Legal · Effective October 31, 2026
Data Processing & Security
For clients who need the detail: where data lives, who processes it, and how it's protected.
Roles
For account, billing and usage data Redline is the controller. For data in your connected Google accounts and your website, you are the controller and Redline processes it on your instructions to provide the service. This page, with the Privacy Policy, forms our data processing terms; a signed addendum is available on request for customers who need one.
Where data is stored
Application and database hosting in the United States (Vercel, Neon). Payments in Stripe (US). Email through Resend (US). AI and search checks are processed by the providers named in the Privacy Policy, which may be outside the US; only the minimum needed for the check is sent.
Sub-processors
Vercel, Inc. (hosting) · Neon, Inc. (database) · Stripe, Inc. (payments) · Resend (email) · Anthropic, OpenAI, Google, Perplexity (AI engines queried during audits) · SerpApi (search result retrieval) · Google LLC (Analytics and Search Console data you connect). We will post changes to this list here at least 14 days before a new sub-processor handles your data.
Security measures
TLS for all traffic; encryption at rest; application-level AES-256-GCM encryption of Google refresh tokens; hashed passwords and single-use sign-in links; role-based access for staff with activity logging; server-side request filtering so the crawler cannot reach private networks; dependency and secret scanning on the code; backups by the database provider with point-in-time recovery.
Access by Redline staff
Staff see your account through our internal system to deliver the service: to review audit results, act on approved recommendations, and support you. Access is logged. Staff do not sign in to your Google accounts; the connection is read-only and token-based.
Deletion and export
You can disconnect Google (revoking our access) at any time. On request we export your audits and recommendations as files, and delete your account within 30 days of a verified request, retaining only what billing and tax law require.
Incidents
If we confirm a security incident affecting your personal data, we will notify the account owner without undue delay and in any case within 72 hours of confirmation, with what we know and what we're doing.
Questions: redline@redline.design. Other documents: Privacy Policy · Terms of Service · Acceptable Use Policy · Refund & Cancellation Policy