you arrived from a Meta ad, the click identifier, up to 90 days.
• kws_landing - our own record of the first page you visited and the site that referred you, 30 days.

If your browser reports a European time zone, you see a banner before any of these are set. Elsewhere they are set on your first visit, and you can turn them off here. Either way, your choice is shared between kwscanner.com and the dashboard.

Change cookie preferences

Declining or withdrawing consent stops new data being collected from your browser; it does not delete data Meta or Google already hold, which you control through their own settings linked in section 4. Blocking these cookies in your browser has the same effect.

8. Children

KWScanner is not intended for use by anyone under 16. We do not knowingly collect data from children. If you believe a child has signed up, contact us and we'll delete the account.

9. International transfers

Our infrastructure is hosted in regions that may include the United States and Europe. When data crosses borders, we rely on the relevant standard contractual clauses approved by the EU Commission.

10. Changes to this policy

We update this policy when our practices change. The "last updated" date at the top reflects the most recent revision. For material changes, we'll email you and post a banner on the dashboard at least 14 days before the change takes effect.

11. Contact

Email us at [email protected] for anything related to this policy or your data.