Privacy Policy
This policy explains what personal data Traffic Wonk Limited collects when you use TrafficWonk, why we collect it, who we share it with and what rights you have over it.
- We do not sell your personal data, and we never have.
- We use no advertising or analytics cookies and run no third-party tracking scripts. The only cookie we set is the one that keeps you signed in.
- If you connect Google Search Console or Google Analytics, we request read-only access and use that data solely to produce your reports. We never write to your Google account.
- Card details never reach our servers — payments are handled entirely by Stripe.
- You can delete your account, and the personal data attached to it, from your account settings at any time.
Contents
1. Who we are
TrafficWonk is operated by Traffic Wonk Limited, a company registered in England and Wales under company number 13477360, with its registered office at Broadclough Farm, Burnley Road, Bacup, Lancashire, OL13 8PS, England.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Traffic Wonk Limited is the data controller for the personal data described in this policy. You can reach us at hello@trafficwonk.com.
2. What we collect, and why
We collect only what the service needs in order to work. The table below lists every category of personal data we hold, why we hold it and the lawful basis we rely on.
| Data | Why we hold it | Lawful basis |
|---|---|---|
| Account identity — your name, email address, profile picture and Google account identifier, received from Google when you sign in with Google | To create and secure your account, identify you when you sign in, and contact you about the service | Performance of a contract |
| Password — if you register with an email address and password rather than Google, we store a cryptographic hash of your password, never the password itself | To authenticate you | Performance of a contract |
| Optional contact details — phone number and postal address, only if you choose to add them in your account settings | To contact you about your account and, where relevant, for invoicing | Performance of a contract |
| Google Search Console and Google Analytics data — search queries, impressions, clicks, positions, pages and traffic metrics for the properties you connect, together with the OAuth tokens needed to fetch them | To produce the visibility reports, scores, opportunities and alerts that are the service you signed up for | Performance of a contract |
| Websites you analyse — the domains you submit or claim, and the technical and visibility data we derive about them | To deliver your reports and maintain your dashboard | Performance of a contract |
| Billing records — your Stripe customer and subscription identifiers, your plan, and your billing history as held by Stripe. We never receive or store your card number, expiry date or security code. | To take payment, manage your subscription and meet our accounting obligations | Performance of a contract; legal obligation |
| Email preferences and delivery records — whether alerts are enabled, how often, and a record of the alert emails we have sent you | To send the alerts you asked for and to avoid sending duplicates | Performance of a contract; legitimate interests |
| Technical logs — including your IP address, the time of the request and the page or endpoint involved | To keep the service available and secure, diagnose faults, and rate-limit abuse. IP addresses are used for rate limiting in memory only and are not written to our database; they appear in short-lived server logs | Legitimate interests — securing and maintaining the service |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and we have limited what we collect accordingly. You can object to that processing at any time — see Your rights.
What we do not collect
- We do not collect special category data (such as health, biometric, racial or ethnic, political, religious or sexual-orientation data), and we ask you not to submit it.
- We do not build advertising profiles, and we do not use your data to train AI models.
- We do not buy personal data from data brokers to enrich your account.
3. Google user data
Connecting Google Search Console or Google Analytics is entirely optional — TrafficWonk works without it, with a reduced feature set. When you do connect, we request these scopes and no others:
openid,email,profile— to identify you and create your accountwebmasters.readonly— read-only access to your Search Console dataanalytics.readonly— read-only access to your Google Analytics data
These scopes give us no ability to modify, publish or delete anything in your Google account. We read your data, derive your scores and reports from it, and show those back to you.
TrafficWonk's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not transfer Google user data to third parties except as necessary to provide or improve the service, we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.
You can disconnect Google at any time from your account settings, which removes our stored access and refresh tokens. You can also revoke access directly from your Google account permissions page.
4. Cookies
TrafficWonk sets one cookie. We run no advertising cookies, no analytics cookies and no third-party tracking scripts, which is why you are not asked to accept a cookie banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
tw_session |
Keeps you signed in between visits. It is strictly necessary for the service to work
and is set only once you sign in. It is an HttpOnly, Secure
cookie, so it cannot be read by scripts in your browser. |
30 days |
Signing out deletes this cookie. Because it is strictly necessary for a service you have requested, we rely on the exemption in the Privacy and Electronic Communications Regulations rather than asking for consent.
Your browser may also store small amounts of data locally — for example, whether you prefer the light or dark theme. That stays in your browser and is never sent to us.
5. The public directory and our crawler
TrafficWonk publishes a public directory of websites and their visibility scores. The data behind it is gathered by our own declared crawler, TrafficWonkBot, from publicly accessible web pages. Its full behaviour is documented on our bot policy page.
What we collect about a website is business and technical information — its visibility and citation signals, technology, performance characteristics, and links it publishes, including links to social profiles. We do not harvest email addresses or contact details from the pages we crawl.
Most of this is information about organisations rather than people, and is not personal data. However, where a website belongs to a sole trader or an individual, information about that site may relate to an identifiable person. Where that is the case we rely on our legitimate interests in operating a public visibility index, and we balance that against the rights of the individual concerned. Because we collect this information from public web pages rather than from you directly, this section also serves as the notice required by Article 14 of the UK GDPR.
How to be excluded
- Add
User-agent: TrafficWonkBotandDisallow: /to yourrobots.txt. The crawler stops at its next robots check. - Or email bot@trafficwonk.com with your domain, and we will remove it from the crawl queue within 24 hours.
- To have an existing directory profile removed, email hello@trafficwonk.com with the domain.
6. Who we share data with
We do not sell personal data and we do not share it with advertisers. We do use a small number of service providers who process data on our behalf, under contract and on our instructions:
| Provider | What it does | What it receives |
|---|---|---|
| Sign-in, Search Console and Analytics data | Your Google account identity and the API requests we make on your behalf | |
| Stripe | Payments and subscription management | Your name, email address and payment details, entered directly with Stripe |
| Resend | Sending alert and service emails | Your email address and the content of the email |
| Railway | Application and database hosting | All service data, as our hosting provider |
| Anthropic, OpenAI | Running the AI visibility probes | Category-level prompts only — see AI processing |
| DataForSEO | Search ranking data | Domains and search terms being analysed |
| ScreenshotOne | Website screenshots for profiles | The public URL being captured |
| IPinfo | Identifying where a website is hosted | The IP address of the website being analysed, not yours |
We may also disclose personal data where we are required to by law, to enforce our agreements, or to protect the rights, safety or property of Traffic Wonk Limited, our users or the public. If our business is sold or reorganised, personal data may transfer to the acquirer, and we will tell you before that happens.
7. AI processing
A core part of TrafficWonk measures whether AI assistants mention a brand when asked about its market. To do that we send prompts to Anthropic and OpenAI and analyse what comes back.
Those prompts are category-level questions — for example, "Top PPC agencies in the UK for small businesses". They do not contain your name, your email address, your account details or your Google data. Responses are cached against the prompt and model, not against your account, so the same question asked for two different customers is not sent twice.
We do not use your personal data to train AI models, and we do not permit our providers to do so with data we send them.
8. International transfers
Some of the providers listed above are based outside the United Kingdom, principally in the United States. Where personal data is transferred outside the UK, we rely on the safeguards permitted under UK data protection law — an adequacy decision covering the destination country, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, as appropriate to the provider.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data | For as long as your account is open, and deleted when you delete your account |
| Session cookie | 30 days, or until you sign out |
| AI visibility history | 365 days |
| AI probe run records | 90 days |
| Alert delivery records | 90 days |
| Cached website profile data | Refreshed on a 7-day cycle |
| Billing and accounting records | Six years after the end of the relevant financial year, as required by UK tax law |
| Server logs | Short-lived, retained only as long as our hosting provider keeps them for operational purposes |
When you delete your account we remove your user record, your visibility history, your alert delivery records and your stored Google tokens, and we unlink any website profiles you had claimed. Public directory entries for a website are not personal data tied to your account and remain in the directory — see the directory section for how to have a profile removed.
10. Your rights
Under UK data protection law you have the right to:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct data that is inaccurate or incomplete.
- Erasure — ask us to delete your personal data. You can do this yourself at any time from your account settings.
- Restriction — ask us to limit how we use your data while a concern is resolved.
- Portability — ask for your data in a structured, machine-readable format.
- Objection — object to processing we carry out on the basis of legitimate interests, including the public directory.
- Withdraw consent — where we rely on consent, withdraw it at any time without affecting processing already carried out.
To exercise any of these rights, email hello@trafficwonk.com. We will respond within one month. We do not charge a fee unless a request is manifestly unfounded or excessive.
You can also unsubscribe from alert emails using the link in any alert, or by turning alerts off in your account settings.
If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would appreciate the chance to resolve it with you first.
11. Security
The site is served over HTTPS throughout. Session cookies are HttpOnly and
Secure, so they cannot be read by browser scripts. Passwords, where used, are
stored only as cryptographic hashes. Access to production systems is restricted to those who
need it.
No system is perfectly secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and tell you where the law requires it.
12. Children
TrafficWonk is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the service changes. The effective date at the top of the page always reflects the current version. Where a change materially affects how we use your personal data, we will tell you by email or through the service before it takes effect.
14. Contact us
For any privacy question, or to exercise your rights:
hello@trafficwonk.com
For crawler and directory removal requests:
bot@trafficwonk.com
By post:
Traffic Wonk Limited, Broadclough Farm, Burnley Road, Bacup, Lancashire, OL13 8PS, England