Privacy policy

The short version. This site runs no ads and sets no advertising cookies. Google Analytics counts visits with cookies, except for visitors in the European Economic Area, the United Kingdom and Switzerland, where it sets none. The free audit asks for no name and no email: it keeps the domain you checked, the result, and a salted hash of your IP address. The contact form keeps what you type into it. If you buy the full audit, Razorpay takes the payment and we keep your order details to do the work and for our tax records; we never see your card number.

Who is responsible

Elivate SEO is a brand of Easinvy, a sole proprietorship of Ridam Agrawal, registered in India (Udyam registration UDYAM-MP-23-0309964) and based in Indore, Madhya Pradesh. Easinvy decides how the data described here is used: the "controller" under the GDPR, and the "data fiduciary" under India's Digital Personal Data Protection Act.

Questions, requests and complaints about your data go to Ridam Agrawal, Proprietor and Grievance Officer, at hello@elivateseo.com or +91 95753 87305. Complaints are acknowledged within 48 hours and resolved within one month.

What we collect, and why

The free audit

What you type: a domain or page address. We fetch that site's public page, robots.txt, llms.txt and sitemap, and store the result with the domain. A repeat check within six hours is answered from that stored copy instead of fetching the site again.
A salted hash of your IP address. A hash is a one-way code: we cannot turn it back into your address. It limits how many audits one visitor can run in an hour, and lets us see that the person who ran an audit is the person who later used the contact form. Anyone holding our secret salt could test whether a known IP matches it, so we treat it as personal data.
Added automatically: your browser's user-agent string and the page that referred you.
Core Web Vitals: the address you checked is sent to Google PageSpeed Insights, which loads the page in a browser and returns its speed scores. Nothing about you is sent.
No name or email is asked for or kept. Results are not published or indexed, but a result has its own address (/audit?domain=…) that anyone you send it to can open.
We never contact anyone because they ran an audit.

The full audit (US$20)

What you give us: on Razorpay's payment page, your name, email and phone number, the website to audit, and your answers to its questions (your platform, whether you sell online or have a physical location, key pages, other domains you own).
Your payment is handled by Razorpay, and by PayPal if you pay with PayPal. Your card, UPI or PayPal details go to them, never to us. Razorpay tells us the payment ID, the amount, the time and whether it succeeded.
Used to: audit the site, email you the sheet, answer your questions, send one follow-up email about the audit, and keep the invoice and payment record that tax law requires. You are not added to any mailing list.
The audit itself is about a website, not about you: we crawl up to 200 of the site's public pages and check them with public tools (among them Google PageSpeed Insights, the Chrome UX Report and the Wayback Machine). The results go in a Google Sheet in our Google Drive, shared with you by link.
If you add us to your Google Search Console, we read its reports for the audit and change nothing. Remove our access whenever you like.

The contact form

What you type: your name and email, and optionally your company, website, the service you are interested in, your message and the times that suit you.
Added automatically: the page you sent it from, the page that referred you, campaign tags in the link if there are any (utm_source, utm_medium, utm_campaign), your browser's user-agent string, and a salted hash of your IP address, which allows five submissions an hour.
Used to: reply to you, and see which pages bring enquiries. Sending the form emails you an automatic confirmation and emails us a notification.

Email you send us

Mail to hello@elivateseo.com is stored in our mailbox at Hostinger. We use it to reply, and keep it as the record of the conversation.

Analytics

Vercel Web Analytics counts page views without cookies: the page, the referring site, and the country, browser, operating system and device type. Vercel recognises a visit by a hash of the request and discards it after 24 hours.
Google Analytics 4 tells us which pages are read, where readers come from and which pages lead to an enquiry or an order. Outside the European Economic Area, the United Kingdom and Switzerland it uses two first-party cookies to recognise a returning browser, and Google receives the page, the referring site, and approximate location, browser and device details. In the EEA, the UK and Switzerland it sets no cookies and stores nothing on your device: Google receives a cookieless signal it does not use to recognise you. Everywhere, its advertising features are off: no advertising storage, no ad personalisation, no Google signals, and ad click identifiers redacted. Google keeps the data for 14 months, and states that GA4 does not log or store IP addresses.
Neither is linked to the audit, an order or the contact form, and neither is used to identify you.

Cookies

Cookie	Set by, and for whom	What for	Kept
`_ga`, `_ga_SF02K0V1E4`	Google Analytics, for visitors outside the EEA, the UK and Switzerland	Recognising a returning browser, to count visits and visitors	Up to two years
The admin session	This site, for the owner alone	Signing in to our own admin panel	Until it expires or the owner signs out

There is no cookie banner because no visitor is asked to accept a cookie that needs consent where they are: in the EEA, the UK and Switzerland none is set. You can delete or block these cookies in your browser at any time, or install Google's opt-out add-on. Razorpay's payment page is on Razorpay's own site and sets its own cookies under its own policy.

Who processes it for us

Provider	What for	What it handles
Vercel	Hosts the site, the contact form and the audit page; cookieless analytics	Page requests, form submissions in transit, analytics events
Railway	Runs the audit service	The domain checked, the hashed IP
Neon	Our database	Contact enquiries and audit records
Razorpay	Takes payment for the full audit, and sends your receipt	Your name, email, phone, the order's answers, and your payment details
PayPal	Only if you pay with PayPal	Your PayPal account and the payment
Resend	Sends the site's emails	Your name, email and message, for the confirmation
Hostinger	Our mailbox	Email you send us, and the full audit's emails to you
Google	Analytics 4, PageSpeed Insights, and Drive and Sheets for the full audit	Page views, with cookies outside the EEA, the UK and Switzerland; domains for performance checks; your audit sheet and the email address it is shared with

Hosts keep their own short-lived request logs, which include IP addresses, under their own retention rules. We do not sell personal data or share it for advertising.

Several of these providers process data outside India and outside your country, mostly in the United States. Where the GDPR applies, those transfers rely on the safeguards in each provider's data processing terms, such as standard contractual clauses.

How long we keep it

Audit records (domain, result, hashed IP) are kept as the record of what each check found. Nothing is deleted automatically; ask, and we delete yours.
Full audit orders: the sheet and your answers are kept until you ask us to delete them. The invoice and payment record are kept for as long as Indian tax law requires, even if you ask, because the law requires it.
Contact enquiries and email are kept until you ask us to delete them. Nothing is deleted automatically.
Google Analytics data is kept for 14 months, then deleted by Google.

Your rights

You can ask to see the personal data we hold about you, correct it, delete it or get a copy of it, object to how we use it, and withdraw consent where we rely on consent. Emailhello@elivateseo.com from the address concerned. For an audit, tell us the IP address you used and roughly when: we can match a hashed IP only from the address itself, never the other way round. We reply within 30 days.

If you are in the EU or UK, you can also complain to your data protection authority. In India, once you have raised it with us, you can take it to the Data Protection Board of India.

Legal bases, for the GDPR. Replying to the contact form is a step you asked for. The full audit is the contract you bought, and keeping its invoice and payment record is a legal obligation. The hashed IP is our legitimate interest in preventing abuse. Analytics is our legitimate interest in knowing which pages are read, and in the EEA, the UK and Switzerland it runs without cookies.

Security

All traffic is encrypted (HTTPS). IP addresses are stored only as salted hashes, and the admin panel needs a password. Payment details never reach us. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities where the law requires it.

Children

The site and its services are for businesses and are not directed at anyone under 18.

Changes

When this policy changes, the date at the top changes. A change to how we use data we already hold is posted here before it takes effect.