Privacy Policy
Effective date:
This notice describes how the ScanDepth application handles information. It is written from the implementation: where the product does not do something, the notice says so rather than describing a practice that is not in place.
1.Who operates ScanDepth
ScanDepth is a product operated by California Global LLC, a Delaware limited liability company. In this notice, “we” and “us” refer to California Global LLC. What follows describes what the application actually does with information, based on how it is built.
2.Information you provide
When you buy a report you provide an email address and the address of the website to be audited. If you add competitor comparison you also provide up to 3 competitor website addresses. You may optionally provide project details such as business category, target country, target languages, products or services, and the customer you are trying to reach. There are no accounts, so no password and no profile is created.
3.Information generated during an audit
To produce a report we fetch pages from the website you submitted and store what we extract from them: URLs, HTTP status codes, titles, meta descriptions, canonical URLs, robots directives, language attributes, headings, readable page text up to a fixed limit, structured data, Open Graph and Twitter card values, author and date values, image sources and alt text, links and anchor text, response times and page sizes. The same is done for any competitor sites you submit. This is public web content, retrieved the way a search engine retrieves it.
4.Free scans
A free scan is not stored. It reads up to 5 pages, calculates the scores in memory and returns them to your browser; no order, project, page or score record is written to our database. The only trace a free scan leaves is a rate-limit counter, described below.
5.Paid orders and payments
A paid order stores your email address, the audited website address and its host, your chosen language, the amount, the currency and the order status. No payment card details are entered on, passed through, or stored by ScanDepth. Payment is handled by a separate payment provider, and we retain only the amount, the currency, the status and that provider’s own reference for the transaction.
6.AI Visibility and AI-assisted content
AI features are switched off by default and run only when an operator configures an AI provider. Where content assistance is enabled, we send the relevant page’s URL, title, meta description, headings and an excerpt of its text — up to 3,000 characters — to the configured provider so it can draft suggested replacement content. Where AI Visibility is enabled, we send generated market questions, not your page content, to each configured provider and store the answers along with whether your brand was mentioned or cited. The providers that may be configured are OpenAI, Google, Anthropic, DeepSeek and Azure OpenAI. No AI provider ever sets a score. When a provider does not respond, we record only a coarse failure category so the report can say the prompt was not measured — never the provider’s error message, which can echo the request.
7.Google Search Console
On a paid Full Audit or Compare purchase you may optionally connect Google Search Console. We request read-only Search Analytics for the property you select, store a 28-day snapshot of clicks, impressions, queries and pages with that order, then revoke the OAuth grant and delete the encrypted tokens. We do not keep ongoing access to your Google account. The Free Scan never starts this flow. If you skip the connection, Search Analytics is reported as not measured.
8.Cookies and analytics
ScanDepth does not set a public interface-language preference cookie. There is no analytics, no tracking pixel, no advertising tag, and no third-party script that profiles you. Essential session or payment-provider cookies may still be used only where required to complete a protected product flow.
9.Rate limiting and server logs
To keep the free service usable we count requests per IP address: 3 free scans and 2 comparison previews per address per day, plus limits on creating orders and on looking up delivery links. Each counter is stored as a key containing the IP address, a count and a window expiry. IP addresses are not attached to your order record. Application logs are written to the server’s standard output and can include operational detail such as job outcomes and error codes.
10.How information is used
Information is used to run the audit you asked for, to generate and deliver the report, to email you the delivery link, to enforce the limits above, and — in anonymous form — to build score benchmarks. A benchmark sample holds only the scores, the scoring engine version and the coarse business category you selected. It carries no order, email, host or URL.
11.Service providers
Running ScanDepth involves the hosting provider that serves the application, a PostgreSQL database, and file storage for generated PDFs, which is either the application server’s own disk or Azure Blob Storage depending on configuration. Email is sent through an SMTP service when one is configured; when none is configured, no email is sent. AI providers, Google (only when you connect Search Console on a paid audit), and the payment provider are involved only as described above.
12.Data retention
Delivery links stop working 30 days after payment, and both the report page and the PDF download refuse access after that point. The underlying order, crawl, audit and report records are not automatically deleted when that window closes: the application has no scheduled deletion routine, so those records are kept until they are removed manually. Rate-limit rows likewise remain until they are pruned. We would rather state this plainly than describe a deletion schedule that is not implemented.
13.Security
The delivery link is the only credential in the product, and it is never stored in readable form. We keep a SHA-256 hash of it for lookup and an AES-256-GCM encrypted copy used once to compose your delivery email, with the key held in the environment rather than in the database. PDF downloads require a signed, time-limited URL. Crawling is restricted to public addresses: private ranges, loopback addresses and cloud metadata endpoints are refused before any request is made. No system is perfectly secure, and we make no such claim.
14.International processing
Depending on how a deployment is configured, the providers described above may process information in countries other than your own, including the United States.
15.Your choices
Because there are no accounts, the delivery link is the only way an order can be found. If you want your order data removed before it expires, that request needs to reach a monitored channel, and we have not published one yet — see Contact below.
16.Changes to this notice
If this notice changes, we will update the effective date shown at the top. We do not keep a public archive of earlier versions.
17.Contact
A public contact address for privacy questions has not been published yet, and we would rather list none than list a mailbox nobody reads. Automated email from ScanDepth is sent from an unattended address that cannot receive replies.