1. Data controller
The controller of the personal data collected through the zerkado.com website is Novatis Agency SAS, 34 avenue des Champs-Élysées, 75008 Paris, France (RCS Paris 912 890 019), publisher of Zerkado. For any questions about the protection of your data, you can contact us at: [email protected].
2. Data collected
2.1 Data provided directly by the user
When you create your account and use our services, we collect the following data: first and last name, email address, company name (where applicable), billing information (address, EU VAT number), and any other information you choose to share with us through contact forms or customer support.
2.2 Data collected automatically
When you browse zerkado.com, certain data is collected automatically: IP address, browser type and version, operating system, pages visited and length of visit, referring URL, cookie identifiers and session data. This data is collected through cookies and similar technologies, detailed in section 7 of this policy.
2.3 Data related to the use of the service
When you use the Zerkado platform, we process data related to your SEO projects: URLs of analyzed websites, tracked keywords, analysis results, content submitted for AI optimization, generated reports and activity history on the platform. This data is necessary to provide the service and remains your exclusive property.
3. Purposes of processing
Your personal data is processed for the following purposes: providing, managing and improving our services; managing your user account and subscription; processing payments and billing; sending service-related communications (notifications, updates, security alerts); sending marketing communications (with your consent); analyzing use of the service to improve its features; complying with our legal and regulatory obligations; and preventing fraud and securing the service.
4. Legal bases for processing
The processing of your data relies on the following legal bases, in accordance with Article 6 of the GDPR:
Performance of the contract: processing is necessary to perform the subscription contract you entered into (account management, provision of the service, billing).
Consent: for sending marketing communications and placing non-essential cookies, we obtain your prior consent, which you can withdraw at any time.
Legitimate interest: for improving our services, preventing fraud and securing the platform.
Legal obligation: for complying with our accounting, tax and regulatory obligations.
5. Data recipients
Your personal data is accessible to authorized members of the Novatis Agency SAS team strictly within the scope of their duties. It may also be shared with our technical subcontractors, who act only on our instructions and are bound by GDPR-compliant contractual confidentiality and security obligations. These subcontractors include in particular: our payment provider (Stripe, PCI DSS certified), our hosting and cloud infrastructure providers, our artificial intelligence service providers, our transactional email providers, our SEO data provider (DataForSEO, which receives the analyzed domains and keywords), the LinkBooster link building platform when you use it from Zerkado (your name and email address are then shared with it) and Google when you connect Search Console or Analytics, or sign in with your Google account. If you accept it in your notification settings, when you compare your competitors' backlinks with its catalogue LinkBooster also receives your project's domain, your competitors and the sites of its catalogue where they have a link, in order to send you offers (three emails at most per analysis); you can withdraw this consent at any time.
We never sell, rent or share your personal data with third parties for commercial purposes.
6. International data transfers
Some of our subcontractors may be located outside the European Economic Area (EEA). In that case, we ensure that appropriate safeguards are in place in accordance with the GDPR, in particular through standard contractual clauses approved by the European Commission or by using providers certified under the EU-US Data Privacy Framework.
7. Cookies and similar technologies
7.1 Essential cookies
These cookies are strictly necessary for the website to work and cannot be disabled. They include session, authentication and security cookies.
7.2 Analytics cookies
With your consent, we use analytics cookies to measure the website's audience, understand how users interact with our pages and improve the user experience. These cookies collect anonymized and aggregated data.
7.3 Functionality cookies
These cookies remember your preferences (language, theme, display settings) to personalize your experience on the platform. This category also controls the loading of our live chat, provided by a third-party provider: until you have accepted it, this service is not loaded and receives no information about your visit.
7.4 Managing cookies
You can set your cookie preferences through the consent banner displayed on your first visit. You can change them or withdraw your consent at any time with the “Manage my cookies” link at the bottom of every page, or here: . Your choice is kept for thirteen months at most, after which you are asked again. Disabling certain cookies may affect how the website works.
Business prospecting
We may write to professionals whose address is published in a professional context (their company's website, a directory or a professional network) to present an offer related to their role. This prospecting is based on our legitimate interest (Article 6.1.f of the GDPR). The origin of each address is recorded; each message states where it came from, lets you object in one click or by replying “STOP”, and explains how to exercise your rights. After 2 years without contact, a prospect's data is anonymized; the content of the messages sent to them is erased after 13 months. A person who has objected remains on an opt-out list, the only data kept, so that they are never contacted again.
8. Retention period
Your personal data is kept for as long as necessary for the purposes for which it was collected: account data is kept for the entire duration of your subscription and for 3 years after your account is deleted; billing data is kept for 10 years in accordance with accounting obligations; browsing data and logs are kept for a maximum of 13 months; customer support data is kept for 3 years after the ticket is closed.
Free trial not followed by a subscription: the account data (organization, projects, analyses) is erased 30 days after the end of the trial. An email notifies you at least 7 days beforehand. An archive is kept for 6 months so you can resume your account, and then destroyed.
9. Data security
We implement appropriate technical and organizational measures to protect your personal data against any unauthorized access, alteration, disclosure or destruction. These measures include encryption of data in transit (TLS/SSL), encryption at rest of credentials and access tokens (mailbox passwords, API keys, Google tokens), secure authentication, restriction of data access according to the principle of least privilege, continuous system monitoring, and regular security audits.
10. Your rights
Under the GDPR, you have the following rights over your personal data:
Right of access: you can obtain confirmation that your data is being processed and request a copy. Right to rectification: you can request the correction of inaccurate or incomplete data. Right to erasure: you can request the deletion of your data under the conditions set out by the GDPR. Right to data portability: you can receive your data in a structured, commonly used and machine-readable format. Right to restriction: you can request that the processing of your data be restricted in certain circumstances. Right to object: you can object to the processing of your data based on legitimate interest. Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time.
To exercise these rights, contact us at [email protected]. We undertake to respond to your request within one month. If you encounter any difficulty, you have the right to lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr.
11. Minors
Zerkado's services are not intended for people under 18 years of age. We do not knowingly collect personal data from minors. If we discover that a minor has provided us with personal data, we will take the necessary steps to delete it.
12. Data from Google APIs (Search Console and Analytics)
Zerkado lets you optionally connect your Google account to import Google Search Console data (search queries, clicks, impressions, positions) and Google Analytics data (sessions, users, bounce rate) for the websites you manage. This access is read-only, through the following OAuth scopes: webmasters.readonly (Search Console), analytics.readonly (Analytics), as well as your email address and basic profile to identify the connected account.
This data is used exclusively to provide the features visible in your Zerkado workspace: rank tracking, content analysis, cannibalisation detection, internal linking and SEO reports for the project to which the Google account is linked. It is never sold, never used for advertising purposes, never shared with third parties other than the technical subcontractors required to host the service, and never used to train generalized artificial intelligence models. Google access tokens are stored securely and are used only to sync your own data.
You can revoke this access at any time, either from the project settings in Zerkado (“Disconnect” button) or from your Google account at myaccount.google.com/permissions. Revocation immediately stops syncing; data already imported can be deleted on simple request to [email protected].
Zerkado's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
13. Changes to this policy
We reserve the right to modify this privacy policy at any time. Any substantial change will be notified by email or by a notification in the platform interface. The date of the last update is shown at the top of this page.