Privacy policy

1 Controller

oerli GmbH, Maiwaldstraße 9, 77855 Achern, Germany, represented by the managing director Till Jedamczik. Email: till@oerli.ai, phone: +49 176 444 425 54. We have not appointed a data protection officer because the statutory requirements for doing so are not met.

2 Hosting and server logs

Both services run on a server that oerli GmbH rents from a data centre operator. When you open a page or use a tool, the web server in front of the application processes technically necessary connection data: IP address, time, requested address, status code, transferred data volume, the browser identifier (user agent) and, where sent, the referring page. Access logs containing IP addresses are deleted after seven days at the latest. The application itself keeps no access log; technical error messages may contain the address that was being processed. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest being secure and stable operation.

3 Cookies, local storage and analytics

We set no cookies and embed no analytics, advertising or social media services. Fonts and illustrations are served from our own server, so opening a page does not connect your browser to Google Fonts or any other font provider. That is why there is no consent banner.

Two things are kept only in your own browser and never sent to us: if you enter the ID of the Chrome extension on the browser crawl page, it is remembered under the key oerli-ext-idin local storage, and a browser crawl keeps its progress in your browser's IndexedDB (oerli-crawl). Both serve only the function you asked for (Section 25(2) no. 2 TDDDG); you can delete them at any time by clearing this site's data in your browser.

4 The crawler on bot.oerli.ai

When you start a crawl, we store the address you entered and the crawl settings. Our server then fetches publicly accessible pages of that website as OerliBot/1.0 (+https://bot.oerli.ai/)and follows the rules in the site's robots.txt. For every page we store in a database on our server: the address, HTTP status, redirects, content type, size and loading time, title, meta description, headings, canonical and robots tags, links, Open Graph and Twitter fields, language, structured data and recognised technologies. We also keep a copy of the HTML as a snapshot (viewable under /snapshot/…) and, where requested, screenshots.

We do not record who started a crawl: no IP address, name or account is stored with it. In return, crawl results are not private. Anyone who has the link can open a crawl, its report and its snapshots, and recently started crawls are listed on the start page and suggested to all visitors. Please do not enter addresses that contain personal data, access tokens or other secrets.

Crawled pages can contain personal data that their operators have published, such as names and contact details in a legal notice. We process them only as part of the page analysis. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest, and that of the person who starts a crawl, is the technical and SEO analysis of publicly accessible websites. Website operators can exclude the crawler with User-agent: OerliBot and Disallow: / in their robots.txt.

Raw crawl results, screenshots and full HTML snapshots are deleted automatically 90 days after the crawl; temporary copies made for previews and screenshots are deleted after 10 minutes. After that we keep only a permanent, heavily compressed archive record for each page and time of retrieval (viewable under /archive): the address, time, HTTP status and redirect target, title, meta description, canonical and robots tags, headings (H1–H3), the visible main text, outgoing links, hreflang, the types of structured data, the word count and a checksum of the content. Like a web archive, this lets anyone see how a public page changed over time; the legal basis is again Art. 6(1)(f) GDPR. Pages that ask not to be archived with noarchive in a robots meta tag or the X-Robots-Tag header are neither archived nor stored as a snapshot; for them we keep only the address, time and HTTP status. If you want everything we hold about a website removed, including the archive, or object to the processing, write to till@oerli.ai. We will delete the data for that host and exclude it from future archiving and snapshots.

5 Browser crawl and Chrome extension

In a browser crawl the requests run from your computer through the «oerli Crawl Bridge» extension, not from our server, so the crawled website sees your IP address. The extension only accepts messages from oerli.ai pages (and local development addresses) and asks for access to websites when you start a crawl. It keeps its crawl history and statistics in the extension's local storage on your computer. The results (page data and HTML snapshots, as described in section 4) are uploaded to our server so that you can share, report on and reopen them; they are then stored and visible in the same way as a server crawl. The legal basis is Art. 6(1)(b) and (f) GDPR.

6 Previews and screenshots

For page previews our server opens the address in a browser without a screen and stores the screenshot or the fetched HTML as a cache file on our server, which is reused for ten minutes. When you view previews, snapshots, Open Graph images or icons of an analysed website, your browser may load images and stylesheets directly from that website, whose operator then receives your IP address. Snapshots are shown in a sandbox without scripts.

7 Tools on tools.oerli.ai

Most tools (converters, encoders, generators, calculators, formatters and the like) work entirely in your browser. What you type or paste into them is not transmitted to us and not stored.

The network tools need our server: DNS lookup, WHOIS and domain info, HTTP headers, redirect checker, meta tag and Open Graph checker, robots.txt tester, sitemap viewer and API tester. For these, the domain or address you enter is sent to our server, which makes the request as OerliBot, returns the result and does not store it. In the API tester, the method, headers and body you enter also pass through our server, so do not use real credentials there. The legal basis is Art. 6(1)(b) and (f) GDPR. The same applies to requests to our programming interface under /api/v1; an API key sent with a request only determines the limits and is not stored.

8 Generated content and tools with their own data sources

No tool on tools.oerli.ai connects your browser to another provider. QR codes, avatars, placeholder images and badges are created in your browser or on our server. The QR code and badge images under /api/v1/qr and /api/v1/badge are generated from the parameters in the address and not stored. Two tools work with data that does not come from you:

• IP address lookup · local database by DB-IPWhen you open the tool, your browser asks our server for your own IP address and our server reads it from the connection. Any other address is looked up only when you click Lookup. Location and network owner come from a copy of the free DB-IP Lite databases (IP Geolocation by DB-IP, CC BY 4.0) on our server; no external service is asked and the addresses are not stored.
• GitHub repo stats · GitHub (api.github.com), via our serverOur server, not your browser, asks the public GitHub API for the repository you enter. GitHub receives only the repository name and our server's address, not your IP address or browser details. The answer is kept in our server's memory for up to ten minutes, without any reference to you, so repeated requests do not reach GitHub again.

The legal basis is Art. 6(1)(b) and (f) GDPR, our legitimate interest being to offer the function you open without passing your data on to third parties.

9 Contacting us

If you write to us or call us, we process the details you give us in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Art. 6(1)(f). We delete the enquiry once it has been dealt with and no retention obligation applies.

10 Recipients

We do not sell or pass on personal data. Data is disclosed only where we are legally obliged to do so.

11 Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). An email to till@oerli.ai is enough. You may also lodge a complaint with a supervisory authority; the authority responsible for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg).

12 Changes

When the services or the law change, we update this policy. The version published here applies.