Last updated: 2026-10-30
This Privacy Policy explains how QueryScope ("we", "us", "our") collects, uses, and protects your personal data when you use the service at https://queryscope.dev.
We handle your data lawfully under the EU General Data Protection Regulation (GDPR).
1. Who we are
- Service: QueryScope
- Website: https://queryscope.dev
- Contact for privacy: [email protected]
- General contact: [email protected]
If you have a concern about how we handle your data and we can't resolve it directly, you can lodge a complaint with the data protection authority in your country of residence.
2. The Service in plain language
QueryScope brings Google Search Console into your AI IDE. It holds the plan for which searches your site is chasing, reads your own Search Console against it, and tells your coding agent the single next change to make. The Service has two parts:
- A hosted MCP server at mcp.queryscope.dev that your AI IDE (Claude Code, Cursor, Cline, Windsurf, etc.) connects to over OAuth. It reads your Search Console data on your behalf and returns it to your IDE. Your IDE runs the AI; we do not.
- A hosted dashboard at queryscope.dev where we store your account, billing, the sites you connect, and the daily Search Console snapshots we keep so your history is not lost to Google's retention window.
This matters for privacy: we read your own Search Console data over a read-only OAuth grant you approve and can revoke. We do not run AI inference on your data, and we are not affiliated with Google.
3. What data we collect
3.1 Data you provide directly
- Account data: email address, password (hashed via bcrypt), name (optional)
- Project data: verified root domain you're working on, project name
- Billing data: billing address, VAT number (B2B), country. Payment card details are handled directly by Stripe and never touch our servers.
- Communications: emails, support tickets, feedback you send us
3.2 Data the MCP server posts back to us
When you use a tool inside your IDE, the MCP server posts a run summary to our API. These summaries include:
- Tool name and parameters (e.g., "keyword", "work")
- Run status and duration
- The searches you declare as targets, the page you assign to each, and the reason you give
- What you record as changed on a page, and the outcome measured afterwards
- Idempotency keys to deduplicate retried requests
The MCP server does NOT post back:
- The full text of content you generate
- Your IDE's AI conversation history
- Your repository contents (unless you explicitly use a tool that needs them)
3.3 Data we collect from connected integrations (optional, with your consent)
When you connect optional integrations, we process:
- Google Search Console (OAuth): read-only access to search performance data (impressions, clicks, position, query, page) and URL indexing status for properties you authorize. We use this to show your performance, to work out where you stand on the searches you declared, and to measure whether a change you recorded moved anything. We never write to your GSC account.
You can disconnect the integration from your account settings at any time. When you do, we revoke the OAuth grant at Google's end and immediately delete the Search Console data we cached for that site (snapshots, daily metrics, and URL inspections). Residual copies in our encrypted backups expire within 30 days.
3.4 Data collected automatically
- Technical data: IP address, browser, device, operating system, request timestamps
- Usage data: which pages of the dashboard you visit, which features you use, time spent (collected via our self-hosted Umami analytics, which does not use cookies or share data with third parties)
- Audit logs: authentication events, API token use, security-relevant actions
3.5 Data we do NOT collect
- We do not buy personal data from third parties
- We do not collect special categories of data (health, racial origin, political opinions, biometrics)
- We do not run third-party advertising or marketing pixels
- We do not sell your data, ever
- We do not process your content through AI ourselves. AI inference happens in your IDE under your vendor relationship (Anthropic, OpenAI, etc.). We are not a subprocessor of those vendors on your behalf.
4. Why we collect it (legal basis under GDPR Art 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service | Account, project, run summaries | Contract performance (Art 6(1)(b)) |
| Process payments | Billing data | Contract performance |
| Send transactional emails (password resets, receipts, the Monday list of your changes ready to judge and their results, which you can turn off from the email) | Email address | Contract performance |
| Customer support | Communications, account | Contract performance |
| Send product updates (only if you opt in) | Email address | Consent (Art 6(1)(a)) |
| Run scheduled audits on your behalf (e.g., daily GSC pull, weekly snapshot, URL inspection) | GSC data | Contract performance |
| Detect abuse and secure the Service | Technical, audit logs | Legitimate interest (Art 6(1)(f)) |
| Aggregate, anonymized product analytics | Usage | Legitimate interest |
| Comply with tax and accounting law | Billing | Legal obligation (Art 6(1)(c)) |
5. How long we keep your data
| Data category | Retention |
|---|---|
| Account data | Deleted from live systems immediately when you delete your account; residual encrypted backup copies expire within 30 days |
| Project data, your plan and its targets, results-page readings, tool-run history, anomalies | Until you delete it or your account; on account deletion, removed from live systems immediately, residual backup copies within 30 days |
| Connected integration tokens (Google Search Console) | Until you disconnect or delete your account, then deleted immediately; on account deletion we also revoke the OAuth grant at Google's end |
| Stored GSC snapshots, daily metrics, and URL inspections (your performance history) | Kept while your account is active; permanently deleted from live systems immediately on account deletion, residual backup copies within 30 days |
| Billing and invoice records | 7 years (Dutch tax law requirement under Algemene wet inzake rijksbelastingen) |
| Support communications | 2 years |
| Contact form messages held by FormHaven | 30 days, then deleted by FormHaven (a reply we send lands in our inbox and follows the support communications line above) |
| Email opt-in records | Until you opt out, plus 1 year (proof of consent) |
| Backups | Up to 7 days (Litestream streaming), up to 30 days (daily snapshots), then auto-deleted |
| Server logs | 30 days |
| Audit logs (security events) | 1 year |
What deleting your account does
You can delete your account at any time from your account settings (Settings, then "Delete account"). Deletion is immediate and irreversible. In a single step we:
- Cancel your paid subscription right away. No further charges are made. The current billing period is not refunded.
- Revoke our Google Search Console access at Google's end, so the grant no longer appears as active in your Google account. You do not have to remove us manually afterward.
- Permanently delete, from our live systems, all of your data: your projects, your stored Search Console history (daily metrics, snapshots, page-and-query data), your URL inspection data, your plan and every target in it, your stored results-page readings, your change log and tool-run history, and every API and MCP access token.
The only data we keep afterward is what the law requires: invoices and billing records, retained for 7 years under Dutch tax law. Residual copies of deleted data inside our encrypted rolling backups (Litestream streaming and daily snapshots) expire automatically within 30 days, after which no copy remains.
If you only want to stop billing but keep your account and history, cancel your subscription instead (see our Terms, Section 5.6); that keeps your data until you choose to delete the account.
6. Subprocessors
We share necessary data with the following processors to operate the Service:
| Vendor | Purpose | Data | Location | DPA |
|---|---|---|---|---|
| Hetzner Online GmbH | Server hosting | All hosted user data | EU (Germany / Finland) | Yes |
| Cloudflare, Inc. | DNS, CDN, security, R2 backup storage, transactional email delivery | Technical, usage, encrypted backups, email addresses and message content | Global (US-headquartered, EU PoPs) | Yes |
| Stripe Payments Europe Ltd. | Payment processing | Payment, billing | Global | Yes |
| Backblaze, Inc. (B2) | Database backups | All hosted user data (encrypted at rest) | US | Yes (with SCCs) |
| Google LLC (Search Console API) | Read your GSC data on your behalf when you connect | OAuth tokens, fetched GSC data | Global | Yes |
| FormHaven (formhaven.net) | Receives contact form messages, stores them in the EU and deletes them after 30 days (privacy policy: formhaven.net/legal/privacy) | Name (optional), email address, message content | EU | Yes |
We do NOT use the following despite some appearing in standard SaaS stacks:
- No AI model providers (Anthropic, OpenAI, Google Gemini, etc.) as subprocessors. AI inference happens in your IDE.
- No marketing automation, ad networks, or CRM that processes your personal data.
The current, dated list lives at https://queryscope.dev/subprocessors. We notify you by email at least 30 days before adding a new subprocessor that processes your personal data.
For international transfers (US-based vendors), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
7. AI processing disclosure
The Service itself does not perform AI inference on your content. The AI features you see in your IDE (Claude Code, Cursor, etc.) run under your relationship with that IDE's AI vendor (Anthropic, OpenAI, etc.). We do not send your content to AI vendors on your behalf, and we are not a subprocessor of those vendors.
This is an architectural choice: we built QueryScope as a tool layer, not an AI wrapper. Your IDE owns the AI runtime.
For the avoidance of doubt:
- Outputs you generate inside your IDE are governed by your IDE vendor's privacy policy (Anthropic, OpenAI, etc.), not ours.
- We do not train any model on your data, because we do not operate any model.
If we ever add server-side AI features (e.g., an optional AI summarization endpoint), we will update this Privacy Policy at least 30 days before that change takes effect.
8. Cookies
We use the minimum cookies needed to operate the Service:
- Strictly necessary cookies (always on): session cookies for authentication, CSRF protection, cookie consent state
- Functional cookies (on with consent): remembering theme preference, dashboard view preferences
- Analytics: we use self-hosted Umami, which does not set cookies and does not track users across sites
- Marketing cookies: we do not use any
You can manage cookie preferences via the banner shown on your first visit or via the "Cookie Preferences" link in our footer.
We do not use third-party tracking cookies, advertising cookies, or analytics cookies that share data with third parties. Our self-hosted Umami analytics does not set cookies. This means your visit to queryscope.dev does not contribute to any cross-site profile.
9. Your rights under GDPR
You have the right to:
- Access your personal data (Art 15)
- Rectify inaccurate data (Art 16)
- Erase your data, the "right to be forgotten" (Art 17)
- Restrict processing (Art 18)
- Port your data to another service (Art 20). We provide a JSON export from your account settings.
- Object to processing based on legitimate interest (Art 21)
- Withdraw consent at any time, without affecting prior processing (Art 7(3))
How to exercise these rights
Email [email protected] with your request. We respond within 30 days as required by GDPR (Art 12(3)).
If you're not satisfied with our response, you can complain to the data protection authority in your country of residence.
You can also delete your account directly from your account settings at any time. Deletion is one-click, immediate, and permanent (see Section 5, "What deleting your account does"), and follows the EU Digital Services Act and Consumer Rights Directive 2026 requirements for paid services.
10. Security
We implement reasonable technical and organizational measures, including:
- TLS 1.2+ encryption for all data in transit (HSTS-preloaded at the .dev TLD level, so HTTP is impossible)
- Encrypted backups at rest (Backblaze B2 + Cloudflare R2)
- Server access restricted via Tailscale VPN and SSH keys (no public SSH port open)
- Cloudflare WAF and DDoS protection
- Automatic security patching via Ubuntu unattended-upgrades
- Application-level rate limiting and bot protection (Cloudflare Turnstile on signup)
- Hashed passwords using bcrypt with strong work factor
- API authentication via revocable tokens (Laravel Sanctum)
- Audit logs of security-relevant events (1-year retention)
If we discover a data breach affecting your personal data, we notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Art 33-34.
11. Children
The Service is not intended for users under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, email [email protected] and we'll delete it.
12. International users
By using the Service, you understand that your personal data will be processed primarily in the EU and, for certain subprocessors, in the US under appropriate safeguards (Standard Contractual Clauses).
13. Changes to this Policy
We may update this Privacy Policy. Material changes will be notified via email at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version. If you need a copy of an earlier version, email [email protected].
14. Contact
- Privacy questions and GDPR requests: [email protected]
- General support: [email protected]