Privacy Policy

1. Controller

Controller for KI-Console at ki-console.com is Alpasana GmbH, Farbweg 18, 5745 Safenwil, Switzerland. The responsible person is Sascha Fiechter.

You can reach us for privacy matters at website@ki-console.com or info@alpasana.ch.

2. Scope

This privacy policy applies to the KI-Console website, the SaaS application, public scans, user accounts, generated reports, public badges, the public directory, and the machine-readable AI register.

KI-Console is operated from Switzerland and is available to users worldwide. We apply the Swiss revised Data Protection Act and the GDPR where it applies, in particular for users in the EU or EEA.

As the service is aimed at users worldwide, before the international launch we assess whether an EU representative under Art. 27 GDPR must be appointed, and will appoint one if required.

3. Data categories processed

• Account data: name, email address, bcrypt password hash, role, plan, activation status, email verification token, timestamps, and login/session data.
• Website data: submitted domains, verification tokens, verification status, and creation timestamps.
• Scan data: scan scores, check keys, status values, technical details, response and crawler-readiness findings for robots.txt, sitemap.xml, llms.txt, HTML and meta signals.
• Crawler visit data: bot name, visit timestamp, and URL where users use monitoring or provide logs.
• Generated files: generated llms.txt, sitemap.xml, report files, badge/report tokens, and related metadata.
• Security and operational data: password reset tokens, operational email logs, system settings, and administrative actions required to run the service.
• Anonymous public scan limits: hashed IP address, submitted domain, and period information to enforce the monthly free-scan limit.

4. Purposes and legal bases

• Contract performance, GDPR Art. 6(1)(b): account creation, login, website registration, verification, scans, generated files, monitoring, alerts, and plan administration.
• Legitimate interests, GDPR Art. 6(1)(f): service security, abuse prevention, rate limiting, error diagnosis, operational mail logs, product improvement, and proof of technical operations.
• Consent, GDPR Art. 6(1)(a), for listing free-account websites in the public directory and KI register after opt-in; performance of contract, GDPR Art. 6(1)(b), for paid-plan listing as part of Starter, Business, and Agency plans, with opt-out at any time.
• Legal obligations, GDPR Art. 6(1)(c), where applicable: accounting, tax, business records, and response to lawful requests.
• Under Swiss data protection law we process personal data lawfully, transparently, proportionately, and only for the stated or compatible purposes.

5. Cookies

We use only technically necessary cookies: a PHP session cookie with HttpOnly and SameSite settings for login and CSRF protection, and a language-preference cookie to remember the selected language.

We do not use analytics cookies, advertising cookies, cross-site tracking, or a tracking-based consent wall.

The public-scan security question uses the existing PHP session cookie only; no third-party captcha cookie is set.

6. Fonts

The Rajdhani, Rubik, and Squada One fonts are self-hosted from our own assets under the SIL Open Font License. Loading the fonts does not create a connection to Google or other third-party font servers.

7. Recipients and processors

• Hosting provider: KI-Console is hosted with Metanet AG (Zurich, Switzerland) in a professional Plesk environment; data is stored in Switzerland. Further processors and the list of data-processing agreements are available on request.
• Email delivery: operational emails such as verification, password reset, invoices, and alerts are sent via the configured mail infrastructure.
• Payment provider: Stripe is not currently integrated. If online payments are activated later, payment data may be processed by a payment service provider such as Stripe. The privacy policy and processor list must then be updated before go-live.
• Public listing features: free verified websites are published only after opt-in; paid verified websites are listed by default as part of the plan unless the owner opts out. Published data can include domain, score, description, public report link, and register metadata.

8. Retention and deletion

Account deletion removes the user account and related websites, scans, scan checks, generated files, and reports through database cascades where technically configured.

Password reset tokens expire after one hour. Anonymous scan-rate-limit entries are used for the monthly period. Operational mail logs, security logs, invoice records, and backups are retained only as long as needed for operation, security, contractual claims, or statutory duties.

Account data is retained until the account is deleted and removed thereafter. Invoicing and accounting records are kept for ten years in accordance with Art. 958f of the Swiss Code of Obligations. Mail logs and security events are generally retained for up to twelve months, backups on a rolling basis for a maximum of 30 days. Anonymous scan rate limits are deleted automatically after a short period.

9. International transfers

The productive hosting is intended to be in Switzerland. If future processors, payment providers, support tools, or email infrastructure process data in the EU, the EEA, the United States, or other countries, we will use appropriate safeguards and update this policy before launch or activation.

10. Rights of data subjects

Depending on the applicable law, you may request access, rectification, deletion, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent for future processing.

Send requests to website@ki-console.com. We may need information to verify your identity before processing the request.

11. Right to complain

In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC/EDOEB). EU users may also contact the competent supervisory authority in their EU member state.

12. Public directory and KI register

Free-account websites appear in the public directory and in ki-register.txt / ki-register.json only after opt-in. Websites in paid plans (Starter, Business, Agency) are listed by default as part of the contracted service and can be opted out at any time in the website settings. Operator domains are listed with extended detail.

Opt-out or removal takes effect promptly in KI-Console. Because public files are cached and may be copied by crawlers, public copies can persist for up to about 15 minutes and third-party caches may remain outside our control.

13. Automated third-party website checks

KI-Console uses the crawler user agent KI-Console-Bot/1.0 (+https://ki-console.com/bot) to fetch websites submitted by users or anonymous visitors. The scanner checks public resources such as robots.txt, sitemap.xml, llms.txt, the homepage, a few public pages at most, and public HTML/meta signals.

For anonymous public scans, results are cached for 24 hours per domain. To prevent abuse, we store salted IP hashes for a rolling quota of 4 live scans per 24 hours under legitimate interests, GDPR Art. 6(1)(f) and Swiss revDSG. The self-hosted captcha is session-only, uses no third-party service, and does not track users. If robots.txt excludes KI-Console-Bot with Disallow: /, we honor that opt-out and do not scan.

KI-Console-Bot details and robots.txt opt-out

14. Privacy contact

Privacy requests can be sent to Alpasana GmbH, Farbweg 18, 5745 Safenwil, Switzerland, or by email to website@ki-console.com and info@alpasana.ch.

API access logging

When you use our API (e.g. the Optimizer endpoint), we log each request with timestamp, the website concerned, the endpoint called, HTTP status, IP address and a shortened client identifier (user agent). These logs serve security, abuse detection and troubleshooting (legitimate interest). They are visible only internally to administrators, contain no API keys in clear text, and are deleted automatically after 365 days.