Privacy policy

Who we are

Space by RapidWombat is operated by OLKY PTY LTD, ABN 48 642 505 762, ACN 642 505 762, Calypso Place, Yowie Bay, NSW 2228, Australia. We are responsible for the personal information processed to provide Space. This policy covers Space accounts, SEO audits, AI-assisted recommendations, billing, Google connections and the RapidWombat SEO for Squarespace browser extension.

Questions, corrections and deletion requests: [email protected].

What we store about you

An account holds the minimum needed to sign you in and attribute your work:

• Your email address, and your name and avatar if your sign-in provider supplies them.
• Authentication material — a password hash, or the tokens issued by the provider you signed in with.
• Session records, including the IP address and browser user-agent a session was created from. These are how you stay signed in and how account misuse is investigated.
• The organisation you belong to and your role in it.
• Your support communications and billing-related information, including customer and subscription identifiers, plan, billing status, invoice references and payment history. Stripe processes payment details; Space does not store your full card number or security code.

What we store about your sites

When you connect a site, the extension sends what a page-level SEO check needs in order to produce a verdict. This can include unpublished content visible in an authorised editor or preview:

• The site’s host name, its Squarespace site and page identifiers, and page URLs.
• Page metadata read from the page: title, meta description, canonical URL, robots directives, headings and comparable on-page signals.
• A snapshot of the checked elements and the resulting findings, so a later scan can show what changed rather than starting from nothing.
• Which extension version and check manifest produced a result, so a wrong verdict can be traced to the code that emitted it.

Information from AI-assisted features

When you request generated recommendations, we process the relevant page text, prompts, generated outputs and workflow information to provide the feature, troubleshoot problems and prevent abuse. Submit only content you are authorised to share. Review generated output before publishing it. Google reporting data is excluded from this processing.

Cookies and usage information

We use cookies and similar technologies for authentication, security and preferences. Technical and usage information can include IP address, browser and device details, pages visited, timestamps, referral information and interactions with the service. We use this information to operate, secure and improve Space. Where optional analytics or other non-essential tracking is used, we obtain consent where required. You can manage cookies in your browser; disabling necessary cookies may prevent sign-in or other features from working.

Purposes and legal grounds

We process information to provide the service you request, authenticate accounts, process subscriptions and payments, respond to support requests, improve features, prevent fraud and abuse, enforce our terms and comply with legal obligations. Where applicable data protection law requires a legal basis, we rely on performance of our contract, legitimate interests in operating and securing the service, legal obligations, or consent where required. You may withdraw consent without affecting processing that was lawful before withdrawal.

Storage, international transfers and security

Our service providers may process information outside your country, including in countries with different data protection laws. Where required, we use appropriate safeguards for international transfers. We use reasonable technical and organisational safeguards, including encryption of saved Google credentials and access controls. No electronic system is completely secure.

Business transfers and third-party services

Information may be transferred in a merger, acquisition, financing or sale involving RapidWombat or OLKY PTY LTD, subject to applicable law and the commitments in this policy. The Google API Limited Use restrictions below continue to apply to Google data. Third-party websites and services have their own privacy policies; this policy describes our processing, not their independent practices.

Google Business Profile connections

When you connect Google Business Profile, you choose a business managed by your Google account. We read the available business locations, reviews, reviewer names, ratings and already published replies to display them in Local SEO. Google requires the business.manage permission for this access; Space does not use it to edit your listing or publish replies.

Review content is loaded directly from Google when you view it and is not saved in the manual-import archive. We store encrypted connection credentials and your selected location identifier until you disconnect or delete your account. Business Profile data is not sent to AI providers, used for advertising, sold or used to train models. Google API Limited Use commitments also apply to this data.

You can disconnect Business Profile separately in Local SEO, or revoke Space access in your Google account connections. Disconnecting deletes the saved Business Profile credentials and selection. Files you import manually are separate records and are covered by the account-data retention rules in this policy.

Google Search Console and Google Analytics connections

When you choose to connect Google, we request read-only access to Search Console and Google Analytics. We use it to list resources you can access and display performance reports for the resources you select. We do not change your Google properties, tracking configuration or website through this connection.

We store encrypted access credentials, the permissions granted and your selected resource identifiers, linked to your Space account and site. Analytics reports are fetched on demand. Search Console query/page metrics are synchronized daily and saved as history for your account and site. Changing the Search Console property, reconnecting Google or disconnecting deletes this synchronized history; manually imported files remain separate. Google reporting data is not sent to AI providers or used to train AI models.

Disconnecting a site deletes its saved Google credentials, resource selection and synchronized search history. You can also revoke all Space access in your Google account connections. Deleting your Space account deletes its saved Google connections.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is not sold, used for advertising or shared with data brokers.

What the extension can and cannot reach

The extension runs on Squarespace editor and preview hosts, and on the RapidWombat site itself. Access to your own live domain is not granted at install time — the extension asks for it from a button you click, per domain, and Chrome records that grant. You can revoke it at any time from the extension’s permissions screen.

RapidWombat processes URLs and SEO data only for pages you choose to scan. It does not access your browser history or track browsing across unrelated websites. We save scan results and associated page URLs so you can review previous SEO checks. The extension has no access to your Squarespace password or billing details.

What we do with it

Data is used to run the checks you asked for, to show your results across sessions and devices, to keep the service working and secure — rate limiting and abuse investigation — and to reply when you contact us.

Where an external language model is used to draft a suggested fix, the page text needed for that suggestion is sent to that provider under contract and is not used to train their models.

What we never do

We do not sell or rent your personal information. We do not transfer it to third parties for advertising, and we do not use it to build advertising profiles.

Data obtained through the browser extension is used only to provide and improve the user-facing features described here — this is our Chrome Web Store Limited Use commitment, and it constrains humans too: no one reads your page data except to fix a fault you reported, to comply with law, or where the data has been aggregated so it identifies no one.

Who else touches it

The service runs on infrastructure we rent rather than own, and a small number of processors handle data on our behalf: our hosting and database provider, our transactional email provider, our product-analytics provider, and — when configured — the language-model provider described above. Each is bound by contract to process data only on our instructions.

We disclose data to anyone else only where the law requires it, and we will tell you unless we are legally prevented from doing so.

How long we keep it

Account data is kept while your account exists. Scan results and page snapshots are kept while the site they belong to is connected, so that changes over time remain visible.

On account deletion, we delete account and site data subject to legal, accounting, fraud-prevention and dispute retention requirements. Ask us at [email protected] and we will do it within 30 days. Backups age out on their own schedule and are not used to restore deleted accounts.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. If you are in the UK, the EEA or Switzerland you also have the right to object to processing, to ask for it to be restricted, and to complain to your data protection authority.

One address for all of it: [email protected]. We answer within 30 days.

Children

RapidWombat is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

If this policy changes in a way that affects what we do with data you have already given us, we will email you before the change takes effect. The date at the top is the last revision.