Introduction
SearchSeal is operated by Nusantara Ventures, LLC (“we,” “our,” or “us”). This Privacy Policy explains how we handle information when you visit searchseal.com or use the SearchSeal crawler-observability product at app.searchseal.com. It should be read together with our Terms of Service, which governs your use of SearchSeal.
Controller and processor roles
For account information, support communications, website and operational data, and security data described below, Nusantara Ventures, LLC is the data controller: we decide why and how that information is processed.
For personal data that may appear inside data from a source you connect or in optional visitor analytics that you enable on your site, you are the controller and Nusantara Ventures, LLC acts only as a processor, on your documented instructions, to identify and report AI crawler activity or provide the analytics you selected. You are responsible for having a lawful basis to send us that data, giving any notice or obtaining any consent required for your site, and responding to your own visitors about it. We will direct any request we receive about that data to you and assist you in responding.
Information we collect
Account information
When you create an account, we collect your email address, authentication records, and information needed to maintain your session and secure your account.
Sites and source connections
We collect the domains, hostnames, source type, connection status, configuration, and other information you provide when adding a site or connecting infrastructure. When a provider uses OAuth or another credential, we process the credential required to keep that connection working.
AI crawler evidence
SearchSeal retains filtered evidence about identified crawler requests. Depending on the source, this can include crawler identity, hostname, path, time bucket, HTTP status, request counts, sampling information, and coverage intervals. Stored paths exclude query strings and URL fragments.
For the connection methods currently available (continuous HTTPS intake, log-stream delivery, and Cloudflare zone analytics), raw request lines are never stored: each batch is parsed, reduced to identified-crawler evidence only, aggregated into short time windows, and committed as that aggregate. We do not retain request bodies, authorization headers, cookies, or other secrets from source logs.
A bounded file-upload connection method is designed but not yet available to customers. If and when we enable it, uploaded raw files would be held transiently in cloud storage and deleted within a defined window after processing, and we will update this section with the exact window before that method becomes available.
WordPress crawler reporting
When a WordPress administrator connects the SearchSeal plugin, crawler reporting sends evidence only for requests whose user agent matches the plugin's crawler filter. The evidence includes the crawler user agent, hostname, path, request method, response status when observable, timestamp, and a random event identifier. The plugin removes the query string before sending the path. It does not send the crawler's IP address, cookies, request body, authorization headers, or other request headers.
SearchSeal processes the crawler user agent transiently to identify the crawler, then discards the raw user agent. Stored crawler evidence follows the aggregation and retention rules described elsewhere in this policy. Connecting the plugin activates crawler reporting; optional visitor analytics is a separate administrator choice.
Optional visitor analytics on customer sites
A WordPress administrator may separately enable SearchSeal visitor analytics. This setting is off by default in the plugin and can be disabled without disconnecting crawler reporting. When enabled, the SearchSeal tracker processes the page URL, referrer, campaign parameters, a random event identifier, and any named goal or revenue event that the customer site sends. SearchSeal stores the page hostname and path, referral source, campaign fields, goal name, and, when supplied, the revenue amount and currency. Non-campaign query string values and full referrer URLs are not stored.
The collection service processes the visitor's IP address and browser user agent transiently with a rotating daily salt to derive a one-day visitor identifier. The IP address and browser user agent are not stored. The salt is stored only for the current UTC day and deleted at the next UTC midnight. The identifier does not persist across UTC days or across customer sites. The tracker sets no cookies and uses no local storage. It does not create a cross-site advertising profile.
Website and operational data
We collect basic server logs and diagnostic information such as IP address, browser type, device information, requested URL, and error details for security, reliability, and troubleshooting. The marketing site uses local browser storage for preferences such as theme; it does not load third-party analytics or advertising tags (see “Do Not Track and cross-site tracking” below).
Our free robots.txt checker tool processes the domain you submit in order to retrieve and evaluate that domain's robots.txt file. Using this tool does not require an account, and we do not associate submitted domains with your identity beyond standard server logs.
How we use information
We use information to:
- Authenticate users and operate SearchSeal
- Connect authorized sources and process crawler evidence
- Show source coverage, crawler requests, paths, and HTTP outcomes
- Provide visitor analytics, acquisition sources, goals, and revenue measurement when a customer enables that feature
- Secure, debug, and improve the service
- Respond to support requests and send essential service communications
- Understand use of the marketing site
We do not sell personal information.
Legal bases for processing
Where we act as controller, we rely on:
- Contract performance — to create your account, connect your sources, and provide the service you signed up for
- Legitimate interests — to secure the service, respond to support requests, and diagnose and fix problems, weighed against your rights and interests
- Legal obligations — where we must retain or disclose information to comply with the law
Service providers and connected platforms
We use service providers to operate SearchSeal, including:
- Supabase for authentication, database hosting, and protected secret storage
- Cloudflare for infrastructure and source analytics data. Cloudflare OAuth grants account-wide analytics read access; SearchSeal restricts its use to the zones you select
- Vercel for hosting web applications and the marketing site
If you connect another supported provider or send a log stream, we exchange data with that provider as needed to establish and operate the connection. Providers process information under their own terms and privacy policies.
We may also disclose information when required by law, to protect rights or safety, or as part of a merger, acquisition, financing, or sale of assets with appropriate safeguards.
Data retention
- Account and authentication records — until you delete your account
- Connected-source configuration and provider credentials — until you disconnect the source or close your account
- Aggregated AI crawler evidence — while your account is active; we do not currently apply an automatic expiry to this evidence
- Visitor analytics events, sessions, and rotating daily visitor identifiers: 30 days
- Daily visitor-free analytics totals: while your account is active; these rows retain counts and reporting dimensions, not visitor identifiers
Operational logs and backups may be retained for a limited period for reliability, security, and recovery.
When you request deletion, we delete or de-identify account data that we are not required to retain for security, legal, or operational reasons. Data may remain in backups until those backups expire through their normal cycle.
Security
We use technical and organizational safeguards intended to protect information, including encrypted transport, access controls, and protected storage for provider credentials. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.
Your privacy rights
Depending on the law that applies to you and on our role for the specific data involved (see “Controller and processor roles” above), you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent, where processing relies on consent, without affecting processing carried out before withdrawal
- Request human review of a decision made solely by automated means, if we make one
- Lodge a complaint with a competent data protection authority
If we are a processor for the data your request concerns — because it came from a source someone else connected — we will direct your request to that customer, who is the controller for that data, and assist them in responding.
You can also disconnect a connected source directly from your account to stop future collection from it. A WordPress administrator can disable visitor analytics separately while keeping crawler reporting connected. You can control local browser storage and cookies through your browser settings.
To exercise any of these rights, contact support@searchseal.com. We may need to verify your identity before completing a request.
International processing
Nusantara Ventures, LLC is a Delaware, United States company managed from Indonesia. Our primary product application and database infrastructure, including the database that holds our website content, runs in Singapore. The marketing site is served through Vercel's global edge network, with its server functions running in the United States. Depending on the sources you connect, your information may also be processed in other locations our infrastructure or service providers operate in.
Where we transfer personal data across borders, we use the safeguards required by applicable law.
Do Not Track and cross-site tracking
The marketing site does not load third-party analytics, advertising, or session-recording tags. No third party collects data through our site about your activity on other websites. Because we do not track visitors across sites, a browser's “Do Not Track” signal does not change how the site behaves.
This statement about the SearchSeal marketing site is separate from the optional visitor analytics tracker that a customer may enable on its own site. That tracker measures activity only for the customer site where it is installed and uses no cross-site identifier.
If we introduce measurement tags in the future, we will update this policy first and add a consent control where the law requires one.
Children's privacy
SearchSeal is a business service. It is not directed to anyone under 18, and no one under 18 may create an account or otherwise use SearchSeal.
If we learn that someone under 18 has provided us information without the valid authorization of a parent or guardian, we will close the account and delete the information where legally required to do so. A parent or guardian who believes their child has provided us information can contact support@searchseal.com to request review and removal.
Changes to this policy
We may update this Privacy Policy. We will identify material changes with a new version and effective date and provide additional notice when appropriate.
Contact us
If you have questions or requests about this Privacy Policy, contact us at:
Email: support@searchseal.com
Mail:
Nusantara Ventures, LLC
1401 Pennsylvania Ave STE 105 Box1776
Wilmington, DE 19806