AEO Score

Privacy Notice

Last updated: June 2026

1. Who we are

AEO Score is operated by HEKN LLC ("HEKN", "we", "us"). HEKN LLC is the data controller responsible for personal data processed through this site and the AEO Score service. You can contact us about privacy at the email address listed on our About page.

2. Data we collect and why

  • Diagnostic inputs (business name, URLs, region, language) — to generate your AEO report and allow you to return to it via a permalink. Legal basis: performance of a contract.
  • Account data (email, password hash, authentication identifiers) — to create and secure your account. Legal basis: performance of a contract.
  • Subscription and billing data (plan, status, period dates, customer and subscription identifiers) — to provision premium access. Payment card and tax details are collected and processed by Paddle, not by us. Legal basis: performance of a contract and legal obligation.
  • Usage and device data (IP address, browser, pages visited, request logs) — to operate the service, prevent abuse, and improve the product. Legal basis: legitimate interests.
  • Communications (emails you send us, marketing preferences) — to respond to you and send occasional product updates you can unsubscribe from at any time. Legal basis: legitimate interests and consent.
  • Publicly available content fetched from URLs you submit — to evaluate them. We do not access private accounts.

3. Who we share data with

We share personal data with the following categories of recipients:

  • Paddle.com Market Limited ("Paddle") — our Merchant of Record and payment processor. When you purchase a subscription, Paddle collects and processes your payment details, billing address, and tax information, issues invoices, and handles refunds and chargebacks. See Paddle's privacy notice.
  • Infrastructure and hosting providers (cloud hosting, database, authentication, email delivery, error monitoring) acting as our processors under contract.
  • AI model providers used to generate diagnostic content from the inputs you submit.
  • Professional advisers (legal, accounting) where necessary.
  • Authorities where required by law.

We do not sell your personal data.

4. International transfers

We and our processors may transfer personal data outside your country, including to the United States. Where required, transfers are protected by Standard Contractual Clauses or equivalent safeguards.

5. Retention

We keep diagnostic reports for as long as your account is active, and for up to 24 months after last activity to enable permalink access. Account and subscription records are kept for the life of the account and for up to 7 years afterwards to meet tax, accounting, and legal obligations. Request logs are typically retained for up to 90 days. We delete or anonymise data when it is no longer needed.

6. Your rights

Subject to your local law, you have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. You can also lodge a complaint with your local data protection authority. To exercise these rights, contact us via the email on the About page. We will respond within one month.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, role-based access controls, and audit logging, to protect personal data. No method of transmission or storage is fully secure.

8. Cookies

We use essential cookies and local storage to keep you signed in and remember your preferences. Paddle may set cookies during checkout to operate the payment flow. You can clear or block cookies via your browser settings; some features will not work without essential cookies.

9. Changes

We may update this notice from time to time. Material changes will be announced in the product or by email.