This privacy policy explains how Reactivators ("we", "us") handles personal data in the Reactivators reporting platform (the "Service"): the dashboards, client reports, website audits and related tools we use to deliver our online marketing services.
1. Who we are
The Service is operated by Reactivators, Bergerstraat 2, 6226 NA Maastricht (KvK 70522022). For anything about this policy or your data, email us at support@reactivators.nl.
We are the controller for the personal data described here. Where we process data on behalf of a client, such as the analytics of their website, we do so as a processor under our agreement with that client.
2. Whose data this covers
- Members of our team who sign in to the Service.
- Our clients and their contacts who receive or view reports.
- People who connect a Google, Meta or WordPress account to the Service.
- Businesses we prepare a website audit for, and their contacts.
- Owners of websites our crawler visits.
3. What we collect and why
Accounts
For team members: name, email address, a hashed password, team membership and role, and session information. We use this to let you sign in and to control what you can see and change.
Clients and report recipients
Business name, website, the email addresses reports are sent to, and a hashed report password. We use this to produce reports and deliver them to the right people.
Connected accounts
When a Google, Meta or WordPress account is connected for a client, we collect the data described in sections 4 and 5, only to produce that client's reports and carry out the work agreed with them.
Public website and search data
Our crawler (ReactivatorsBot) reads publicly accessible pages of client websites to find technical SEO issues. We also collect public data on page speed, search results, keyword volumes, business listings in online directories, and how AI assistants answer questions related to a client's business.
Website audits for prospective clients
When we audit a business's website before working together, we store its domain, business name, type and city. We may also store contact details (name, phone number, email address), public information from its Google Business Profile that we enter by hand, and our notes. We record whether and how often the audit report was opened. We do this on the basis of our legitimate interest in offering our services. You can ask us to delete this data at any time.
Usage and security
Our hosting provider keeps technical logs, such as IP addresses and request times, to run and secure the Service. We use Vercel Web Analytics for aggregated visitor statistics; it does not use cookies and does not track you across websites.
4. Data from Google accounts
When a Google account is connected for a client, we ask for these permissions:
- Google Analytics (read-only): website traffic, visitor locations and conversions.
- Google Search Console (read-only): search performance: search terms, pages, clicks, impressions and positions.
- Google Ads: campaign performance, such as spend, clicks and conversions.
- Google Business Profile: the business listing (name, address, phone number, website), performance (calls, direction requests, website clicks, Search and Maps views), the average rating and review count, and the reviews themselves (the reviewer's public name, rating, text, date and any reply).
- Email address: to record which Google account is connected for each client.
How we use this data:
- Only to provide the Service to the client the account is connected for: their reports and dashboards, checks that their business details are consistent across online directories, and suggestions for which questions to track in AI assistants.
- We only read data. We never create, change or delete anything in your Google accounts.
- We do not sell Google user data, use it for advertising, or use it to train AI models.
- Our team only looks at this data to produce reports, provide support, keep the Service secure, or when the law requires it.
- To suggest questions to track, we send the client's website details, top Search Console search terms and tracked keywords to Anthropic (Claude API). Anthropic's terms do not allow it to use this data to train its models.
- To draft a reply to a review, when a team member asks for one, we send that review's rating and text and the business name to Anthropic (Claude API), under the same terms. We don't send the reviewer's name, and we never post replies ourselves.
Reactivators's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can withdraw our access at any time through your Google account permissions, or by asking us to disconnect the account. We then stop collecting data from it. To also delete data we already collected, email us at support@reactivators.nl.
5. Data from Meta and WordPress
Meta: for Facebook Pages, Instagram accounts and Meta ad accounts you give our agency access to, we read statistics such as reach, engagement, followers and ad performance, plus the content of ads so we can review them.
WordPress: if you give us a WordPress application password, we use it only to publish SEO improvements to your site (page titles, meta descriptions) that have been reviewed and approved. The password is stored encrypted.
6. AI features
Some features use AI models from external providers:
- OpenAI suggests page titles, meta descriptions and page copy, based on publicly accessible website content.
- Anthropic (Claude) suggests questions to track for AI visibility and drafts replies to Google reviews (see section 4), and reviews and summarises Meta ad performance and creatives.
AI output is always reviewed by our team before it is used. We use these providers' business APIs, whose terms do not allow them to use our data to train their models.
7. Who we share data with
We don't sell personal data. We only share it with service providers that help us run the Service:
- Vercel: hosting, file storage and visitor statistics.
- Neon: database, hosted in the EU (Frankfurt).
- Upstash: database and background job processing.
- Resend: sending report emails.
- Google: the APIs above, PageSpeed Insights and the Chrome UX Report. Our pages also load fonts from Google Fonts, so your browser connects to Google's servers.
- Meta Platforms: Facebook, Instagram and Meta Ads data.
- DataForSEO: keyword research, search results, Google Maps rankings and AI-answer data.
- OpenStreetMap: map images in our team dashboard. Team members' browsers load them directly.
- OpenAI and Anthropic: the AI features in section 6.
We may also share data when the law requires it, or to protect our rights or the security of the Service.
8. Transfers outside the EU
Some of these providers are based in the United States. Where data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
9. How long we keep data
- Team accounts: as long as the account exists.
- Client data, connected accounts and reports: for as long as we work together, so reports can show history. We delete it when the relationship ends or when the client asks us to.
- Prospect audits: as long as reasonably needed to follow up. We delete them on request.
- Technical logs: for a limited period, only as long as needed to run and secure the Service.
10. Security
Access to the Service requires an account, and team members only see the clients of their own team. Reports are protected with a password or a personal link. All data is sent over encrypted connections (HTTPS/TLS). The keys that give us access to your accounts (Google refresh tokens and WordPress application passwords) are stored encrypted with AES-256-GCM, passwords are stored hashed, and access to our databases is restricted to the Service and our team.
11. Cookies
We only use cookies that are needed for the Service to work:
- A session cookie that keeps team members signed in.
- A cookie that remembers you have unlocked a password-protected report.
Your light or dark mode choice is stored in your browser only. We don't use tracking or advertising cookies, so we don't ask for cookie consent.
12. Your rights
Under the GDPR you can ask to access, correct or delete your personal data, to restrict or object to its processing, or to receive it in a portable format. Where processing is based on your consent, you can withdraw it at any time. Email support@reactivators.nl and we will reply within one month. If you are not satisfied with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
If we process your data on behalf of one of our clients, we may forward your request to that client and help them handle it.
13. Children
The Service is intended for businesses and is not directed at children under 16.
14. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change matters for how we use your data, we will let our clients know in advance.