DATA HIT

Privacy Policy

Last updated: 28 May 2026

This privacy policy explains how DATA HIT Ltd ("DATA HIT", "we", "us", "our") handles your information when you use the tools hosted at tools.datahit.co. The tools fall into two categories with different data-handling models — both are covered in this single policy. Read alongside the DATA HIT main privacy policy, which covers general website usage.

DATA HIT Ltd is a company registered in England and Wales, with its registered address at 2 Infirmary Street, Leeds, LS1 2JP. For any privacy-related enquiries, please contact us at hello@datahit.co.

1. The tools at a glance

We currently offer the following tools at tools.datahit.co:

2. OAuth-based tools (Seasonal Spiral, Timing Grid)

When you connect your Google account to one of the OAuth-based tools, we request the following read-only scopes:

Both scopes are read-only. We do not request any permissions to modify, delete, or write data to your Google accounts.

Spiral and Timing Grid each offer two ways to connect. The default is browser-only and stores nothing on our servers. The optional persistent connection stores a refresh token on our servers so the connection survives across visits and so Pro features that run on a schedule (e.g. the Monday digest) can fetch on your behalf.

Default: in-browser connection.

Optional: persistent server-side connection. When you click "Stay connected next time" beside the Connect Google button, or any time a Pro feature needs to query Google on your behalf when you are not actively at the page (e.g. the Monday digest cron), the tool initiates the OAuth 2.0 authorisation-code flow with offline access instead. This issues a refresh token that we encrypt and store server-side so we can mint short-lived access tokens for future requests. Specifics:

We do not use your Google user data for any purpose other than providing the visualisation and the Pro features you have enabled. Your data is never used for advertising, marketing, profiling, AI model training, or any purpose unrelated to the tool's core functionality.

To revoke access at any time, click "Disconnect" in the tool or visit your Google Account permissions page.

3. SERP Seasonality Map (server-side data flow)

Unlike the OAuth tools above, the SERP Seasonality Map runs partly on our servers because it consumes public SERP data from a third-party SEO provider and generates an analyst-style insight via a third-party LLM provider. This section explains exactly what is sent where.

What you provide:

We do not ask for, collect, or store any personal information — no name, email, account, or contact details — to use this tool.

What we process server-side:

Third parties that receive your scan data:

We never sell or share your keyword data with any party other than the processors listed above. We never combine your scan data with any other identifier.

Sensitive keywords: because your keyword is transmitted to DataForSEO and Anthropic to produce the scan, please avoid using the tool to look up personal information, medical conditions, or any other information you would not feel comfortable sharing with those third parties under their respective policies.

4. AI Mention Monitor (server-side data flow)

Like the SERP Seasonality Map, the AI Mention Monitor runs partly on our servers because it consumes data from a third-party SEO provider. Unlike SERP, the AI Mention Monitor scans an AI engine's response index rather than Google's organic search results, and is gated to Pro accounts for non-sample scans. This section explains exactly what is sent where.

What you provide (Pro accounts only):

Free users see a fixed sample scan (a hard-coded "best CRM" result) and cannot trigger a real scan. No data is transmitted to any third party in the free-preview path.

What we process server-side (Pro scans only):

Third parties that receive AI Mention Monitor scan data:

We never sell or share AI Mention Monitor scan data with any party other than the processors listed above. The brand names, source URLs, and fan-out queries returned by DataForSEO and stored in our database are not your personal data — they are public third-party data about the AI engine's response patterns — but they are scoped to your account so only you can see your own scan history.

Pro: watched scans and weekly diff cron. When you click the ★ Watch button on a completed scan, we add the (keyword, country, platform) tuple to a "watch list" (D1 ai_monitor_watches, capped at 20 entries on Solo and 50 on Agency). Every Monday at 07:00 UTC, an automated cron re-runs each watched scan and computes a diff against the previous week's results (new and dropped brand mentions, new and dropped cited sources). The diff is persisted to D1 (ai_monitor_diffs) and surfaced on your /app/welcome dashboard. These cron-driven scans draw from a separate processing budget and do not decrement your manual monthly quota. The third-party data flow for each cron-driven scan is identical to a user-triggered scan (see "Third parties" above).

Pro: AI overview (optional). Click the "Generate AI overview" button on a completed scan and we send the scan's brand / fan-out / source tables to Anthropic to produce a 2-4 sentence plain-English summary. See section 5 for the shared AI overview data flow that covers Spiral, Timing Grid, AI Mention Monitor, and SERP Seasonality Map.

Sensitive keywords: because your keyword is transmitted to DataForSEO (and, if you click Generate AI overview, to Anthropic), please avoid using the tool to look up personal information, medical conditions, or any other information you would not feel comfortable sharing with those third parties under their respective policies.

5. DATA HIT Tools Pro accounts

The Pro tier adds account-based features on top of the three free tools. Using Pro requires an email address (for sign-in) and a payment method (for the subscription). Everything in this section applies only to users who have created a Pro account; the free tools remain anonymous and unchanged.

What we collect when you create a Pro account:

We do not collect your name, address, or any other contact information for the Pro tier. Stripe handles all payment details directly — we never see your card number or full billing address.

Authentication (magic links):

What we store as you use Pro features:

What we do with this data:

AI overview (on-demand Pro feature). Every Pro-tier chart page (Spiral, Timing Grid, AI Mention Monitor, SERP Seasonality Map) offers a "Generate AI overview" button that produces a 2-4 sentence plain-English summary of the visible chart. The data we send to Anthropic differs per tool:

In each case the request goes to Anthropic via the Claude API; the response is sanitised (only <strong> tags allowed) and rendered inline. Generated overviews are cached in Cloudflare Workers KV for 24 hours, keyed by a hash of the full input payload, so re-clicking Generate on identical chart state returns the cached output without a fresh API call. We never send your email, user id, or any other account identifier to Anthropic. Per Anthropic's published policy, API requests are not used to train their models by default.

We do not use your Pro account data for advertising, profiling, AI model training, or any purpose unrelated to operating the tools.

Third parties that receive Pro account data:

We never sell or share Pro account data with any party other than the processors listed above. We never combine your Pro data with any other identifier.

Closing your Pro account: to permanently delete your Pro account and all associated data (tracked keywords, SERP snapshots, AI Mention Monitor scans, watched AI scans, weekly AI mention diffs, saved views, annotations, anomaly alerts, sessions, digest history, billing event log entries scoped to your record), email hello@datahit.co from the address registered on the account. We will cancel any active subscription via Stripe and hard-delete your D1 rows. You can also self-serve cancel the subscription at any time from your dashboard via the Stripe billing portal — that ends future billing but leaves your account data in place until you also email us to request deletion.

6. Analytics

We use Plausible Analytics, a privacy-focused analytics service, to collect anonymous usage statistics about our tools pages. Plausible does not use cookies, does not collect personal data, and is fully compliant with GDPR, CCPA, and PECR. No Google user data, scan data, keyword data, or Pro account data is shared with Plausible. The only data collected relates to page views and lightweight custom events (e.g. that a scan was triggered, that a Pro annotation was created — never the keyword text or annotation content itself).

7. Cookies and local storage

The free tools at tools.datahit.co set no tracking cookies. We use the following browser localStorage items, all of which are purely UI preferences with no identifying value and no third-party visibility:

Pro accounts use one HTTP cookie — dh-session, HMAC-signed, HttpOnly, Secure, SameSite=Lax, 30-day sliding expiry. The cookie carries only the session id; identity is resolved server-side. The cookie is not set unless you sign in. Signing out (from the dashboard or via the sidebar) deletes both the cookie and the server-side session row.

For information about cookies used on the main DATA HIT website, see our main privacy policy.

8. Data retention summary

Free tools:

Pro accounts:

To request earlier deletion of a specific cached scan, share slug, or entire Pro account, email hello@datahit.co.

9. Data protection

All communication between your browser, our Workers, and any third party we transmit data to is encrypted using HTTPS/TLS. Our Worker runs on Cloudflare's edge with strict secret-management for the API credentials used to call DataForSEO, Anthropic, Stripe, Resend, and (for OAuth tools) Google. The OAuth client IDs for our connected tools are restricted to authorised JavaScript origins, preventing use from unauthorised domains. Session cookies are signed with a server-side HMAC key so a tampered cookie cannot impersonate a Pro user; Stripe webhooks are verified with Stripe's HMAC-SHA256 signature scheme before any database write.

10. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

Free tools: because we do not collect personal information (name, email, account) to use any of our free-tier tools, and because all cached SERP data is short-lived and not tied to your identity, most of these rights are effectively fulfilled by design. To revoke OAuth access, use the tool's disconnect button or your Google Account permissions page. To purge a cached SERP scan or share slug, email hello@datahit.co.

Pro accounts: you can review the bulk of what we hold about you directly from the dashboard at /app/welcome (tracked keywords, saved views, annotations, recent digest activity). To request a full export of your account data, to correct anything inaccurate, or to delete the account entirely, email hello@datahit.co from the address registered on the account.

If you have any concerns about how your data is handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

11. Changes to this policy

We may update this privacy policy from time to time. Any changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our tools after changes are posted constitutes your acceptance of the updated policy.

12. Contact

If you have any questions about this privacy policy or how your data is handled, please contact us: