Privacy Policy

1. Introduction

ERPFIT CO., LTD (Tax ID: 0317567782) operates the CiteStat service at aiseo.erpfit.com. We are committed to protecting your privacy and personal data in accordance with Vietnamese law.

2. Data We Collect

• Account information: email, name (upon registration)
• Usage data: scanned URLs, report history, API key usage
• Technical data: IP address, browser (user agent), session cookies, API request logs
• Google Search Console connection (if you connect it): your Google account email and OAuth access tokens
• Bing Webmaster Tools connection (if you connect it): the Bing API key you provide

3. How We Use Data

• Providing SEO audit services and reports
• Account authentication and management
• Security, abuse prevention and rate limiting
• Improving service quality
• Sending periodic reports (if subscribed)

4. Data Sharing and Processors

We do not sell your personal data. We share data only: (a) with your consent, (b) as required by law, or (c) with the technical processors needed to provide the service, listed below:

• Cloudflare (USA, global network): delivers and protects website traffic — processes IP addresses and requests
• Resend (USA): sends email (verification, reports) — processes email addresses and email content
• Google (USA): Google Search Console when you connect it; PageSpeed Insights and CrUX receive the scanned URL
• Microsoft Bing Webmaster Tools (USA): when you connect it with your API key
• AI model providers (for example Anthropic, USA), through our internal AI gateway: receive the public content of scanned pages for analysis and suggestions — not your account information
• auth.erpfit.com: the shared sign-in service operated by ERPFit

Some of these processors are located outside Vietnam, so the related data may be transferred abroad for the purposes above.

5. Data Security

Data is secured with HTTPS encryption, API keys are SHA-256 hashed, and passwords are securely hashed. The service database is stored on servers in Vietnam.

6. Data Retention

• Account information and report history: kept while your account is active, deleted when you ask us to delete your account
• Google/Bing connections: tokens and API keys are deleted as soon as you disconnect or delete your account
• Request and session logs (with IP addresses): kept for security and abuse prevention; IP addresses are erased automatically after 12 months, and you can ask us to delete the logs linked to your account at any time

7. Your Rights

You have the right to: be informed, access your personal data, request corrections, request deletion of your data or account, restrict processing, and withdraw consent at any time by contacting us. Deletion requests are carried out within 72 hours of receipt, per Decree 13/2023/ND-CP.

8. Cookies

We use session cookies necessary for service operation. We do not use advertising or third-party tracking cookies.

9. Contact

For privacy policy questions, contact:

CÔNG TY TNHH ERPFIT
Email: [email protected]
MST: 0317567782