Privacy policy
SemDev Reporting · Last updated 5 November 2026
Who operates this application
SemDev Reporting is an internal application operated by SemDev Digital Ltd (“SemDev”, “we”, “us”). This policy covers the reporting application, separately from our public website. The application is used by authorised SemDev personnel to review the performance of websites we manage and prepare reports.
Information we process
- Client records: business and contact names, website URLs, report email addresses, launch dates, reporting preferences, Umami website IDs, and Search Console property identifiers entered by SemDev.
- Google Search Console data: clicks, impressions, click-through rates, average positions, search queries, and page performance for properties available to the connected Google account. Search queries and page URLs may contain personal information.
- Website analytics: aggregate visitors, page views, pages, referral sources, and tracked enquiry actions retrieved from SemDev’s self-hosted Umami installation.
- Operational records: report periods, generation and delivery times, recipient addresses, delivery status, error messages, and service logs. Hosting and email providers also process technical request and delivery information.
- Authentication: server-side access credentials and a signed session cookie used to keep an authorised administrator signed in.
Why we use this information
We use this information to administer client reporting, generate and preview performance summaries, compare reporting periods, deliver reports, investigate failures, and secure the application. We rely on our legitimate interests in managing website services and operating a secure internal reporting system, where those interests are not overridden by individuals’ rights. Where processing is necessary to perform a contract with an individual, we may rely on that contract.
Google access and permitted use
The application requests the Google Search Console read-only permission. It does not change Search Console settings or website content. Access is limited to properties the authorised Google account can access.
We use Google data only to provide the reporting functions described here. We do not sell it, use it for advertising, or use it to train general-purpose AI models. SemDev Reporting’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable.
Storage and service providers
The application runs on Vercel and stores client records and report delivery records in its configured PostgreSQL database. Analytics are fetched when a report is generated; the application does not currently save the full analytics response or rendered report body in its reporting database. Google OAuth credentials and other integration credentials are kept in server-side environment configuration.
Google supplies Search Console data, SemDev’s self-hosted Umami installation supplies website analytics, and Resend processes report content and recipient details to deliver email. Sent reports may remain in mailboxes and email-provider systems. Operational logs and backups may also contain records described in this policy.
Access is intended for authorised SemDev personnel and service providers needed to operate the system. We may also disclose information where legally required. Providers may process information outside the UK; locations and retention depend on the services and account configuration in use. Contact SemDev for details of the arrangements relevant to your information.
Report recipients
Email delivery is currently restricted to a designated SemDev test inbox, even if a client record contains a different report address. If direct client delivery is enabled later, reports will be sent to the recipients authorised by SemDev for that client and this policy will be updated accordingly.
Retention and deletion
The application currently has no automatic retention or deletion schedule. Client details and reporting history remain until SemDev removes them. We retain records for reporting, service administration, and troubleshooting, and review requests for deletion manually. Information that is no longer needed should be removed, subject to legal obligations and necessary record keeping.
Deleting a record from the reporting database does not automatically delete source analytics, provider logs, backups, or copies of emailed reports. These must be handled separately under the relevant service’s retention arrangements.
Cookies and security
The reporting application uses an essential administrator session cookie that lasts up to 30 days. It is cleared on sign-out. The application does not install advertising cookies or its own visitor analytics tracker on these pages. We restrict administrator access and keep integration credentials server-side. No system can guarantee absolute security.
Revoking access and your rights
The connected Google account holder can revoke the application’s access through Google Account connections. This stops future access under that authorisation but does not erase records or emails already created.
Depending on the circumstances, individuals may request access, correction, deletion, restriction, or portability of their personal information, or object to its processing. To make a request, contact SemDev using the contact details published on builtbysemdev.com and mention “SemDev Reporting privacy”. We may need to verify your identity. You can also raise a concern with the UK Information Commissioner’s Office.
Changes to this policy
We will update this page when the application’s data handling changes. The date above identifies the current version.