Privacy Policy

1. Data we process

We only process data that is needed to provide the service:

• Account data: your name, e-mail address and login details.
• Organisation and website configuration: the websites you add, and how you showed ownership of or access to them (a DNS record, or a Google Search Console account and the level of access it has to the property).
• Google Search Console data (read-only): clicks, impressions, click-through rate and average position per page and search query, for the properties you explicitly connect.
• Google Analytics 4 data (read-only), only for a property you explicitly connect: sessions and engaged sessions per page and day, by channel group, the number of key events per page (a count, never a monetary value), and sessions per landing page from a fixed list of AI assistants (ChatGPT, Perplexity, Claude, Gemini, Microsoft Copilot, Le Chat (Mistral), DeepSeek, Grok, Meta AI). Google filters on that list before the data reaches us. We do not receive or store data about individual visitors.
• Crawl data of your own website: page titles, meta descriptions, canonical URLs and internal links. We do not store the body text of your pages.
• Changes and measurements: the on-page changes you record in Lastmod and the measured before/after effect.
• Billing data: your organisation’s company name, address, country, VAT or Chamber of Commerce (KvK) number and invoice e-mail address, plus subscription and invoice details (per invoice only its id, number, amount and status). Payments and invoices are handled by our payment provider, Mollie. You enter your payment details yourself on Mollie’s payment page: we never see or store card or bank account numbers.
• Connected apps: when you create an API key or connect an external app through OAuth (for example an AI assistant through our MCP server), we store only a hash of the key or token, who created the connection and when it was last used. When an app registers itself with us, we store its name and redirect addresses and a pseudonymised hash of the IP address it registered from, never the IP address itself.
• Support correspondence when you contact us.

2. Why we process it (legal bases)

We process the data above to deliver and secure the service and to bill you and collect payment (performance of contract and legal obligations), to communicate with you about the service (contract), and to improve the product — including the aggregated insights described in section 3 (legitimate interest). We do not sell your data and we do not use it for third-party advertising.

3. Learning across customers (aggregated, anonymous insights)

To improve our recommendations we will compute, every 7 days, anonymised patterns across all connected websites — for example, how often a longer page title is followed by more clicks. These patterns are computed exclusively from the type of change, whether the text became longer or shorter, whether it contains a year, and the measured effect — never from URLs, page texts, search queries, domain names or anything that could identify a website or person. A pattern is only used once it is supported by at least 30 measured changes across at least 5 different customer organisations, each on a different website. You can exclude your organisation from contributing at any time by e-mailing privacy@lastmod.ai; this works retroactively — your contribution disappears at the next recalculation, so within 7 days — and you will continue to benefit from the resulting insights. Legal basis: legitimate interest (product improvement); our balancing assessment is available on request. This feature is not active yet: until our legal review is complete we compute no cross-customer patterns at all, and no customer data is used for them.

4. Google user data (Limited Use disclosure)

Lastmod’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means: we request read-only access to Search Console and, if you connect it, Google Analytics 4; we use that data only to provide the features you see in your own dashboard and reports; we do not use it for advertising, do not sell it, do not use it to train generalised AI or machine-learning models, and no humans read it except with your consent, for security or support at your request, or where required by law. You can disconnect the integration at any time, which deletes the stored tokens. To let you choose the right Google Analytics property, we read the names of the accounts, properties and web data streams your Google account can access; we keep only the property you choose.

To provide some of those features — search-result observations, the commercial-value indication and the backlink check during a measurement period — we send the search queries from your Search Console and the URLs of your pages to an external SEO data provider. It uses them only to return that data to us. We send no account, contact or organisation details. Search queries are sent as they appear in Search Console: if someone searched for a person’s name, that name can be part of a query.

If you use AI visibility, we also send the questions you track, with the market you set, to the same provider. It puts each question to ChatGPT and Google AI Mode, without a login or history, and returns the answer to us. From that answer we keep only whether your brand or domain is mentioned, whether your site is cited, which of your pages was cited and the domain names of the websites the answer lists as sources (no page addresses or titles); we use those domain names only to count the sources by type, such as news, forums or review sites, and never show them to you by name. To improve that classification we look at totals across all customers ourselves: which domain names occur often, only from three organisations on and without seeing whose they are. We do not store the answer text. We suggest those questions with the help of our AI provider, based on your Search Console search terms, the titles and headings of your pages, your domain and your brand name; we only track a question after you approve it. The questions we suggest are general questions about your category, without your brand name; check each one before you approve it. A question you add yourself may contain your brand name. We do not send your brand name to the SEO data provider separately.

5. Where your data is processed

Lastmod is built EU-first. Our database, application hosting, object storage, error monitoring and e-mail sending run in EU regions (including Frankfurt, Amsterdam and Ireland). Where a provider processes data outside the EU, this happens under EU Standard Contractual Clauses. That applies to our AI provider, Anthropic, in the United States: for explanations, text suggestions and suggested AI-visibility questions we send it page URLs, titles, meta descriptions and headings, search queries from your Search Console, measurement results and competitor data, and it keeps them for up to 30 days. Our full list of sub-processors is published on this site, at lastmod.ai/en/subprocessors. E-mail you send us is stored with our mailbox provider.

Payments and invoices. When you subscribe and pay online, we pass your organisation’s company name, address, country, VAT or Chamber of Commerce (KvK) number and invoice e-mail address to Mollie, a payment institution in the Netherlands (EU), so that it can process your payments and create and send your invoices. The payment details you enter on Mollie’s payment page go to Mollie directly, not through us. Mollie also has legal duties of its own as a payment institution, including a statutory retention period for payment and invoice data for tax purposes; Mollie’s privacy statement applies to that part. Legal basis: performance of the contract and legal obligations.

VAT number check. If your organisation is in an EU member state other than the Netherlands and you give us a VAT number, we check it with VIES, the VAT number validation service of the European Commission, which looks the number up in the VAT register of the member state concerned. For that we send the VAT number you gave, with its country, and our own VAT number. The European Commission and that member state receive these numbers for their own purposes; they are recipients, not processors working for us. We do not keep the company name and address that the register returns. We keep the record of each check: the VAT number, the country, the date and time, the outcome (valid, not valid or no answer) and the reference number and date that VIES returns; that reference number and date are also added to your invoice at Mollie. Purpose and legal basis: legal obligation, as we must be able to show why an invoice carries no VAT. We keep these records for 7 years after the end of the financial year in which the check was made, also if you delete your account or organisation, because the tax rules require it.

6. Retention and deletion

Raw measurement and crawl data is retained for the period that belongs to your plan, after which it is automatically cleaned up. Google Analytics 4 data is kept for 180 days and then deleted automatically. The pseudonymised IP hash of an app that registered through OAuth is cleared after 30 days; an app registration that was never used and has no connection is deleted after 30 days (after 90 days for an app identified by a public metadata address, which contains no personal data). If you delete your account, it is deleted immediately, with your memberships, sessions and personal settings; the organisations you belonged to keep their own data. If you delete your organisation, all associated data — including stored reports and access tokens — is permanently deleted after a grace period of 7 days, together with the accounts that then belong to no other organisation. We confirm each deletion by email. The deletion itself is logged: who did what and when is kept, without content such as names, email addresses or free text. You can export your data before deleting. We keep the links to your invoices (per invoice its id, number, amount and status) for as long as the organisation exists. Mollie keeps payment and invoice data for its own statutory retention period for tax purposes, also after deletion. The records of VAT number checks described in section 5 are the exception: we keep them for the period stated there.

7. Your rights

Under the GDPR you have the right to access, rectify, erase and export your personal data, to restrict or object to processing (including objecting to the aggregated insights in section 3), and to lodge a complaint with your supervisory authority — in the Netherlands the Autoriteit Persoonsgegevens. Contact privacy@lastmod.ai to exercise any of these rights.

8. Cookies and security

We only use functional cookies (such as your session and language preference); we do not use third-party advertising or tracking cookies. Data is encrypted in transit. Our database and object storage providers encrypt data at rest at platform level, and Google access tokens are additionally envelope-encrypted with a key that is held outside the database — those tokens never reach the browser. Access to customer data is strictly scoped per organisation.

Visitors to lastmod.ai. When you visit our website we measure how it is used: which pages, via which referrer, from which country, on which device and browser. We use Vercel Web Analytics for this, as our processor. It works without cookies and does not follow you across other websites. Vercel recognises a visitor by a code derived from the request, which is discarded automatically after 24 hours. We do not use it to identify individuals. Legal basis: legitimate interest (understanding how our website is used). You can object via privacy@lastmod.ai.

Where a sign-up came from. When you start a trial from our website, we record with your new organisation how your visit began: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), the website that referred you (only its domain), the first page you landed on, and whether you came via the free check. Until you sign up, this stays in your browser tab (session storage, not a cookie) and travels to the sign-up form inside the link. We use it only to see which channels bring customers, not to identify you, and we delete it together with your organisation. Legal basis: legitimate interest (knowing which channels work). You can object via privacy@lastmod.ai.

Free check on lastmod.ai. When you check a domain on our website, we read that domain's robots.txt, sitemap and homepage, the way a search engine does. To prevent abuse, such as a large number of checks from one network, we keep counters. They contain your IP address and a random code we place in your browser's storage, only in pseudonymised form: as a hash made with a secret key. The counters link your pseudonymised IP address or code to the domain you checked. The check does not store your IP address itself. These counters are deleted after at most 7 days. We keep the checked domain and the result for at most 24 hours: for that long, everyone who checks that domain gets the same result, so we don't fetch the site again and again. After that we delete them. During those hours our staff can see which domains were checked, with the outcome and the time, to understand how the check is used and to improve it; that overview contains no IP address and no browser code. Separately we keep daily totals, such as how many checks were run, how they ended and how many sign-ups came through the check, for at most 400 days; they contain only numbers, no domain and nothing that points to you. The result only contains technical properties of the public homepage, such as the title and the meta description, and no data about you. Your browser keeps the domains you checked, the time and the codes of the findings, to show what has been fixed on a next check; this stays on your device, and you erase it with “Forget my checks”. If you enter an email address to start the trial, it is only passed on to the sign-up form; we do not store it with the check. Legal basis: legitimate interest (offering a free check without it being abused, and understanding how it is used). You can object via privacy@lastmod.ai.

When the check finds something to improve, we send the public text of the checked homepage (title, meta description, heading and main text) once to our AI provider, to write an explanation and text suggestions. We send no data about you. The advice is kept with the result, for at most 24 hours.

Results by e-mail. If you ask us to e-mail the results of a check, we use the address you enter to send that one e-mail. To prevent abuse we send at most one such e-mail per address per day, and we count requests per IP address and per browser code as described above. Like every e-mail we send, it is recorded in our e-mail log for 90 days (address, type, delivery status). If an address bounces, complains or unsubscribes, we keep a hash of it on a block list so we don't e-mail it again. Legal basis: your request. If you also tick "send me tips", we only use your address for tips once you confirm with the button in the e-mail. As proof of that consent we keep the address, the language, where you gave it, the version of the consent text and when you asked and confirmed. An unconfirmed request is deleted after 7 days. You can withdraw at any time with the link in every e-mail; we then delete the address and keep only a hash and the dates. Legal basis: consent.

9. Changes and contact

We will update this page when our data practices change and note the date at the top; material changes will be announced to account holders. Contact: privacy@lastmod.ai. Lastmod is a service of Frontiq B.V., Vareseweg 121, 3047 AT Rotterdam, the Netherlands; Chamber of Commerce (KvK) 98636065, VAT NL868578770B01.