Skip to content
KWS EverywhereKWS Everywhere
Legal & Compliance

Privacy Policy

This policy explains what KWS Everywhere collects, how authentication tokens and search queries are processed, and how your privacy is protected.

Last updated 16 August 2026

Who we are

KWS Everywhere operates the KWS Everywhere SaaS platform, web dashboard tools, and the official Google Chrome Extension. For data protection and GDPR purposes, we are the data controller of your account information.

What we collect

Account & Authentication Data

  • Your name and verified email address upon registration.
  • A securely hashed password (bcrypt) and 2FA secrets if enabled.
  • A unique, private 32-character authentication token bound to your user record.
  • Pass records, expiration dates, and Stripe transaction references. We never store raw credit card numbers.

Extension & Google search data

The KWS Everywhere Chrome Extension operates strictly on Google Search Engine Result Pages (SERPs) when you submit a search query.

  • The search query keyword is sent securely to our API to fetch search volume, CPC, and competition metrics.
  • The domain names appearing in search results are analyzed to return live Ahrefs DR and Moz DA badges.
  • The extension never tracks your browsing history across other websites, logs visited URLs outside Google, or sells user telemetry.

Incognito & 24h temporary caching

Every dashboard tool offers a "Save to search history" toggle switch (enabled by default).

When toggled off, your queries and research results are never written to permanent database tables. Instead, ownership is cached in temporary in-memory Redis keys for 24 hours so you can inspect your active results, after which the data expires automatically.

Security & DPoP request signing

Chrome extension requests are secured with Demonstrating Proof-of-Possession (DPoP) cryptographic signing. The background service worker generates a non-extractable ECDSA P-256 keypair in your browser's IndexedDB and signs each request with a compact JWS in the X-KWS-DPoP header, ensuring unauthorized parties cannot impersonate your token.

Third-party processing

We partner with trusted enterprise service providers solely to deliver platform functionality:

  • Stripe — for PCI-compliant payment processing and one-time pass checkout.
  • Google Ads API — for official historical search volume and commercial bid metrics.
  • Ahrefs API — for live Domain Rating (DR) authority scores.
  • Cloudflare — for DDoS mitigation, SSL encryption, and CDN caching.

Your rights & data deletion

You have the complete right to export your search history, modify your profile, or permanently delete your account and all associated query logs directly from your user dashboard under Settings > Delete Account.

Contact

For privacy inquiries, GDPR data requests, or compliance questions, email us directly at [email protected].