Privacy policy

Last updated 24 October 2026

This policy says what Spec21 Labs collects through spec21.co and Spec21 Reach (app.spec21.co), why, and who else sees it. Spec21 Labs is Spec21 Labs, the trading name of its founder, an individual based in India, who is responsible for your data. Write to [email protected] for anything below.

What we collect

• Your account: email, password (stored only as a one-way hash), your name and business name if you give them, and your website.
• Your sites: what our audits read from the public pages of the sites you add.
• Search data: the Google Search Console data for properties you share with our service account (queries, pages, clicks, impressions, positions).
• Your work in the console: messages to the agent, drafts, tasks and settings.
• Billing: your plan and Paddle's customer and subscription ids. We never see or store card numbers; Paddle does.
• The free site check on app.spec21.co: the address checked and a one-way hash of the visitor's IP address, to limit abuse.
• Logs: basic server logs (time, address requested, errors) to keep the service running and safe.

Cookies

One cookie: the session cookie that keeps you logged in to the console. No advertising or tracking cookies, and no analytics scripts.

Who else processes it

• Cloudflare carries all traffic to spec21.co and app.spec21.co.
• Cheaper Inference runs the AI model: your messages, the project context and the drafting instructions are sent to it to write answers and drafts.
• Google provides the Search Console data you share.
• Zoho ZeptoMail sends account emails (confirmation, password reset).
• Paddle handles payments, tax and invoices as our reseller, under its own privacy policy.
• Telegram carries short notices to the Spec21 Labs team, such as a new account's name and email.

The service itself and its database run on hardware we operate in India. We do not sell your data or use it to train AI models.

Why, and on what basis

We use your data to provide the service you signed up for (the contract between us), to keep it secure and stop abuse (our legitimate interest), and to meet legal duties such as tax records (kept by Paddle for payments).

How long we keep it

Account data for as long as the account exists. When you ask us to delete your account, we delete it and its data within 30 days, apart from what the law makes us keep. Sent emails are removed from our outbox after 30 days; links in them stop working much sooner.

Your rights

You can ask for a copy of your data, for corrections, or for deletion, and you can object to how we use it, by writing to [email protected]. We answer within 30 days. You can also complain to your local data protection authority.

Changes

If we change this policy in a way that matters, we will email account holders before it applies.

Terms Privacy Refunds [email protected]