Privacy Notice
1. Who we are
AuditCrow is operated by 4D Services Limited, a company registered in England and Wales (company number 16412943, 4dservices.co.uk). Depending on how you use the service, 4D Services acts either as a data controller (for your own account with us, and for our own platform operations) or as a data processor (for client data you or your agency submit for audit, on your instructions). See §2 below for which applies to you.
2. Controller or processor — which applies to you
| Data | Who controls it | 4D Services' role |
|---|---|---|
| Your account, billing and support interactions with us | 4D Services Limited | Controller |
| Audit data for sites you audit directly as a customer | You | Processor |
| Audit data an agency submits about its own client | The agency | Processor |
| Connected Google, Microsoft Clarity and Klaviyo data (Search Console, Analytics, Business Profile, email flow statistics) | You / your agency | Processor |
| Anonymised, cross-client visibility insights (where you have opted in) | 4D Services | Controller |
3. What we collect and why
- Account data — name, email, authentication details (via Clerk) — to provide and secure your account.
- Site & audit data — URLs, crawled page content, technical signals, and connected analytics (Google Search Console, Google Analytics, Google Business Profile, Microsoft Clarity, and for online stores Klaviyo flow and campaign statistics, never individual subscribers) — to generate your visibility audit and recommendations.
- AI-generated content — audit summaries, persona insights and draft recommendations, produced using AI models (see §6) — always labelled as AI-drafted for your review.
- Usage & support data - to operate, secure and improve the service, and to respond to support requests. Where you have opted in to analytics cookies, this includes product analytics and session replay via PostHog (EU Cloud). Replay records your use of our app (inputs are masked). See the Cookie Policy.
- MCP access - if you connect Claude, ChatGPT, or another MCP client to AuditCrow, that client can read your account's sites and plan data, and can create or update content drafts and todos, after you sign in with OAuth. We do not send that data to Anthropic or OpenAI ourselves; the client you connected is acting on your instructions.
3A. Google user data
If you choose to connect a Google account, AuditCrow reads data from the Google services below on your behalf. You connect each source separately, you choose which site, property, account or location to share, and we only read: we do not change anything in your Google accounts.
Every Google connection also includes Google's basic permission to see the email address of the account you connect (userinfo.email). We do not currently read or store that address.
| Google source | Permission we ask for | What we read | What we use it for |
|---|---|---|---|
| Google Search Console | View Search Console data (webmasters.readonly) | The sites you can access, and search queries, clicks, impressions, average position and click-through rate for the site you choose | Showing how your site performs in search, spotting declines, ranking recommendations and checking whether a fix helped |
| Google Analytics (GA4) | View Analytics data (analytics.readonly) | The accounts and properties you can access, and reports of sessions, conversions, revenue and traffic channels for the property you choose | Showing traffic and conversion trends and what changed after your fixes |
| Google Business Profile | Manage Business Profile (business.manage) | Your business accounts and locations, listing details such as name, address, categories and opening hours, and review information such as ratings and how recently you were reviewed | Checking how complete and well-reviewed your listing is. Google offers this permission only as a single "manage" permission that also allows edits. We use it to read only, and we do not edit your listing or reply to reviews. |
| Google Ads | Manage Google Ads (adwords) | The ad accounts you can access, and campaign, ad group, ad and spend reporting for the account you choose | Showing paid spend and results beside your organic results, and spotting gaps. As above, Google offers this permission only as a single permission that also allows changes. We only run read queries and do not change your campaigns, ads or budgets. |
How we use it, and the limits. We use Google data only to provide the features you asked for in AuditCrow: your audits, recommendations and reporting. We do not sell it, we do not use it for advertising, and we do not use it to develop, improve or train generalised AI or machine learning models. We do not combine one customer's Google data with another's, or use it for cross-client benchmarking. We share it only with the sub-processors we need to run the service (see the sub-processor list, including the AI provider that drafts your summaries from it). Our staff do not read your Google data unless you ask us to (for example to help with a support request), where it is needed for security or to prevent abuse, or where the law requires it.
AuditCrow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Security. The access token Google gives us for each connection is stored encrypted in a dedicated secrets vault. We use it only to read the data you chose to share.
Revoking access and deleting your data. You can withdraw our access at any time at myaccount.google.com/permissions. Once you do, we can no longer read that source. To have the Google data we have stored, and the access token, deleted, email privacy@4dservices.co.uk and we will do it within one month. If you delete your AuditCrow account and you were its only member, your stored connection tokens and the data tied to the account are deleted automatically.
4. Lawful basis
We process account and billing data under contract (Art. 6(1)(b)). Audit and connected-account data is processed on your instructions as processor, under the contract between you and us. Where we process third-party data found during an audit (e.g. names in crawled pages or Google Business Profile reviews), our lawful basis is legitimate interests (Art. 6(1)(f)) - enabling the audit you requested - balanced against that person's rights. Product analytics and session replay rely on consent (PECR / Art. 6(1)(a)). You can withdraw that consent at any time via the cookie banner or the control on the Cookie Policy page.
5. Third-party data found during an audit
An audit can incidentally capture personal data about people who have no direct relationship with us or with you — for example names in crawled testimonials or team pages, reviewer names on a connected Google Business Profile, or search-intent captured in Search Console query data. We rely on legitimate interests (Art. 6(1)(f)) as our lawful basis for this: enabling the audit you or your agency requested, balanced against that person's rights. Direct notice to each such individual is frequently disproportionate to the purpose (Art. 14(5)(b)) given the scale and public nature of the source. Anyone who believes their data has been processed this way and wishes to object can contact privacy@4dservices.co.uk.
6. Sub-processors and international transfers
We use a defined set of sub-processors to deliver the service — see the full, current sub-processor list, including further processors engaged by those vendors (for example Clerk's email and user-search providers). Our primary data store is in the UK; several sub-processors are US-based, and transfers to them rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or an International Data Transfer Agreement (IDTA) otherwise.
7. AI & automated processing
AuditCrow uses AI models (including Anthropic and, optionally, OpenAI models) to draft audit summaries, persona insights and recommendations from your site and connected-account data. AI-drafted content is always clearly labelled in the product and is intended for your review — no decision producing a legal or similarly significant effect on you is made solely by AI. Connecting an MCP client is optional and is a separate instruction from you to that client.
8. Retention
We retain audit results for as long as your account is active, and for a limited period after closure to support re-onboarding and legal/accounting requirements. Immutable operational logs (cost, security and impersonation logs) are retained separately for security and audit purposes. We are implementing automated deletion in line with our published retention schedule.
9. Your rights
Subject to UK GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Request erasure of your data (already automated for account deletion)
- Request a portable export of your data
- Object to or restrict certain processing
- Withdraw consent where processing relies on it (e.g. the cross-client insight layer, or analytics cookies)
To exercise any of these rights, email privacy@4dservices.co.uk. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO).
10. Cookies
See our separate Cookie Policy for details of the cookies we use and how to control them. Analytics cookies and session replay (PostHog, EU Cloud) run only after you opt in, and only on our staging and live app hosts.
11. Contact
4D Services Limited (company number 16412943) · Data Protection Officer: Ben Foord · privacy@4dservices.co.uk