Privacy

Last updated 15 October 2026

Kelvix checks whether a website is technically able to appear in search results and AI answers. This page explains what it collects, what it does with anything it reads from Google Search Console, how long that is kept, and how to have it removed.

Who is responsible

Kelvix is operated by Gabriel Wang, a sole proprietor, who is the data controller for the information described here. For any question about this policy, or to ask for your data to be deleted, write to privacy@kelvixai.com.

Running a check

Starting a check needs no account. When you submit a website address, Kelvix fetches up to 20 pages of that site the way a search engine would and stores what it found — the pages, the findings, and the resulting report.

Reading the finished report needs a free account. Anyone you give a report link to can open that report once they sign in; the link itself is unguessable, but treat it as something you are choosing to share.

On the plan you can compare your website with a competitor’s. We check the competitor’s public pages the same way, and that check is stored like any other. The comparison itself is kept with your account: which site you compared, when, and what we found on each. Only you can see your comparisons; they have no share link, and deleting your account deletes them.

Signing in

There is no password. You give an email address, we send a link to it, and following that link signs you in and creates your account if you did not already have one. Asking for a link creates nothing — the account exists only once the address has been proven — so an address typed by mistake leaves no trace beyond the link itself, which stops working after 15 minutes or after one use.

We store your email address, because it is how you sign back in and how we reach you about your subscription or anything we find while monitoring your site. You can delete it, and everything attached to it, at any time — see below.

Your IP address is used at the moment of submission to apply rate limits and to run the Cloudflare Turnstile anti-abuse check. It is held in a short-lived counter that resets within the hour and is not written to our database.

Connecting Google Search Console

Connecting Search Console is entirely optional. Kelvix can tell you that nothing is blocking a page; only Search Console can tell you whether Google has actually indexed it, so connecting is what turns that unknown into an answer.

What we ask for

Kelvix requests your name, email address and Google account identifier, plus one Search Console permission: https://www.googleapis.com/auth/webmasters.readonly. That permission is read-only. Kelvix uses it for exactly two things: listing the properties on your account so it can find the one matching the site in your report, and asking the URL Inspection API what Google reports about each page in that report. Kelvix never writes to, changes, or submits anything to your Search Console.

What we store

• Your Google account identifier, email address and name.
• The refresh token that keeps the connection working, encrypted with AES-256-GCM. It is never stored in readable form and is decrypted only at the moment a request to Google is made.
• Which Search Console property was matched, which permissions you granted, and when the connection was made and last used.
• What Google reported about each page in your report: the page address, the coverage state and verdict, the robots and indexing state, and when Google last crawled it. This is stored with the report so the report stays a record of what Google said on the day it was made.

What we never do

• Sell your data, or share it with anyone for advertising.
• Use it to train machine-learning or AI models.
• Use it for anything other than producing and improving your report.
• Ask for, or hold, any permission that can change your Search Console.

How long it is kept

When you disconnect Search Console, Kelvix immediately tells Google to revoke its access, then stops using the connection. Everything it holds from that connection — the stored token, the connection record, and the indexation results Google returned — is permanently deleted within 30 days by an automated nightly job.

An account that has no connected property and has not been used for 30 days is deleted on the same schedule, along with its sign-in sessions.

The report itself is not deleted, because the share link is the product and other people may hold it. Once the Google data is removed the report simply stops showing the indexation section; it never continues to display what Google said. Crawled page content that is kept only to re-run checks is discarded after 30 days. What stays with the report is its findings and a short summary of each page we read: its address, some counts, and the kinds of structured data on it, never its text.

Removing your data

You can do either of these at any time, without asking us:

• Disconnect — from your account page, or from any report where you are connected. This revokes Kelvix’s access at Google straight away, stops any recurring checks of that site, and starts the 30-day deletion described above.
• Delete everything now — on your account page or the report. This cancels any paid plan with Stripe so you are not charged again, revokes access at Google, and then deletes your account, your connection and every stored indexation result immediately, rather than waiting for the nightly job.

You can also revoke Kelvix’s access directly from your Google account at myaccount.google.com/permissions. If you would rather we did it for you, email privacy@kelvixai.com and we will action it and confirm.

Who else processes this data

Kelvix runs on a small number of providers, each acting on our instructions:

• Cloudflare — hosting, the anti-abuse check, and stored page snapshots.
• Neon — the database holding reports, accounts and connections.
• Resend — sending operational alert email to us. Your data is not sent through it.
• Google — the source of the Search Console data, when you connect it.
• Anthropic — the AI model behind two paid features. Nothing is sent unless a subscriber uses one of them:
  • The AI helper under each problem. When you ask a question, we send the finding, why it matters, its fix, the pages it affects, the website’s address, what your pages suggest the site is built with, your three answers about your site if you gave them, and the question you type, along with the earlier questions and answers in that same conversation. We keep those three answers (what builds your site, who changes it, and how you feel about code) with your account so the helper does not ask again; you can change them on your account page. We keep a count of the questions you ask and what each one cost us. We do not keep what you asked or what it answered: your browser keeps the conversation on your device so you can pick it up later.
  • Business markup, on the AI plan. When you ask us to write it, we send the text of up to four public pages of the website being checked.
  Your email, your account details and your Search Console data are never sent.
• Stripe — payments, for the plan and for packs of questions. You enter your card on Stripe’s own page and it never reaches Kelvix. We keep your Stripe customer and subscription references, your plan and its status, and a record of each pack you buy. While a payment is failing we also keep the link to Stripe’s page for paying it, so our reminders can include it. We keep a record of which billing emails we have sent you (payment reminders, and when your plan paused and started again), so none is sent twice. At checkout Stripe asks for your billing name and address, and a tax ID if your business has one; Stripe keeps them and prints them on your invoices, and we do not store them. When you open your invoices on your account page we fetch them from Stripe to show you, and keep no copy.

Cookies

Kelvix sets no advertising or analytics cookies and does not track you across sites. It sets two cookies, both strictly necessary: a short-lived one lasting 30 minutes that protects the Search Console connection while it is in progress, and a sign-in cookie lasting 30 days once you sign in. Signing out from your account page, or deleting your data, removes the second and ends the sign-in on our side too. Cloudflare may set its own cookie as part of the anti-abuse check. People who work on Kelvix may have one more, which lets them switch between their own test accounts; it is never set for anyone else.

How we count visits

We count how many people reach each step of the site — the home page, a report, starting a check, connecting Search Console, opening the payment page — so we can tell whether the product is working. A count is all it is: no cookie is set for it, no identifier of any kind is stored, and nothing links one step to another or to you. We cannot tell that the person who read a report is the person who later subscribed, and we have not built the means to.

One further thing is stored alongside a count: where the visit came from. That is either a short marker we put on our own links (so we can tell one post from another) or the domain name of the site that linked to you — the domain only, never the full address, which can carry personal details in it. Nothing is shared with an advertising network and there is no third-party analytics service involved.

Changes

If this policy changes in a way that affects what happens to data already collected, the date at the top will change and, where we hold an email address for you, we will tell you. Questions go to privacy@kelvixai.com.