Privacy Policy

Last updated: 8 August 2026 · SUDO Technology LTD

KeywordScope is a desktop application that keeps your data on your own computer. This policy explains the small number of cases where personal data reaches us, what we do with it, and the rights you have over it under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Bulgarian Personal Data Protection Act.

1. Who is responsible for your data

The controller of the personal data described here is:

We are not required to appoint a Data Protection Officer, because we do not carry out large-scale processing of personal data or large-scale monitoring. Privacy enquiries go to the address above and are answered by the company directly.

2. What never leaves your Mac

Everything you create in the application. Your tracked apps, keywords, rank history, notes, tags, metadata drafts, ratings snapshots and release annotations live in a single database file in your Application Support folder. That file is never uploaded, synchronised or transmitted to us. We hold no copy of it and have no technical means of obtaining one.

A consequence worth being explicit about: if you delete the application and its data folder, that information is gone. We cannot restore it, because we never had it. The application includes a backup feature for exactly this reason.

3. What we process, why, and on what legal basis

Where this data comes from. You give us the support correspondence directly, and the website logs arise from your own visit. The subscription data in the first row reaches us from Paddle rather than from you — that is the source, for the purposes of Article 14(2)(f), and the categories are the ones named in that row. The licence key and device identifier in the second row are generated by us and by your Mac.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. In each case above the processing is limited, expected, and could not reasonably be achieved another way. You may object at any time — see section 8.

Providing the data in the first two rows is necessary to enter into a subscription with us. Without it we cannot supply the paid tier. It is not required to use the free tier, which needs no account at all.

4. What leaves your Mac, and where it goes

Requests to Apple

To fetch rankings and ratings, the application makes requests directly from your computer to Apple's public App Store endpoints. Those requests carry your IP address and go to Apple, not to us. We do not proxy, log or observe them, and we are not a controller in respect of them.

If you choose to connect an Apple Search Ads account for search popularity data, the application authenticates to Apple's Ads API using credentials you supply. Those credentials are stored in your macOS Keychain and are sent only to Apple. We never receive them.

Update checks

The application checks our server for a new version. That request carries your IP address, the application version and your macOS version, and nothing else — there is no system profiling, and no report of what you have tracked or done in the app. It happens on the free tier too, because everyone gets security fixes.

Licence verification

If you subscribe, the application periodically contacts our licensing service to check that your subscription is still active. That request carries your licence key and an identifier for the Mac it is activated on. It does not carry your keywords, your tracked apps, your rankings or any other content.

Payments

Payments are processed by Paddle.com Market Limited, which acts as merchant of record and is an independent controller of the billing data it collects. Paddle collects the information required to take your payment and meet tax obligations. We receive from Paddle only what we need to provide and support your subscription. We never receive or store your card details.

Paddle's own privacy policy governs their handling of your data: paddle.com/legal/privacy.

5. Who else sees your data

We do not sell, rent or share personal data with third parties for their own purposes. The only recipients are the service providers we need in order to operate, acting as processors on our instructions or, in Paddle's case, as an independent controller:

• Paddle — payment processing and merchant of record
• Google Ireland Limited — website analytics, as our processor, and only for visitors who accept the cookie banner
• Our hosting and email providers — serving this website and carrying support correspondence

We may also disclose data where we are legally obliged to, for example in response to a valid order from a competent authority.

6. Transfers outside the EEA

Some of our providers are established outside the European Economic Area, or use infrastructure that is. Where personal data is transferred outside the EEA, that transfer is made under a legal mechanism recognised by Chapter V of the GDPR — in practice an adequacy decision of the European Commission where one covers the country concerned, and otherwise the Commission's Standard Contractual Clauses together with any supplementary measures required.

Concretely: our analytics contract is with Google Ireland Limited in the EU, but Google may process the data in the United States. That transfer relies on the EU–US Data Privacy Framework, to which Google is certified, with the Standard Contractual Clauses as a fallback. If you would rather not have data leave the EEA for this purpose, decline the cookie banner — the analytics never run and no transfer occurs. You may request a copy of the relevant safeguards from the address in section 1.

7. What we deliberately do not do

• No analytics, telemetry or automatic crash reporting in the application. The desktop app reports nothing about what you do in it, on any tier.
• No advertising or remarketing cookies on this website, and no analytics at all unless you accept the banner. See section 9.
• No profiling and no automated decision-making producing legal or similarly significant effects, within the meaning of Article 22.
• No use of your data to train anything, and no sale of it in any form.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy of it (Art. 15).
• Rectify data that is inaccurate or incomplete (Art. 16).
• Erase your data where one of the grounds in Article 17 applies — noting that we must keep billing records for as long as tax law requires.
• Restrict processing in the circumstances set out in Article 18.
• Portability — receive, in a structured, commonly used, machine-readable format, the data we process on the basis of contract or consent by automated means, and have it transmitted to another controller where technically feasible (Art. 20). In practice that is your subscription record; correspondence and logs rest on legitimate interests and fall outside this right, though you can still request a copy under Article 15.
• Object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21). We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent at any time, where processing is based on consent — though as the table in section 3 shows, we do not currently rely on consent for anything.

Write to privacy@keywordscope.app. We will respond within one month, as Article 12(3) requires, and will tell you if we need to extend that period. Exercising these rights is free; we will only charge where a request is manifestly unfounded or excessive, and we will say so first.

For billing records held by Paddle as merchant of record, we will either direct you to Paddle or forward your request to them, whichever gets you an answer faster.

9. Cookies

This website uses Google Analytics, which sets cookies. Because those cookies are not strictly necessary, the ePrivacy Directive and its Bulgarian implementation require your active agreement first — so nothing loads until you accept the banner. Declining changes nothing about how the site works.

The cookies concerned are Google's _ga and _ga_<id>, which distinguish one visitor from another and expire after two years. We run Google Analytics with IP anonymisation on, advertising and remarketing features off, and data retention set to 14 months — Google's shortest option.

One further item is stored on your device whatever you choose: a single entry recording your answer, so we do not ask again on every page. That is exempt from consent as strictly necessary — remembering that you said no is not tracking you.

To change your mind at any time, use the cookie settings link in the footer of every page. Choosing Reject also deletes the analytics cookies already set. Withdrawing is as easy as giving consent, and does not affect the lawfulness of what happened before you withdrew.

We use no advertising cookies, no remarketing, no social media pixels and no third-party fonts. The application itself sends us no analytics at all — this section is about the website only.

10. Complaints

If you think we have handled your personal data wrongly, please tell us first — most things are fixable quickly. You also have the right to lodge a complaint with a supervisory authority under Article 77, either in the EU country where you live or work, or with the competent supervisory authority in Bulgaria, where we are established:

11. Security

We keep the amount of personal data we hold deliberately small, which is the most effective security measure available to a company our size. What we do hold is protected by access controls and encryption in transit. Apple Search Ads credentials are stored in the macOS Keychain on your own machine rather than by us. No system is perfectly secure, and we will notify you and the supervisory authority as Articles 33 and 34 require if a breach ever affects you.

12. Children

KeywordScope is a professional tool and is not directed at children. We do not knowingly collect personal data from anyone under 16, and we will delete it if we discover we have.

13. Changes

If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle your personal data, we will email subscribers before it takes effect.

14. Contact