Privacy Policy

Last updated: August 20, 2026

This privacy policy explains which personal data SiteLens processes, why, and what rights you have. SiteLens is a service of CtrlSync (Dutch Chamber of Commerce no. 81086334), located at Moeder Theresastraat 5, Veenendaal, the Netherlands. For questions about this policy or your data, you can email thomas@ctrlsync.nl.

1. What data we collect

Account data: name, email address and (hashed) password when creating an account.
Website data: the domain names and names of the websites you connect to SiteLens.
Google account data: when you connect your Google account, we receive, via the Google Analytics Data API and the Google Search Console API, read-only access to statistics for the websites you select yourself (visitor counts, search traffic, page performance). We never get access to your Gmail, Drive, or other Google services.
Payment data: subscription status and billing details, processed by our payment processor Stripe. SiteLens does not store credit card details itself.
Client portal data: if you invite a client as an agency, we store that client's email address to grant access to the client portal.
Newsletter data: if you sign up for the newsletter on sitelens.nl, we keep your email address, whether and when you confirmed your signup, and whether you've unsubscribed.
Technical data: basic logging (timestamps, error messages) for maintaining the service.
Temporary visitor measurement: in an ongoing, temporary evaluation we record the IP address and timestamp of visitors to sitelens.nl, to assess whether we can identify the visiting company from public registry data (RDAP). We do not link this to an individual and do not store browser information, referrer or pages visited.

2. Google API Services and Limited Use

SiteLens's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain language: the Google Analytics and Search Console data we fetch through your connection is used exclusively to show you (or, for an agency account, the client you grant access to) the statistics in the SiteLens dashboard. We do not sell this data, do not use it for advertising, and do not share it with third parties, except for the subprocessors listed in section 4, who process the data solely on our behalf to deliver the service. Automated systems only read the data to generate charts/overviews; there is no human review of the content of your Google data, except when needed for customer support at your request, or required by law.

3. Why we process this data

We process your data to perform our agreement with you (delivering the SiteLens dashboard), under Article 6(1)(b) GDPR. For technical logging and security we rely on our legitimate interest (Article 6(1)(f) GDPR) in a working and secure service. We send the newsletter solely based on your active consent (Article 6(1)(a) GDPR), which you only give after clicking the confirmation link in your email (double opt-in), and which you can withdraw at any time via the unsubscribe link at the bottom of every newsletter email. We carry out the temporary visitor measurement (section 1) on the basis of our legitimate interest (Article 6(1)(f) GDPR) in evaluating a possible product feature.

4. Who we share data with

We share data only with the following subprocessors, who process the data on our behalf:

Supabase: database, authentication and server functions (hosted within the EU).
Google LLC: for fetching the statistics you connect (GA4, Search Console, PageSpeed Insights).
Stripe: for processing subscription payments.
Resend: for sending transactional email and, if you've signed up, the newsletter.

We do not sell personal data and do not share it for third-party marketing purposes.

5. Retention period

We retain account data for as long as your account is active. Google connections (tokens) and the fetched statistics are kept until you remove the connection or cancel your account. After cancellation, we delete your data within 30 days, unless we are legally required to keep it longer (for example, invoice data due to tax retention obligations). Newsletter signups are kept until you unsubscribe. The IP addresses from the temporary visitor measurement (section 1) are deleted automatically after at most 60 days, and the entire measurement is removed once it concludes.

6. Your rights

You have the right to access, correct, delete and receive a copy of your data, and the right to object to processing. You can revoke your Google connection at any time yourself from your SiteLens settings, or via myaccount.google.com/permissions. For other requests, email thomas@ctrlsync.nl. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Cookies

SiteLens uses only functional cookies/local storage to keep you logged in. We do not use tracking or advertising cookies.

8. Security

Data is stored and transmitted encrypted (TLS). Access to production data is limited to what's needed to maintain the service.

9. Changes

We may update this policy. For significant changes, we notify active users by email or via a notice in the dashboard.