Privacy

Last updated: 31 July 2026

1. Who We Are

NitroShock is a search and AI visibility platform operated by DevWave Software Inc. ("we", "us"). DevWave Software Inc. is the data controller for the personal data described in this policy, and acts as your data processor for the search data you connect or enter into the platform.

If you are an agency using NitroShock on behalf of your own clients, you remain the controller of your clients' data and we act as your processor. This policy is written so you can show it to those clients.

Contact: info@nitroshock.ai. Registered address: [registered address].

2. What This Policy Covers

This policy covers the NitroShock website at nitroshock.ai, the NitroShock application, and the WordPress plugins we publish. It explains what we collect, why, who else sees it, how long we keep it, and what you can do about it.

Where a section applies only to a specific feature, it says so.

3. Data We Collect

Account data

Your email address, and your name if you provide it. Optionally a company name, country, tax identifier and phone number if you enter them for invoicing. We do not require any of those optional fields to use the product.

Billing data

Subscription and credit purchases are handled by Stripe. Card details are entered directly into Stripe's payment form and are never transmitted through or stored on our servers. We store the Stripe customer and subscription identifiers, the plan, and the amount, so we can show you your billing history.

Project data you enter

The domains, keywords, competitors, locations and content you add to a project, plus anything you generate with the writing tools.

Connected Google data

If you connect Google Search Console, the data described in section 4. This connection is entirely optional and the rest of the platform works without it.

Technical data

Your IP address, browser type and version, and pages visited, recorded in server logs and for security controls such as rate limiting. If you use the contact form we store your name, email, message, IP address and browser string so we can reply and to limit abuse.

What we do not collect

We do not run advertising trackers, analytics pixels or session recording on this website. There is no Google Analytics, no Meta pixel and no advertising network on nitroshock.ai.

4. Google Search Console Data

Connecting Google Search Console is optional, is requested with read only permission, and can be disconnected at any time.

What we request

We request a single Google permission for this feature, webmasters.readonly, which allows us to read Search Console data and does not allow us to change anything in your Google account. The consent screen also confirms your email address so the platform can show you which Google account is connected. We do not request permission to write, and adding a write permission would be a deliberate change to our product, not a silent one.

What we retrieve

Aggregate search performance for the property you select: search queries, landing page URLs, clicks, impressions, average position, and totals by device and country, for up to the previous 16 months. This is the same data Google shows you in the Search Console interface.

What we do with it

We calculate an expected click through rate curve for your own site, compare periods to separate a change in demand from a change in ranking from a change in the search results page itself, and raise the findings in your Intelligence tab and reports. This processing happens on our own servers.

Limited use

NitroShock's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How the connection is secured

The long lived token that lets us refresh access is encrypted with AES-256-GCM before it is stored. The decryption key is held only in our edge worker environment and never in the application database, so a copy of the database alone cannot be used to reach your Google account.

Your controls

On the connection card in your project settings you can choose how long we retain the underlying data (16 months, 36 months, or indefinitely), whether disconnecting also deletes the history, and whether we store search query text in full, as an irreversible hash, or not at all. Choosing the hashed option keeps all of the analysis working while storing no readable search terms. You can disconnect at any time, which revokes our access at Google. You can also revoke access independently from your Google account permissions page.

5. How We Use Data and Our Legal Basis

• To provide the service, which is the performance of our contract with you. This covers running scans, generating reports, and storing your projects.
• To take payment, also contract performance.
• To keep the service secure and working, which is our legitimate interest. This covers rate limiting, abuse prevention, error logs and backups.
• To contact you about your account, contract performance, and for occasional product email where you have consented or where we have a legitimate interest you can object to at any time.

We do not sell personal data, and we do not share it with advertising networks.

6. Artificial Intelligence Processing

Several features send data to AI providers to generate a result: the content writing tools, the FAQ and brief generators, the AI visibility checks and the support chat.

What is sent is the input the feature needs, for example a keyword, a topic, your brand and domain, or a passage of text you asked us to rewrite. Your account credentials, payment data and Google Search Console data are not sent to AI providers.

The providers we use are listed on our subprocessors page. We do not permit our AI providers to use your content to train their models.

7. Who Else Sees Your Data

We use a small number of service providers to run NitroShock. Each is listed, with what it receives and where it operates, on our subprocessors page. We keep that page current so an agency or a compliance team can see the full list without having to ask.

We may also disclose data where we are legally required to, or to establish or defend a legal claim.

8. Where Your Data Is Held

Our application servers and database are hosted with OVH in Canada. Our edge layer runs on Cloudflare's global network, which means requests are processed at the location nearest to the person making them. Some of our providers, including our AI providers and Stripe, operate in the United States.

Where personal data of people in the United Kingdom or European Economic Area is transferred outside that area, we rely on the appropriate safeguards available to us, including the European Commission's standard contractual clauses where our provider offers them, and Canada's partial adequacy decision for the servers we control.

9. How Long We Keep It

• Account and billing records: for as long as your account is open, and afterwards for as long as tax and accounting law requires us to keep the transaction record.
• Search Console data: for the retention window you choose per project, which defaults to 36 months. Older records are removed automatically by a scheduled job.
• Project data, reports and generated content: until you delete it or close your account.
• Contact form messages and security logs: no longer than we need them to answer you or to investigate abuse.

Deleting a project deletes the search data behind it. Closing your account removes your projects and their data.

10. Security

Access to the platform is over HTTPS. Credentials for third party services are held in our edge environment rather than in application code. Third party access tokens are encrypted at rest with a key stored separately from the database. Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the relevant regulator within the time the law requires.

11. Your Rights

Depending on where you live, you have some or all of the following rights: to access the data we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we relied on consent.

Two of these are built into the product so you do not have to wait for us:

• Export. You can download a project's full search data as CSV or JSON from the project at any time.
• Erasure. Disconnecting an integration with the delete option enabled, or deleting a project, permanently removes the underlying records rather than hiding them.

For anything else, email info@nitroshock.ai and we will respond within 30 days. If you are in the United Kingdom or European Economic Area and you are not satisfied with our response, you may complain to your local supervisory authority. If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada.

12. Cookies

We use cookies that are necessary to sign you in and keep your session working. See our cookie policy for the detail. You can set your browser to refuse cookies, but the application will not be able to sign you in if you block the necessary ones.

13. Children

NitroShock is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to This Policy

If we change this policy we will update the date at the top. Where a change materially affects how we handle your data, we will tell you by email or in the application before it takes effect.