Privacy Policy

This policy explains what the AHX SEO Labs Chrome extension (“the extension”) and this website, seo.ahxlabs.com, collect, why, and what control you have. AHX SEO Labs is made by AHX Labs (“we”, “us”). For our company website, see the AHX Labs privacy policy.

Summary

• Page checks run in your browser. Nothing is sent to us until you agree to it.
• Google access is read-only. We never change your website, Search Console or Analytics.
• We use Google data only to show it to you and to build the reports you ask for.
• We never sell your data, never use it for advertising, and never use it to train AI models.
• We share Google user data only with the service providers that run our features, as listed in Who we share Google user data with.
• You can delete your account and all of your data from the extension’s Settings at any time.

What stays in your browser

When you open the side panel, the extension reads the page you are viewing (for example its title, headings, links, images, tags and structured data) and checks it. To compare versions of a page or scan a site, it loads pages of that website from your browser. This happens on your device.

The accessibility check runs axe-core, an open-source engine that is part of the extension, inside the page you are viewing. The bits of page HTML it shows you stay in your browser. If you are signed in, we save only which checks failed and how many elements were affected, not the page's HTML.

The extension stores your settings, recent results and a random installation ID in Chrome’s local storage on your device. Scan keys you create in the extension stay in your browser. Scan keys you create in the dashboard for server scans are stored encrypted on our servers and sent only to that site, by our crawler. The extension only reads websites when you open the panel or start a scan, and asks your permission before accessing a website’s pages for a scan.

This website

seo.ahxlabs.com uses Google Analytics to understand which pages are useful: pages visited, how you arrived, your approximate location (country or city), device and browser type. If you choose “Accept all” in the cookie notice, or switch Analytics on under “Customise”, Google Analytics uses cookies to recognise return visits. If you leave Analytics off under “Customise”, or haven’t chosen yet, it sets no cookies and sends only anonymous visit data without identifiers, which Google uses to estimate overall traffic. You can change your choice at any time with “Cookie settings” at the bottom of every page. Google’s advertising features are turned off, so this data is not used for ads. Learn how Google uses information from sites that use its services. The extension itself does not use Google Analytics.

Your Google data

Signing in with Google is optional. If you sign in, the extension asks for these permissions:

We never write to or change anything in your Google accounts. The extension also downloads Google Search Status Dashboard incidents to show known Google issues, which involves no personal data.

Website sign-in and stored access

If you sign in on seo.ahxlabs.com, Google gives AHX a refresh token so our servers can read your Search Console and Analytics data for site audits and your dashboard without the extension open. We store it encrypted (AES-256, with a key kept only on our servers, separate from the database) and use it only for the features above. It is deleted when you delete your account, and stops working at once if you remove AHX at myaccount.google.com/permissions.

Bing Webmaster Tools (optional)

If you connect Bing Webmaster Tools, Microsoft gives AHX read-only access (webmaster.read) to the sites in your Bing account. We use it to show your Bing search clicks, impressions and searches, Bing's crawl statistics, which of your pages Bing has crawled, and your sitemaps in Bing. Bing's refresh token is stored encrypted, like Google's, and deleted when you disconnect Bing or delete your account; you can also remove AHX in your Bing Webmaster Tools settings. We never change anything in your Bing account.

Who we share Google user data with

We do not sell, rent, share, transfer or disclose Google user data, or any information obtained through Google APIs, to third parties, except when it is needed to provide the features you use (to the service providers listed below) or when the law requires it.

“Google user data” means the data we receive through Google sign-in and the Google APIs above: your name, email address and Google account ID, your Google access and refresh tokens, and your Search Console and Google Analytics data. We do not sell Google user data, and we do not share, transfer or disclose it to advertisers, data brokers, information resellers or anyone else for their own purposes. We share it only with the recipients below, only the part each one needs, and only to provide the features you use:

We may also disclose Google user data if the law requires it, to protect people’s safety or prevent abuse, or as part of a merger or sale of AHX Labs, in which case this policy and the Limited Use requirements continue to apply to it. We share no Google user data with anyone else.

Site audits

When you start a site audit, our crawler visits the pages of that website from our servers, the way a search engine would: it follows robots.txt, slows down when a site asks it to, and stops if the site's firewall blocks it. You can only audit sites you manage in Search Console, which we check with Google before each scan. For accessibility checks, it also opens a small sample of those pages in a browser on our server. We save the pages found, the problems detected (including short excerpts of the public page HTML where an accessibility problem was found), the Google data used and the reports, so you can see and download them later.

To show Google's Lighthouse results, we send the address of the page to Google's PageSpeed Insights API, which tests the public page. No personal data is included.

Data saved to your account

Before anything is sent to our servers, the extension shows you what it saves and asks for your permission. If you decline, the extension still works, but nothing is saved to our servers. If you agree, we save:

• Account details: your name, email address, profile picture and Google account ID.
• Pages you check: the address of each page, what the check read from it (such as title, headings, links and tags), the problems found, speed results, and accessibility results (which checks failed and how many elements, without the page's HTML).
• Site scans: the pages scanned on sites you verify you manage, the problems found and the reports you create or download.
• Search Console data: clicks, impressions, search queries, index status and URL inspection results for the sites you view.
• Google Analytics data, only if you connect it: page and channel totals for visits, engagement and conversions.
• How you use the extension: which features you use, session length, errors, extension version, browser language, screen size, and when the extension is installed, updated or removed. If you remove it, the page that opens lets you pick a reason and, if you want, write a comment; we keep both with your installation ID. We use this only to fix problems and improve the product.
• Security logs: for each request to our servers, the IP address it came from, the browser's user agent, the time and the address requested. We use these only to keep the service secure, prevent abuse and fix errors. An IP address can show your approximate region; we don't collect precise location.

To show speed from real visitors, we send the address of the page you are checking to Google’s Chrome UX Report API from our server and return the result. No personal data is included in that request.

We use this data only to provide the extension’s features to you: showing your data, saving your history, building your reports, keeping the service secure, and fixing bugs. We don’t use it for advertising and we don’t sell it.

Visitor measurement on websites (pilot)

A website owner who uses AHX can add a small AHX script to their site to see what their visitors experience. If you visit such a website, the script sends short reports about the pages you view there, to AHX, for that website's owner:

• Pages and timing: each page's path (without the part after “?” or “#”, and with numbers, IDs and email addresses in the path replaced), the website that linked to it (its name only), the width of your browser window, how long you were active on the page, how far you scrolled, the heading on screen when you left, and page speed measurements.
• What you clicked: the visible label of links and buttons you click (for example “Apply now”) and where a link goes on that website. Never anything you type.
• Problems on the page: JavaScript errors, requests to that website that fail (only the address and the error status, never what was sent or received), short error messages the page shows (for example “Incorrect password”), the names of form fields the page marks as invalid (never their values), and repeated fast clicks on one element. Email addresses, long numbers and codes are removed from all text.
• Goals the website marks, such as reaching a sign-up page.
• Your visit: a random visit ID, kept in your browser for that website only, links the pages of one visit (including pages you open in new tabs) to group observations; explicit parent links form navigation branches, including separate tabs. Missing reports and excluded paths leave gaps. It is not a cookie, it is replaced after 30 minutes without activity, and it is never reused for later visits or other websites. The owner can turn this off.
• What it never sends or stores: cookies, an ID that follows you across visits or websites, anything you type, passwords, the rest of the page's text (only the labels, headings and messages listed above) or your browsing history. Site owners can also mask labels, headings and messages on any part of their pages. AHX doesn't keep your IP address with these reports; it is used only briefly to limit abuse and to look up your country, which is stored.
• If your browser asks not to be tracked (Global Privacy Control or Do Not Track), the script sends nothing.
• How long: page reports are deleted after 90 days. Daily totals per page (counts and averages, with no individual visits) are kept for the website owner's account.
• Who sees it: only the website's owner, in their AHX dashboard. It shows counts, averages and anonymous example visits. Reports do not show the random visit identifier or your IP address. Collected labels, headings and alerts can still contain personal information if the website displays it; owners should mask sensitive elements or all text and exclude sensitive paths. Uncaught script errors use generic messages unless the owner explicitly enables cleaned error text. We don't sell it or use it for advertising.

For these reports, AHX works on behalf of the website's owner, who decides to use it and, where the law requires it (for example in the EU and UK), asks for your consent first. Questions about a specific website go to its owner; you can also write to support@ahxlabs.com.

AI reports and keyword ideas

Audit summaries may be generated as part of a site audit when included in your plan. Investigations, reviews and keyword ideas run when requested. We then send a summary of that site’s findings, together with related Search Console and Analytics figures, to the AHX Labs agent, which writes the explanation. The agent uses an AI model from a third-party provider. We send only what that report needs, and do not include your name or email address. Keyword ideas work the same way: the agent receives the topic you enter and your matching Search Console searches with their positions, and groups them.

The provider processes this data under paid business terms: it is not used to train or improve AI models, and it is used only to produce your report. Report summaries and investigations select approved evidence and recommendations by identifier; AHX renders the factual text. This prevents arbitrary model prose from becoming a measured claim. Model selections can still be mistaken and should be reviewed.

Service providers

We share data only with companies that help us run the service, only as far as needed, and under contracts that limit how they can use it:

• Hosting and database providers, which store the data saved to your account.
• Google, for Google Analytics on this website, sign-in, the Search Console, Analytics, Chrome UX Report and PageSpeed Insights APIs.
• An AI model provider, used by the AHX Labs agent for AI reports and keyword ideas, under paid business terms that do not allow it to use the data to train or improve its models. See AI reports.
• Microsoft, for the Bing Webmaster Tools API, only if you connect Bing.
• Brevo, which sends AHX's emails (audit results, trial and billing notices). It receives your email address, name and the content of each email, and reports whether it was delivered, opened or clicked.
• Lemon Squeezy, our reseller and merchant of record for Pro subscriptions. If you subscribe, Lemon Squeezy collects your payment details, billing address and tax information under its own privacy policy. We receive your name, email address, country, subscription status and dates, and your card brand and last four digits; never your full card number. We send Lemon Squeezy your email address, name and AHX account ID when you start a checkout.
• A search results provider, used to check live Google results. It receives only the search terms being checked (including your site’s top Search Console searches when you start tracking) and a country code; never your name, email address or other Google data. See Who we share Google user data with.

We may also disclose data if the law requires it, to protect people’s safety, or as part of a merger or sale of AHX Labs, in which case this policy would continue to apply to your data. We never sell personal data or share it with advertisers or data brokers.

Google API Limited Use

In particular, we:

• use Google user data only to provide and improve the features you see in the extension;
• transfer it to others only to provide those features, to comply with the law, or as part of a merger or sale with your data still protected;
• never use it for advertising, and never sell it;
• never use it to develop, improve or train general AI or machine learning models;
• never let people read it, unless you ask us to (for example for support), it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.

Keeping and deleting data

We keep data saved to your account for as long as you have an account, so your history and reports stay available. You can delete it at any time:

• In the extension: open Settings and choose “Delete my account and data”. This permanently deletes your account and everything saved to it from our servers.
• By email: write to support@ahxlabs.com from the email address on your account.
• Remove Google access: sign out in the extension, or remove AHX SEO Labs at myaccount.google.com/permissions.
• Remove local data: uninstalling the extension deletes everything it stored in your browser.

Deleted data is removed from our live systems straight away and from backups within 30 days. Records of AI reports are deleted together with your account.

Deleting your account cancels any Pro subscription first. Records of payments and subscriptions (dates, amounts, plan, email address) are kept for as long as tax and accounting law requires, separate from your deleted account; Lemon Squeezy keeps its own records as the seller.

Security

All data moves over encrypted HTTPS connections. Google sign-in uses Google's own OAuth flow, so we never see your Google password. Google refresh tokens are stored encrypted, with the key kept only on our servers. Access to our servers and database is restricted to the people who run the service.

Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to access, correct, delete or export your personal data, and to object to or restrict how we use it. Email support@ahxlabs.com and we will reply within 30 days. You can also complain to your local data protection authority.

Children

AHX SEO Labs is a tool for website owners and professionals. It is not directed at children under 16, and we do not knowingly collect their personal data.

Changes to this policy

If we change what we collect or how we use it, we will update this page and its date. For important changes, the extension will ask for your permission again before collecting anything new.

Contact

AHX Labs · support@ahxlabs.com · ahxlabs.com