Privacy and Google data

Who operates TSEP Control?

Bertrand Morel — entrepreneur individuel (EI), Edikka.
94 boulevard Barbès, 75018 Paris, France.
SIREN 478 522 691.

App and data contact: agence@edikka.com. Publisher legal notice.

What data is used?

Google identity

Your Google identifier and verified email address identify the connection and bind an inspection to the correct account. TSEP Control does not receive your Google password.

Search Console properties

The list of accessible properties and your permission level let you select the site. Connecting does not create a Search Console property or grant new access to a site.

URL inspection

After your request, the app stores the selected URL and property, the request, Google’s original response, HTTP status, timestamps and hashes. The response may include indexing status, last crawl, canonical URLs and other fields returned by Google.

Dossiers and reports

Your scopes, imported captures, observations, reviews and reports are stored to document and replay assessments. Only import data you are authorized to process.

Direct analysis and CrUX

When you analyse a public URL, TSEP reads its HTML and a bounded sample of robots.txt, sitemaps and linked pages on the same host and, when CrUX is configured, sends the URL to Google to retrieve mobile and desktop field measurements. If Google has no data for the page, TSEP requests measurements for its origin. No visitor Google account is required. The URL, HTML and received responses are retained in an observation private to your session, even without a project dossier.

TS44 and TS43 comparisons

When you launch a comparison, TSEP performs two anonymous navigations with and without JavaScript and HTTP tests using selected client strings. Public rendering resources may come from other hosts. Selected text, responses, screenshots and inventories are stored privately within your session and can be exported. An imported log excerpt is optional; its original and correlation are also retained and included in a separate export. These logs are not sent to Google.

Analysis queue

Your analysis request is saved in private storage and waits for its turn. It can run even if you close the tab. You can cancel before it starts; it expires after ten minutes without starting. Its state and result remain accessible to your session.

Treatment measurements

To improve the service, a private log records the treatment type, waiting time, duration, admission and outcome, PHP memory and measured storage. It contains no analysed URL, IP address, identifier, token or evidence content. It is capped at 512 KiB per day. On the first activity of a new day, files older than the last 14 days are removed; this cleanup does not run while the service is inactive. Demo navigation is not tracked by this measurement. Hosting logs are separate.

Connection and security

Google access and refresh tokens are encrypted on the server. A necessary session cookie enables access to your dossiers. An identifier derived from the IP address limits daily operations; the VPS request log stores no IP address, URL, query parameters or browser user agent. System security logs, including SSH, may contain the IP address of an administrative connection.

Why, and with whom?

Google data is used only for connection, property selection and the inspections, evidence and reports you request. No inspection is launched in the background. A token may be refreshed to perform an action requested in the app.

Google receives requests needed for authentication and, for an inspection, the selected property and URL. OVH hosts the app and its private storage. Authorized service administrators can technically access data for operation and support; any access to Google data must remain limited to uses permitted by Google’s policy.

Google data is not sold, used for advertising or sent to an AI service by the app. Dossiers and reports are not automatically published. If you download and share an export, you choose its recipients.

TSEP Control’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Retention and backups

Dossiers, analyses, assessments and their evidence have no automatic expiry. An explicitly requested deletion also removes linked evidence. You can download your reports and evidence to keep an independent copy. Retention depends on continued service operation; any change to this policy will be announced before it takes effect.

To delete a dossier, contact the publisher. Once acknowledged, deletion remains effective after a backup restoration. Hourly maintenance applies these requests; it does not delete dossiers based on age.

Encrypted backup copies rotate over 35 days on the VPS and in private OVHcloud storage independent of the Mac. In OVHcloud, noncurrent versions are removed after one additional day, subject to object protection and provider processing time. Recovery copies may also be kept on the publisher’s private Mac; cleanup runs while it is powered on. The restore workflow rejects archives that are 35 days old or older. Copies contain dossiers, session ownership and private configuration; new backups exclude Google connections and their session caches. They are used only for service recovery.

Deleted data may remain in a backup until it expires. A private deletion registry, separate from the archives, is reapplied before a restored service is made available. It contains only the technical identifiers, dates and reasons needed for this protection, without evidence content. Every restoration, including from an old archive, removes Google connections: Search Console requires a new connection. Retained dossiers and their owners remain unchanged. User-downloaded exports remain with their holders.

Google tokens are encrypted separately on the server. They remain stored until confirmed in-app revocation or operator deletion. Removing access at Google prevents their use at Google; it does not automatically delete evidence held by TSEP. Records and their evidence are not automatically deleted based on age. Active evidence and reports do not have individual application-level encryption. Access uses your browser session; an optional personal key can restore your workspace in another browser. Only its hash is stored. Its expiry does not delete dossiers, and it does not restore the Google connection.

Purposes and legal bases

Providing the analyses, dossiers, imports and exports you request relies on performing the service described in the terms of use. Optional Google access relies on your consent to access account data; you can withdraw it at any time for future access. Evidence already requested follows the retention periods above. Service protection and abuse prevention rely on Edikka’s legitimate interest in operating and securing the service.

Information comes from your input and imports, public pages retrieved at your request and Google responses. A URL or evidence is necessary for the relevant workflow; declining Google leaves other workflows available. The app does not make decisions producing legal effects on an individual.

Exchanges with Google are also governed by its terms and privacy policy. Google processing may involve infrastructure outside the European Union; the app does not guarantee that those exchanges remain exclusively within Europe. Google privacy policy.

Technical logs

The request log contains only the timestamp, HTTP status, duration and transferred sizes. Daily rotation keeps at most 13 archives and the current file, approximately 14 days. It does not record URLs, Google sign-in codes, headers, IP addresses or form contents. Raw request-error details are disabled.

PHP service logs use the same rotation. System security and administration events have a configured retention of 35 days and a storage cap. They are not used to measure the audience. Log rules are separate from dossier and backup rules.

Withdraw access or request deletion

1. On TSEP Control’s Google page, “Révoquer l’accès Google” requests revocation from Google and then deletes the local token if Google confirms. Dossiers and reports remain stored.
2. You can also remove TSEP from your Google account connections.
3. To request access to or deletion of your data, write to agence@edikka.com with “TSEP Control”, the relevant account address and available dossier identifiers. Your right to the data must be verified. Never send your password, a login code or a token.

Early deletion requests are handled manually; a complete deletion button is not yet available. Copies you exported or shared remain under your control or that of the recipient.

Exercise your rights

You may request access, rectification, deletion or restriction of your data and, depending on the processing, portability or object to its use. Contact agence@edikka.com. We verify your right to the data without requesting your password. We normally respond within one month; if an extension is necessary under the applicable conditions, we inform you and explain why.

You may lodge a complaint with the CNIL.

Support exchanges are limited to information necessary to handle the request. Verification documents are deleted after verification; minimal administrative tracking is kept for 12 months after closure, unless a documented legal retention requirement or dispute applies.