Effective date: October 26, 2026 · Last updated: October 26, 2026
This policy describes information handled by the current Seoptiz website and diagnostics tools. It distinguishes data that a visitor submits from public information a tool retrieves, and identifies implementation limits that still require owner or provider confirmation.
Scope and service operator
This Privacy Policy applies to the public Seoptiz website, account pages, diagnostics tools, documentation, and related features available at seoptiz.com. Seoptiz is the product name. The exact legal name and registration details of the person or organization responsible for a particular deployment have not been provided in the application, so this policy does not invent an entity name, registration number, street address, or corporate structure. The site is developed by Skypeaklimits; that attribution does not by itself identify the legal data controller for every deployment.
The policy describes the application code as it exists on the effective date below. Hosting providers, mail services, DNS providers, advertising vendors, and other infrastructure may process additional data under their own terms. A site owner must review those services and update this policy before enabling or changing them. If a separate legal notice conflicts with this policy, mandatory law controls where applicable.
Information we handle
When a person creates an account, the application can store the email address, optional display name, a password hash, role, email-verification status, timestamps, and acceptance of the Terms. Passwords are hashed with a password-hashing function; the application does not need to store a readable password. Verification and password-reset flows create a random token, store a hash and purpose with a one-hour expiry, and send the original token only in the relevant email link when outgoing mail is configured.
A tool request may contain a public web address, domain, IP address, keyword, text, code sample, DNS record choice, or file content depending on the tool. The tool may produce a response, diagnostic report, generated markup, or other output. Avoid entering passwords, authentication cookies, API credentials, confidential URLs, customer records, or private text. The application is designed for public website diagnostics and supplied examples, not for processing secrets.
If an account database is connected, it may store projects, audits, reports, tool-use events, CMS content, and administrator events. For successful public HTML visits, it also stores one daily record per public IP and browser-session fingerprint, with timestamps and approximate country/region when available from local GeoIP data. Visitor IPs are not sent to a geolocation provider. Records contain no page path, city, coordinates, or user-agent string. They remain anonymous unless the visitor verifies an account email in the same browser session; eligible records can then be linked to that account. Records expire 30 days after refresh and are hidden from the admin view after expiry. GeoIP can be incomplete or inaccurate, especially for IPv6.
Submitted information and public data
Information submitted by a visitor is different from information retrieved from a public source. A website check can request a URL that the visitor enters and inspect the public HTTP response, markup, headers, links, or metadata returned at that time. DNS tools query configured DNS resolvers; resolver comparison uses named public DNS services. RDAP and domain-age checks may query the public RDAP service at rdap.org. Registries can omit, redact, or change public registration fields. The output is a timestamped observation from a source, not a verified statement from the domain owner.
External services necessarily receive the query needed to answer it. The website being checked receives a request from the application server; a resolver receives the domain and record type; an RDAP service receives the domain lookup. This is not a promise that those providers retain no logs. No commercial search-volume, ranking, backlink-index, payment, or behavior-analytics provider is configured by default. The optional advertising integration is inactive unless an administrator configures a publisher and an ad placement. If enabled, the advertising provider can receive browser and page information under its own terms.
Generated results can include data copied from public pages or public DNS/RDAP responses. Such public information may still relate to a person or business. Use it only for legitimate diagnostics, do not use redacted fields to identify someone, and do not build unsolicited contact lists from lookup results.
Purposes and legal bases
Seoptiz uses account details to create and secure accounts, verify email addresses, authenticate sessions, support account features, enforce tool access, prevent abuse, and respond to account requests. Submitted inputs are used to execute the selected tool and show its result. Tool-use records and administrator audit events support quotas, operational review, security, and the administration features that depend on a database. Email addresses are not used for a marketing campaign by the application code described here.
Where a privacy law requires a legal basis, the appropriate basis depends on the user's location and the actual deployment. Processing may be necessary to provide a feature the user requests, to meet a legal obligation, or to pursue a legitimate interest such as account security and abuse prevention. Consent is used only where required and actually collected. Closing the cookie notice records a dismissal preference; it is not consent to optional advertising or analytics. The owner must not enable optional tracking until a lawful consent mechanism is in place for affected visitors.
Seoptiz does not sell personal information through the application code described here. Whether a configured advertising service constitutes “sharing,” targeted advertising, or another regulated activity depends on the service, settings, jurisdiction, and applicable legal definition; the site owner must assess that before activation.
Service messages and support communications
The application can send verification, password-reset, and administrator-initiated test messages. The Contact form emails the visitor's name, reply address, and message as plain text to the confirmed general inbox; it does not store submissions. Google reCAPTCHA is optional. If enabled, account and contact forms load Google's widget and send its response token for verification. Google may receive browser request data, including the visitor's IP; the server does not pass the IP as a separate verification field. The application has no newsletter or marketing list.
Development SMTP uses STARTTLS. The owner confirmed a test from noreply@seoptiz.com and confirmed info@seoptiz.com as the general inbox. The contact@, dmca@, abuse@, and privacy@ aliases are unconfirmed. A sender test does not verify delivery to each inbox or a separate production environment. Do not send passwords or authentication links through the Contact form.
If the operator later adds newsletters, product announcements, or other marketing, it must obtain any required permission, identify the sender and purpose, include a working unsubscribe method where required, honor opt-out requests, and update this policy. Closing the cookie notice is unrelated to marketing consent.
Service providers, disclosures, and business changes
To operate a deployment, an administrator may connect a hosting platform, database, email-delivery service, domain registrar, DNS resolver, RDAP service, or optional advertising provider. The application code identifies PostgreSQL as the database option and uses public DNS and RDAP services for specific checks; it does not identify a single hosting provider, database host, or email vendor for every deployment. A public website being checked is a recipient of the tool's page request. These external services are not all “processors” in every legal context and may determine their own purposes for certain logs.
No payment processor, subscription checkout, commercial keyword dataset, commercial backlink index, live rank provider, or third-party analytics platform is configured by default in this release. Advertising remains optional and inactive until an administrator supplies settings. The operator must record each provider that is actually enabled, review its contract and privacy terms, determine its role, and add required disclosures before using it. This policy does not imply that a provider has been vetted or that data is stored only in one country.
Information may also be disclosed when reasonably necessary to protect accounts, investigate suspected abuse, enforce the Terms, comply with a valid legal obligation, or protect the rights and safety of a person or service. A disclosure should be limited to information the operator is legally permitted or required to provide. The application does not promise advance notice where law or a security risk prevents notice.
If Seoptiz or its operating assets are reorganized, transferred, or acquired, account and service data may need to be transferred as part of continuity, subject to applicable law and any required notice or choice. The operator should update this policy and explain the practical consequences before a material change where required.
Regional privacy considerations
Privacy rules depend on where a person lives, where a service is offered, the operator's role, the type of information, and thresholds or exemptions in the relevant law. Puerto Rico is a U.S. territory; the application does not claim a separate Puerto Rico consumer-privacy statute applies to every visitor or that a particular legal test has been satisfied. U.S. federal rules and any applicable state or territorial requirements may still govern specific activities. The operator should obtain advice on the laws that apply to its actual business and deployment rather than infer coverage from a visitor's IP address.
Some U.S. state laws provide rights to know or access, correct, delete, or obtain a portable copy of certain personal information, and to opt out of defined sales, targeted advertising, or profiling. They may also provide appeal rights, authorized-agent rules, or limits on sensitive-data processing. Seoptiz does not currently use a universal privacy-request portal or a state-specific opt-out signal manager. If a particular law applies, the operator must implement the required intake, identity check, response, appeal, and opt-out process and update the public notice to describe it accurately. The cookie notice's close control is not a sale or targeted-advertising opt-out.
Where the European Union or United Kingdom rules apply, individuals may have rights such as access, rectification, erasure, restriction, objection, portability, and withdrawal of consent, along with the right to complain to a supervisory authority. Those rights have conditions and exceptions. An operator that is subject to those laws must identify its controller, appropriate legal bases, representative or data protection contact where required, retention details, transfer safeguards, and consent tools. These have not been confirmed for this deployment, so this policy does not claim that all of those structures are currently in place.
Submitting and handling a privacy request
For general privacy questions and requests, use the Contact Us page, which lists the owner-confirmed general inbox. No dedicated privacy alias or self-service request portal is confirmed. Identify the account or data involved, the right being exercised, and a safe way to respond. Do not send a password, authentication cookie, full reset link, or identity document unless the operator requests a proportionate verification method through a verified channel. A request may be refused or narrowed where the law permits—for example, when the requester cannot be verified, the information concerns another person, or a legal exception applies.
The operator should verify identity using the least intrusive practical method, search relevant account and application records, document the decision, and explain any limitation or available appeal where required. A user may appoint an authorized agent when the applicable law permits it; the operator may verify both the agent's authority and the consumer's identity as allowed by law. There is no general self-service deletion control or dedicated privacy inbox, and no fixed response deadline is represented by this template. The operator must comply with the actual statutory deadline before claiming a formal process.
If a person cannot resolve a concern directly with the operator, some laws allow a complaint to a government regulator or supervisory authority. The appropriate authority depends on the person's location and the activity at issue. Seoptiz does not select or represent a particular regulator as having jurisdiction over every visitor.
Retention, deletion, and backups
Verification and password-reset tokens expire after one hour. The default session cookie ends with the browser session; selecting Remember me sets a persistent cookie for up to thirty days. The cookie-notice dismissal and visitor-location records last thirty days. Visitor-location records are deleted by the hourly in-process cleanup while the app is running and by the operator's scheduled cleanup command; expired records are hidden from the admin view immediately. These settings do not describe the lifetime of server backups or provider logs. Other project, audit, tool-use, administrator-log, and CMS records may remain in the configured database until removed or otherwise managed.
The application does not currently provide a general self-service account-deletion workflow. A request to access, correct, or delete account information can be sent through the Contact Us page using the owner-confirmed general inbox. A dedicated privacy alias is not confirmed. A request may require reasonable identity verification. Legal obligations, security investigations, backups, and records needed to resolve disputes may affect when data can be removed.
Removing a project or report may not immediately remove copies held in backups or logs. Database operators should establish backup retention, restore testing, and deletion procedures before enabling production accounts. Seoptiz does not promise immediate deletion from every service or backup.
Security and international processing
The code includes password hashing, session controls, CSRF checks for state-changing forms, authorization checks for account and administrator routes, rate limits, and restrictions on outbound website fetches. These controls reduce risk but do not guarantee that a system is secure. Transport encryption depends on the deployment's HTTPS and proxy configuration. The owner must protect environment secrets, restrict database access, patch dependencies, and maintain tested backups.
Public DNS, RDAP, website, email, and advertising providers may operate in different countries. Their processing and transfer terms are governed by their own policies and the deployment configuration. The exact hosting, database, email, and advertising providers have not been confirmed here, so this policy does not name or certify them. A production operator must add provider names, locations, and transfer safeguards when known.
Privacy rights and requests
Depending on a person's location and the circumstances, privacy laws may provide rights to access, correct, delete, restrict, object to, or receive certain information, and to withdraw consent. Some laws also permit an appeal or a complaint to a regulator. Rights are not identical in every jurisdiction and may be subject to exceptions. The application does not make a blanket promise that every request can be granted or fulfilled within a particular number of days.
Residents of U.S. states, Puerto Rico, the European Economic Area, or the United Kingdom should use rights available under laws that apply to them. This policy does not claim that every regional statute applies to every visitor, and it does not waive rights that cannot lawfully be waived. The Contact Us page lists the owner-confirmed general inbox; a dedicated privacy alias and any required identity-check, response-tracking, or appeal process still need to be confirmed.
Children's information
Seoptiz is a technical diagnostics service for website owners and developers, not a service directed to children. Do not knowingly submit a child's personal information. If the operator learns that a child's information was collected without a valid basis, it should review the record and take appropriate steps under applicable law. No age-verification system is claimed here.
Changes and contact
This policy may change when the application, providers, legal requirements, or data practices change. The date at the top identifies the current revision. For a material change, the operator should use an appropriate notice method, such as a website notice or account message, before the change takes effect when required. Continued use is not a substitute for consent where consent is legally required.
For questions, corrections, or general privacy requests, use the Contact Us page and its owner-confirmed general inbox. A dedicated privacy alias, legal operator identity, and any jurisdiction-specific representative details still need confirmation where required.