1. Who we are
The Colewood Digital SEO Audit Tool is operated by Colewood Internet Ltd, trading as Colewood Digital (“Colewood”, “we”, “us”). Colewood Internet Ltd is registered in England and Wales under company number 03843745. Our address is Colewood House, 1 Kingfisher Way, Stockton-on-Tees, TS18 3EX.
For information held in our own business systems, Colewood normally acts as controller. When we process information for a client under an engagement, the respective controller and processor responsibilities may also be governed by our contract with that client.
2. Information we collect
Workspace and account information
We store authorised users’ names, business email addresses, roles, account status, password hashes, last-login information and security/activity records. The hosting environment may also create ordinary server logs containing IP address, browser, request and timestamp information.
Audit and client information
We store client names, website addresses, audit configurations, URLs, crawl findings, performance results, search and competitor evidence, analyst notes, AI-assisted drafts, approved reports and related history supplied or generated during an engagement.
Essential cookies
The application uses an essential session cookie to maintain authenticated access and protect the workspace. It is not used for advertising. The public information pages do not intentionally set marketing cookies.
3. Google user data
When an authorised user connects Google, the application requests the minimum permissions currently needed: identity/email, read-only Google Search Console access and read-only Google Analytics access.
We may collect and store the connected account email, encrypted OAuth access and refresh tokens, granted scopes, selected Search Console property and permission level, selected GA4 property identifier and name, and the evidence retrieved for an authorised audit.
Search Console evidence may include aggregate clicks, impressions, click-through rate, average position, query and page performance, dated trends and derived opportunities. GA4 evidence may include aggregate organic users, sessions, engaged sessions, engagement rate, key events, channel information and landing-page performance. The tool does not request permission to edit Search Console or Analytics properties.
Google user data is used only to provide client-authorised audit, reporting, comparison and recommendation features visible within the application. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
4. AI-assisted processing
When an authorised user starts an AI assessment, relevant stored audit evidence—including selected aggregate or derived Search Console and GA4 evidence where available—may be sent to the OpenAI API to produce an assessment draft. This processing is used solely to provide the requested audit feature. Colewood personnel review and may edit the output before approval or client publication.
We do not use Google user data to train a general-purpose AI model. OpenAI states that API inputs and outputs are not used to train its models by default unless the API organisation explicitly opts in. OpenAI may retain API data for service operation and abuse monitoring in accordance with its published business and API data policies.
5. Purposes and lawful bases
We process information to provide and secure the application, perform client engagements, create requested audits and reports, maintain business records, respond to enquiries and comply with law. Depending on the context, our lawful bases may include performance of a contract, legitimate interests, consent and compliance with legal obligations.
7. Security
Controls include role-based access, protected sessions, password hashing, encrypted storage of Google OAuth tokens, audit logging and restricted administrative access. No internet service can be guaranteed completely secure, but we take proportionate technical and organisational measures to protect the information entrusted to us.
8. Retention, disconnection and deletion
Google tokens and connection details are retained while the client connection remains active. Using the application’s Disconnect control deletes the stored Google connection and tokens from the active client workspace. A user may also revoke access from their Google Account permissions.
Disconnecting does not automatically delete historical evidence already collected into an audit, because that evidence may form part of an approved client work product or business record. To request deletion of stored Google-derived evidence, reports or an account, email enquiries@colewood.net with the client/workspace name and sufficient information for us to verify authority. We will delete or anonymise eligible information within a reasonable period, subject to legal, security and contractual retention requirements.
Other information is kept only for as long as needed for the relevant engagement, operational security, dispute resolution, legal obligations or legitimate business records.
9. Your data-protection rights
Depending on the circumstances and applicable law, you may have rights to access, correct or erase personal data; restrict or object to processing; receive portable data; and withdraw consent. You may also complain to the UK Information Commissioner’s Office. We may need to verify your identity and authority before acting on a request.
10. Children
This is a business application and is not intended for children. We do not knowingly invite children to create accounts or connect Google data.
11. Changes to this policy
We may update this policy as the application, providers or legal requirements change. The updated date above identifies the current version.
12. Contact
Email enquiries@colewood.net, telephone 0845 123 2908, or write to Colewood Internet Ltd, Colewood House, 1 Kingfisher Way, Stockton-on-Tees, TS18 3EX.