Privacy policy

1. Who we are

Quorvana is an AI analysis service for Google Search Console, operated by Click&Mortar from France, within the European Union. Click&Mortar is the data controller for the personal data described below.

With your authorisation, Quorvana connects to your Google Search Console account through Google's official read-only OAuth flow and reads your search analytics so it can analyse them with AI. Quorvana does not run its own crawler and does not collect data directly from your site's visitors.

2. Data we collect

• Account data, when you create an account: your name, email address, and password (stored hashed). For an organisation, the name you give it.
• Google account & connection, when you connect Google: your Google account email and basic profile, and read-only OAuth tokens that let us call the Search Console API on your behalf. Tokens are stored encrypted, and we never receive your Google password.
• Search Console data, for the properties you connect: search queries, pages, clicks, impressions, click-through rate, average position, URL inspection (index status) and sitemap data, together with the AI analyses and recommendations we derive from them.
• Billing data, if you subscribe to a paid plan: the billing details needed to process your payment. Payment is handled by our payment provider; we do not store full card numbers.
• Usage & technical data, server logs (IP address, browser type, timestamps) needed to operate and secure the service, plus privacy-friendly, cookieless usage analytics.
• Messages you send us, the content of the contact form or emails you send to our support address.

Search Console metrics describe how your pages and queries perform in Google Search, not identifiable visitors. The data Google returns is aggregated, and Google omits queries that are too rare to be anonymous.

3. How we use your data

• To provide and operate the service and your account.
• To read your Search Console data and analyse it with AI, run scheduled analyses, and send you digests and ranking-drop alerts.
• To process subscriptions and payments.
• To respond to your questions and provide support.
• To keep the service secure and prevent abuse.
• To meet our legal and accounting obligations.

4. Legal bases (GDPR)

• Contract, to provide the service you signed up for, connect Search Console, and manage your account.
• Legitimate interests, to secure the service, prevent abuse, and understand aggregate usage, provided those interests do not override your rights.
• Legal obligation, to keep billing and accounting records.
• Consent, which you give when you authorise the Google connection and may withdraw at any time by disconnecting.

5. Sharing & sub-processors

We do not sell your personal data. We share it only with the service providers needed to run Quorvana:

• Google, the Search Console API and Google Sign-In. We call these on your behalf to read your search data, under Google's privacy policy. Google Fonts are also served by Google.
• An AI provider, which processes the search data required to generate your analyses and recommendations, under a data-processing agreement.
• Cloudflare, Turnstile anti-abuse protection on our public forms (privacy policy).
• Hetzner Online GmbH, hosting of the application and data, in Germany (EU).
• Self-hosted Umami, cookieless product analytics that we run ourselves; no data is shared with a third party.
• A payment provider and an email-delivery provider for billing and transactional messages, where applicable.

6. International transfers

We store and process your data within the European Union. Some providers (for example Google, Cloudflare, or our AI provider) may process data outside the EU; where they do, transfers are governed by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Data retention

We keep account data for as long as your account is active, and afterwards only as long as needed for our legal, accounting, and security obligations. Your imported Search Console data and the analyses derived from it are retained for the duration of your subscription. When you disconnect Google or close your account, we revoke and delete the associated OAuth tokens. Server logs are kept for a limited period for security and troubleshooting.

8. Your rights

Under the GDPR you may exercise the following rights over your personal data:

• Access, rectification, and erasure.
• Restriction of, and objection to, processing.
• Data portability.
• Withdrawal of consent, where processing is based on consent, including by disconnecting Google at any time.

To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the French supervisory authority, the CNIL.

9. Cookies

Quorvana uses only strictly necessary cookies, and no tracking or advertising cookies. See our Cookie policy for the full list.

10. Changes

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date above.

11. Contact

Questions about this policy or your data? Email [email protected].