Privacy Policy

SlapMyWeb respects your privacy. This policy explains what data we collect, how we use it, and your rights under GDPR and CCPA.

• Account data: email, name, hashed password, plan, signup IP
• Scan data: URLs you submit, scan results, screenshots, cached HTML
• Billing data: handled by Stripe — we never see your card number
• Usage data: anonymous analytics (page views, feature usage), error logs
• Communications: support emails, contact-form submissions

• To run audits and deliver scan results to you
• To process billing and send transactional emails
• To improve the Service (anonymized usage analytics)
• To respond to support requests
• To detect abuse and enforce our Terms

We don't sell your data. We share data only with:

• Stripe — for billing and subscription management
• OpenAI / Anthropic — to generate AI roasts and code fixes (audit data only, never PII)
• Google (Gemini API) and Perplexity via Experiential Labs — receive the questions you set for AI visibility checks, and nothing else about your account
• Google PageSpeed Insights API — to fetch CrUX field data for your audited URLs
• Email provider — to deliver transactional emails

If you choose to connect your own accounts, we read this, and only this, for the sites you link:

• Google Search Console (read-only): clicks, impressions, click-through rate and average position by query and page
• Google Analytics 4 (read-only): sessions and engaged sessions by landing page
• Bing Webmaster Tools (using an API key you paste): query statistics and the backlinks Bing reports for your site

Why: only to show you your own site's data inside SlapMyWeb and to send you alerts about it. If you leave weekly check-up emails on, we email you only when something breaks: your score dropped, a new critical issue appeared, more pages are broken, a page that gets search traffic broke (an error, noindex or a redirect), your SSL certificate expires soon, or the site is down. Every email has a one-click switch-off, and there is a toggle on the site's Search performance page. We do not use this data for advertising and we do not sell it.

How long: we keep up to 400 days of daily history. The synced Search Console, GA4 and Bing data and the access tokens (and your Bing key) are deleted straight away when you disconnect Google or Bing, and when you delete your account. Issues already listed in your audit reports (which name the affected pages, not traffic numbers) stay in those reports until you delete them. Tokens and your Bing key are stored encrypted.

You can also revoke Google access at any time at myaccount.google.com/permissions.

SlapMyWeb's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We keep your account data for as long as your account is active. Scan data is retained according to your plan (7 days on Free, unlimited on Pro and Agency). You can delete your account and all associated data at any time from Settings → Danger zone.

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure: delete your data (“right to be forgotten”)
• Portability: export your data in JSON
• Opt-out: stop marketing emails (transactional emails will continue)

We use essential cookies (session token, theme preference) and Google Analytics cookies to measure how the site is used. No advertising cookies.

Passwords are bcrypt-hashed, sessions use signed JWTs, all traffic is HTTPS-only with HSTS, and we keep daily database backups. We follow OWASP best practices and patch dependencies regularly. Found a security issue? Email security@slapmyweb.com.

Privacy questions or data requests: info@slapmyweb.com. We respond within 30 days as required by GDPR.