Privacy Policy
Effective 11 October 2026
botAEO is an SEO and answer-engine auditing tool. This policy covers the marketing site at botaeo.com and the app at crawl.botaeo.com. It says what we collect, what we do with it, who else sees it, and how to get it deleted. botAEO is operated by Trailmonger LLC ("we", "us"), which is responsible for your data; "you" means anyone using either site.
The short version. We collect what is needed to run your audits and nothing for advertising. We do not sell data. Data from your Google accounts is read-only, used only to show you reports inside botAEO, and never used to train AI models. You can disconnect and ask us to delete everything at any time.
1. The botaeo.com website
The marketing site sets no cookies, runs no analytics or tracking scripts, and loads nothing from third parties - fonts are served from botaeo.com itself. It is hosted on Cloudflare Pages. Cloudflare processes your IP address and request details to deliver the page and protect it from abuse, under Cloudflare's privacy policy.
2. What the app collects
Account information
- Your username, email address and a hashed password (we never store the password itself).
- If you sign in with Google: your Google account ID, email address and name, from the
openid,emailandprofilescopes. Sign-in grants nothing else. - Which workspaces you belong to and your role in each.
What you put into botAEO
- Sites you ask us to crawl, and the public pages, headers and resources the crawler fetches from them.
- Audit results, findings, settings, competitor lists, prompts and notes you create.
- API keys and webhook URLs you paste in for other services (for example Cloudflare, Perplexity or Slack).
- Data you import yourself, such as CSV files or server logs.
Technical data
- A session cookie that keeps you signed in. It is strictly necessary and is not used for tracking.
- Server logs with IP addresses, request paths and timestamps, used for security and debugging.
3. Data from Google accounts
You can connect Google Search Console, Google Analytics and Google Ads. Each connection is optional, made by you through Google's own consent screen, and read-only. botAEO requests only these scopes:
| Service | Scope | What we read |
|---|---|---|
| Search Console | webmasters.readonly |
The list of properties you can access, and for the property you choose: search queries, pages, clicks, impressions, click-through rate and average position. |
| Google Analytics | analytics.readonly |
The list of properties you can access, and for the property you choose: daily totals of sessions, users, page views and conversions. |
| Google Ads | adwords |
The list of accounts you can access, and for the account you choose: search terms, clicks, impressions, spend and conversions, plus Keyword Planner ideas for keywords you enter. botAEO never creates, edits or pauses anything in your Ads account. |
How Google data is used
Google user data is used only to provide features you can see in botAEO:
- Reports on traffic, rankings, keyword opportunities, content decay and paid-versus-organic overlap.
- Correlating your audit scores with real search performance over time.
- AI citation checks. When you run a citation check, botAEO turns your top Search Console queries into questions and sends that question text to the AI engines you choose (see section 5) to see whether they cite your site. Only the question text is sent - not clicks, impressions, account details or your identity.
- Exports and agent access you start: CSV downloads, writing briefs, and AI assistants you connect to botAEO with an access token you create.
What we never do with Google data
- Sell it, rent it, or share it with data brokers.
- Use it for advertising, ad targeting or retargeting.
- Use it to develop, improve or train generalized AI or machine-learning models.
- Use it to determine creditworthiness or for lending.
- Let people read it, except with your permission (for example a support request), for security purposes such as investigating abuse, to comply with law, or when it has been aggregated and anonymized for internal operations.
botAEO's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. How we use data
- To run crawls, audits, reports and alerts you ask for.
- To sign you in, keep workspaces separate, and enforce who can see what.
- To send account emails such as address verification, invitations, and alerts you turn on.
- To keep the service secure, fix problems and prevent abuse.
We do not use your data for advertising and do not sell it.
5. Who we share it with
Only with the service providers needed to run botAEO, and only what each one needs:
- Contabo - hosts the server that runs the app and stores its database.
- Cloudflare - hosts botaeo.com and provides DNS.
- Google - sign-in, the Google APIs you connect, the Gemini API when you choose it for citation checks, and delivery of account emails.
- AI engines you choose - Perplexity, Google Gemini, OpenAI and Anthropic receive prompt text when you run citation checks with them, and Anthropic receives crawl evidence (public page content and findings) when you run a deep audit. These calls are made through each provider's API.
- DataForSEO - receives the keywords you enter when you request keyword ideas from it.
- Services you connect - such as Cloudflare analytics for your own zone, or a Slack channel you add a webhook for.
Members of your workspace, and clients you give a read-only login, can see that workspace's data. We may also disclose data if required by law, or to protect the rights and safety of users and the service. If botAEO is ever sold or merged, this policy will continue to apply to data collected under it.
6. Retention and deletion
- Data is kept while your account or workspace is active.
- Disconnecting a Google service in botAEO deletes its access grant, so we stop reading new data at once. To also cancel the grant on Google's side, remove botAEO at myaccount.google.com/permissions.
- Data already imported stays in your reports until you ask us to delete it. Email us and we will delete your account, a workspace, or the data imported from any connected service within 30 days, including any backup copies.
- Server logs are used only for security and debugging, and are deleted along with your account on request.
7. Security
The app is served only over HTTPS. The server is not reachable for administration from the public internet. Passwords are hashed. API keys you store, and the access grants for the Google accounts you connect (Search Console, Analytics and Ads), are encrypted at rest. Secrets are never shown back in the app, and every request is checked against the workspace it belongs to. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.
8. Your choices and rights
- Every Google connection is optional; the audit runs without them.
- You can disconnect a service at any time in Settings, and revoke access at Google.
- You can ask for a copy of your data, a correction, or deletion by emailing us. Depending on where you live (for example the EU, UK or California) you may have further rights, including to object to processing or complain to a data protection authority. We will respond within 30 days.
9. Children
botAEO is a professional tool and is not intended for anyone under 16. We do not knowingly collect their data.
10. Changes and contact
If we change this policy we will update the date above, and tell account holders by email before any change that affects how Google data is used.
Questions or requests: [email protected]. See also our Terms of Service.