Privacy Policy

CTRPilot ("we," "us," or "our") operates the CTRPilot web application at https://ctrpilot.com (and associated subdomains). This Privacy Policy explains how we collect, use, store, and share information when you use our service.

1. Information we collect

Account information

When you sign up, we collect your email address, name (if provided), and authentication credentials managed through our auth provider (Supabase). If you sign in with Google, we receive your basic profile information as permitted by Google.

Google Search Console data

If you connect Google Search Console, we access read-only search performance data for properties you authorize, including page URLs, queries, impressions, clicks, CTR, and average position. We do not access or store your Google account password.

Usage and product data

We store data you create in CTRPilot, such as connected websites, synced page metrics, opportunity scores, AI title recommendations (when generated), and experiment records.

Payment information

Paid subscriptions are processed by Razorpay. We do not store full payment card details on our servers. Razorpay provides us with subscription status, plan identifiers, and transaction references needed for billing.

Technical data

We may collect standard log data such as IP address, browser type, device information, and pages visited for security, debugging, and service improvement.

2. How we use your information

• Provide and maintain the CTRPilot service
• Sync and analyze your Search Console data to surface CTR opportunities
• Generate AI-assisted title suggestions when you explicitly request them
• Track experiments and show before/after performance comparisons
• Process subscriptions and enforce plan limits
• Send transactional emails (e.g., welcome, sync notifications) when enabled
• Improve reliability, security, and product experience

We use deterministic calculations (not AI) to compute opportunity scores. AI is used only for on-demand title or meta suggestions you initiate.

3. Legal bases (where applicable)

Depending on your location, we process personal data based on: performance of our contract with you, your consent (e.g., connecting GSC), and our legitimate interests in operating and improving a secure SaaS product.

4. Third-party services

We use trusted providers to run CTRPilot, including:

• Supabase — authentication and PostgreSQL database hosting
• Google — Search Console API and optional Google sign-in
• Vercel — application hosting
• OpenAI or Google Gemini — AI title generation (only when you click generate)
• Razorpay — subscription billing (USD)
• SMTP email provider — transactional email (when enabled)

These providers process data according to their own privacy policies and our agreements with them. We share only what is necessary to deliver the service.

5. Data retention

We retain account data while your account is active. Search Console metrics are stored in aggregated form to control cost — typically rolling windows (e.g., 28-day sync periods with defined retention for raw daily data). You may disconnect GSC or delete your account to remove associated data, subject to reasonable backup retention periods.

6. Security

We use industry-standard measures including HTTPS, encrypted storage of OAuth tokens, server-side authorization on API routes, and row-level data isolation so users cannot access other accounts' data. No method of transmission or storage is 100% secure.

7. Your rights and choices

• Access, update, or delete account profile information in Settings
• Disconnect Google Search Console at any time
• Request account deletion by contacting us
• Opt out of non-essential marketing emails (transactional emails may still be sent)

Depending on your jurisdiction (e.g., EU/UK GDPR, California CCPA), you may have additional rights to access, portability, correction, or objection. Contact us to exercise these rights.

8. International transfers

Your data may be processed in countries where our infrastructure providers operate (e.g., United States). We take steps to ensure appropriate safeguards where required by law.

9. Children

CTRPilot is not intended for users under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be notified by email or in-app notice.

11. Contact us

Questions about this Privacy Policy or your data: privacy@ctrpilot.com