GSC PLUS · Effective date: October 2, 2026

This Privacy Policy explains how we process personal data when you visit gsc-plus.com and use our web application at app.gsc-plus.com (together, the “Service”). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

Julian Harzer, GSC PLUS Hammer Steindamm 64, 20535 Hamburg, Germany Email: seo@gsc-plus.com Phone: +49 176 95282987

We are not legally required to appoint a data protection officer. For all privacy questions, please contact us at the email address above.

2. Hosting and Server Log Files

2.1 Our website and application are hosted by DigitalOcean, LLC, 101 Avenue of the Americas, New York, NY 10013, USA, on servers located in the EU [CHECK: data center region].

2.2 When you access the Service, our hosting provider automatically collects technical information in server log files: IP address, date and time of the request, requested URL, referrer URL, browser type and version, and operating system.

2.3 This data is processed to deliver the Service, ensure its security and detect misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website). Log files are deleted after [7] days unless needed to investigate a security incident.

2.4 We have concluded a data processing agreement with DigitalOcean in accordance with Art. 28 GDPR. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses.

3.1 We use technically necessary cookies to operate the Service, e.g. to keep you logged in. The legal basis is Section 25(2) TDDDG and Art. 6(1)(b) and (f) GDPR.

3.2 Non-essential cookies and similar technologies (e.g. for analytics) are only used with your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings on our website.

4. Google Tag Manager and Analytics

4.1 Our website uses Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Tag Manager itself does not set cookies or store personal data; it is used to manage and load other tools on our website. When it loads, your IP address may be transmitted to Google.

4.2 Via Google Tag Manager we use the following tools, only after your consent: [LIST TOOLS, e.g. Google Analytics 4]. These tools help us understand how visitors use our website. The legal basis is Art. 6(1)(a) GDPR.

4.3 Data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework. Further information: https://policies.google.com/privacy

5. Contacting Us

If you contact us by email, we process the data you provide (e.g. name, email address, content of your message) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, and Art. 6(1)(f) GDPR otherwise. We delete the data once your request has been fully handled, unless statutory retention obligations apply.

6. User Account

6.1 To use the application, you need to create an account. We process your name, email address, password (stored in hashed form only), company details where provided, and the settings you make in the application (e.g. brand terms, priority keywords, URL groups).

6.2 This data is required to provide the Service. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

6.3 We store your account data for as long as your account exists. After you delete your account, the data is deleted unless statutory retention obligations apply.

7. Google Search Console Data

7.1 To provide our core functionality, you connect your Google account via Google OAuth and grant GSC PLUS read-only access to your Google Search Console data (e.g. properties, search queries, pages, clicks, impressions, positions, countries, devices).

7.2 We use this data exclusively to display analyses, reports and exports to you within the Service. Only you and the users you authorize can see your data. Search Console data is retrieved on demand and is not stored permanently on our servers. Temporary caching only takes place to the extent technically necessary to deliver the Service [CHECK: confirm retention, e.g. for rank tracking history].

7.3 The legal basis is Art. 6(1)(b) GDPR. Where Search Console data contains personal data of third parties, we process it on your behalf as a processor under Art. 28 GDPR.

7.4 You can revoke access at any time in your Google account settings at https://myaccount.google.com/permissions.

7.5 Google API Services User Data Policy: GSC PLUS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not sell this data, do not use it for advertising, do not use it to train AI or machine learning models, and do not allow humans to read it, except with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

8. Payment Processing

8.1 Payments are processed by [PAYMENT PROVIDER, name and address]. When you subscribe to a paid plan, your payment data (e.g. name, billing address, payment method details) is transmitted directly to the payment provider. We do not store full credit card details.

8.2 The legal basis is Art. 6(1)(b) GDPR. We retain invoices and accounting records for the periods required by German commercial and tax law (generally up to 10 years, Section 147 AO, Section 257 HGB).

9. Transactional Emails

We send emails that are necessary for using the Service, e.g. account confirmation, password reset, billing notices and important changes to the Service. The legal basis is Art. 6(1)(b) GDPR. [If applicable: These emails are sent via EMAIL PROVIDER.]

10. Recipients and Third-Country Transfers

We only share personal data with service providers that help us operate the Service (hosting, payment, email) and only to the extent necessary. Where data is transferred outside the EU/EEA, we ensure an adequate level of protection, e.g. via an adequacy decision (including the EU-U.S. Data Privacy Framework) or EU Standard Contractual Clauses. We do not sell personal data.

11. Storage Duration

We store personal data only as long as necessary for the purposes described or as required by statutory retention periods. Afterwards, the data is deleted or anonymized.

12. Your Rights

Under the GDPR, you have the right to:

  • access your personal data (Art. 15 GDPR);
  • rectification of inaccurate data (Art. 16 GDPR);
  • erasure (Art. 17 GDPR);
  • restriction of processing (Art. 18 GDPR);
  • data portability (Art. 20 GDPR);
  • withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process your data based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation.

To exercise your rights, simply email us at seo@gsc-plus.com.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

14. Data Security

We use TLS/SSL encryption for all data transmitted via the Service and take appropriate technical and organizational measures to protect your data against loss, misuse and unauthorized access.

15. Changes to This Privacy Policy

We may update this Privacy Policy when our Service or legal requirements change. The current version is always available on this page.