Privacy Policy
Last updated: 25 June 2026
1. Who we are
ClimbMetrics ("we", "us") is the data controller for personal data processed through the Service. Contact: privacy@climbmetrics.co.uk.
2. Data we collect
- Account data: email address, business name, password hash, sign-in timestamps.
- Profile data: website URL, industry, contact email you choose to provide.
- Usage data: keywords you track, audit results, AI advisory prompts and outputs, ranking history.
- Billing data: Stripe customer ID, subscription status. Card details are handled by Stripe and never reach our servers.
- Technical data: IP address, browser, device, error logs (used for security and debugging).
3. How we use your data
- Provide and operate the Service (legal basis: contract).
- Process payments and manage subscriptions (contract).
- Send transactional emails: signup confirmation, password reset, billing receipts (contract).
- Detect abuse and secure the platform (legitimate interest).
- Improve features and fix bugs (legitimate interest).
4. Sharing
We share data only with processors required to run the Service:
- Stripe — payment processing.
- Lovable Cloud / Supabase — database, authentication, hosting.
- Firecrawl — site auditing.
- AI providers (via Lovable AI Gateway) — generating SEO recommendations.
We do not sell personal data.
5. Retention
We keep account and usage data for as long as your account is active. After deletion, data is removed within 30 days from production systems; encrypted backups expire within 90 days.
6. Your rights (GDPR / UK GDPR / CCPA)
You can request access, correction, deletion, restriction, portability, and (in the EU/UK) lodge a complaint with your supervisory authority. Email privacy@climbmetrics.co.uk. Most data can be exported from Settings or deleted by closing your account.
7. Security
Data is encrypted in transit (TLS) and at rest. Access is controlled with row-level security so users can only read their own rows. Passwords are checked against the Have I Been Pwned database to prevent breached credentials.
8. International transfers
Our processors may store data outside your country, including the United States. Where required, transfers rely on the Standard Contractual Clauses or equivalent safeguards.
9. Children
The Service is not intended for children under 16. We do not knowingly collect data from children.
10. Supervisory Authority
If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the opportunity to deal with your concerns first, so please contact us at privacy@climbmetrics.co.uk in the first instance.
11. Changes
We will notify material changes by email or in-app. The "Last updated" date above reflects the latest revision.