1. Controller
The controller of personal data processed via this website and the
Reflexa service is Reflexa Technologies AB, Sweden
(“Reflexa”, “we”). Contact:
info@reflexatechnologies.com.
2. What we collect
- Account data — email address and login credentials when you create an account.
- Audit data — the domain you submit and the analysis results we generate for it. Audits read only publicly available web content.
- Usage data — technical logs such as IP address, browser type, pages visited and timestamps, collected by our hosting infrastructure for security and operation.
- Communications — emails you send us and newsletter signups.
3. Why we process it (legal bases, GDPR art. 6)
- To provide the Service — running audits, showing reports, operating your account (performance of a contract, art. 6(1)(b)).
- To secure and improve the Service — logs, abuse prevention, aggregated statistics (legitimate interest, art. 6(1)(f)).
- To communicate with you — replying to messages; sending product updates you signed up for (legitimate interest / consent, art. 6(1)(a)). You can unsubscribe at any time.
- To comply with law — where processing is legally required (art. 6(1)(c)).
4. Sharing and processors
We do not sell personal data. We share it only with service providers
(processors) that help us run the Service — hosting and infrastructure,
email delivery, and AI/API providers used to perform analyses — under
data-processing agreements, and with authorities where required by law.
Where providers are located outside the EU/EEA, transfers rely on
appropriate safeguards such as the EU Standard Contractual Clauses or an
adequacy decision.
5. Google user data (Search Console connection)
If you choose to connect Google Search Console to Reflexa, we ask
Google for read-only access to your Search Console data
(https://www.googleapis.com/auth/webmasters.readonly).
Reflexa's use of information received from Google APIs adheres to the
Google API Services User Data Policy,
including the Limited Use requirements.
- What we access — the list of Search Console properties on your Google account (to find the one matching your connected domain) and that property's search analytics for the last 28 days: the search queries your site appeared for, with clicks, impressions, average position and the page shown. We do not access Gmail, Drive, Analytics, Ads or any other Google data.
- Why — only to provide the feature you asked for: turning the searches Google shows your site for into buyer questions Reflexa checks in AI assistants, and showing your Google position next to each AI answer in your reports.
- Storage and security — the Google refresh token is stored encrypted at rest and used only to read the data above; the search analytics rows are stored with your site. We do not share, sell or transfer Google user data to third parties, do not use it for advertising, and do not let humans read it except with your consent, for security, or where required by law. It is never used to train AI models.
- Revoking — disconnect at any time from your site's Settings (we delete the stored token and the search data) or at myaccount.google.com/permissions. Deleting your Reflexa account deletes it as well.
You can also use the same feature without a Google connection by
uploading the Performance export from Search Console yourself; the file's
rows are then handled exactly as described above.
6. Retention
We keep personal data only as long as needed for the purposes above:
account data for the life of the account; audit data while it is needed
to provide reports and tracking; logs for a limited security-retention
period; correspondence as long as relevant. Data is then deleted or
anonymized.
7. Your rights
Under the GDPR you have the right to access, rectify and erase your
personal data, to restrict or object to processing, to data portability,
and to withdraw consent at any time (without affecting prior processing).
To exercise any right, email
info@reflexatechnologies.com.
You also have the right to lodge a complaint with the Swedish Authority
for Privacy Protection (IMY, imy.se) or your local
supervisory authority.
8. Cookies
This website (reflexatechnologies.com) does not set advertising or
cross-site tracking cookies.
- Strictly necessary cookies — the Reflexa dashboard (dashboard.reflexaagent.com) sets cookies that are required to log you in, keep your session secure and protect forms against bots (e.g. Cloudflare Turnstile). These cannot be switched off, as the Service cannot function without them.
- No marketing cookies — we set none and do no cross-site tracking or ad profiling.
- Privacy-friendly, cookieless analytics — to understand aggregate traffic (page views, approximate visitor counts, referring source and device type) we use our own first-party analytics that set no cookies and store no IP address or personal identifier. Unique visitors are estimated with a daily-rotating, non-reversible hash that cannot identify you or be linked across days. No data is shared with third parties. Because this uses no cookies and no personal data, it needs no consent under the ePrivacy Directive and GDPR.
- Third-party resources — pages load fonts from Google Fonts, which involves your browser requesting files from Google's servers (transmitting your IP address). See Google's privacy policy for details.
You can delete or block cookies in your browser settings at any time;
essential dashboard functions may stop working if you do.
9. Security
We use appropriate technical and organizational measures — encryption
in transit, access controls and least-privilege infrastructure — to
protect personal data. No method of transmission or storage is 100%
secure; to the maximum extent permitted by law, we are not liable for
circumstances outside our reasonable control.
10. Children
The Service is intended for business use and not directed at persons
under 18. We do not knowingly collect data from children.
11. Changes
We may update this policy at any time by posting the new version here
with an updated effective date.
12. Contact
Reflexa Technologies AB ·
info@reflexatechnologies.com
