Privacy policy.

In short

What this policy covers

This policy explains what personal data Opmerk processes, why, where it is stored and what you can ask us to do with it. It covers the public website at opmerk.com, the workspace at app.opmerk.io, the Opmerk Chrome extension and the MCP endpoint that coding agents use.

Opmerk is a tool for teams that review and improve websites. Most of the data in a project is about a website, not about a person. Where personal data appears, it is listed below.

The public website (opmerk.com)

opmerk.com consists of static pages served by Cloudflare. The site sets no cookies, uses no analytics service and embeds no third-party scripts, fonts or media from other domains. The only data that flows is the ordinary web request your browser makes, which Cloudflare handles as our hosting provider.

Your account

A workspace account is created by an administrator or by an invitation from a project. We store your name, e-mail address, a hash of your password, your language preference, your roles and the time of your last sign-in. Sessions last seven days in the workspace and thirty days in the extension; expired sessions are deleted.

The workspace uses a single cookie, the session cookie, which is strictly necessary to keep you signed in. There is no consent banner because there is nothing to consent to: no advertising, analytics or tracking cookies are set.

Notifications appear inside the workspace. Opmerk sends no newsletters and no marketing e-mail.

Project data

A project is a website your team connects. For that website Opmerk stores the domain, the pages it audits, the results of those audits, screenshots and the feedback your team pins to elements of the page: the page URL, the element selector and text, the viewport, the screenshot, comments, mentions, assignees and status. Tasks, comments and the project’s history are kept so the team can see what was decided and why.

While review mode is on, the position of each reviewer’s cursor and the page they are on are shared live with the other members of that project. Presence is for the review team and is not stored as visitor analytics; it is not visible to the website’s visitors.

Project members see project data according to their role. A System Admin of the workspace can see every project. Deleting a project removes its feedback, audits, screenshots and measurements.

The Chrome extension

The extension is active only on the websites that are connected to your projects and on pages where you start an audit yourself. On every other page it injects no code and reads nothing. It never reads your browsing history, bookmarks or passwords.

When you pin feedback or run a page check, the extension sends the page URL, the selected element, the visible text it needs for the check, your viewport size and the screenshot you capture to the workspace. Nothing is sent to anyone but Opmerk.

AI visibility measurements

AI visibility sends the questions you configure for a project to AI services and stores their answers, so you can see whether and how your brand is named. The services currently used are OpenAI, Anthropic, Google (Gemini), Perplexity and OpenRouter; brand mentions in the answers are analysed by TypeSafe (Jev); Google results and competitor advertisements are captured through Apify; backlink and keyword data for Agency projects comes from DataForSEO.

What these services receive is the question text, the brand name and the website address of the project, and the public web pages the measurement reads. Your account data, your team’s feedback and your Search Console or Bing data are never sent to them. Keep personal data out of the questions you configure.

Opmerk does not use your data to train AI models and does not permit the services it calls to do so where the service offers that choice.

Google Search Console

When a Project Admin connects Google Search Console, Opmerk asks Google for the read-only scope “View Search Console data for your verified sites” (webmasters.readonly) and nothing else. Opmerk stores the refresh token encrypted, lets you choose one property and imports that property’s clicks, impressions, queries, pages and index status once a day. It does not change anything in Search Console.

Opmerk’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Search Console data is shown to the members of the project it belongs to, is used only to provide the Search view and the actions derived from it, and is not transferred to anyone else, not used for advertising and not used to train models. A human reads it only with your permission, for support, or where the law requires it.

You can disconnect Search Console in the project settings at any time; the stored token is deleted immediately and the imported data is removed. You can also revoke Opmerk’s access from your Google account’s permissions page.

Bing Webmaster Tools and Chrome UX Report

A Project Admin can add a Bing Webmaster Tools API key. The key is stored encrypted and used once a week to import the project’s queries, pages and inbound link counts from Bing. Because Bing refuses requests from Cloudflare’s shared network, these requests are forwarded through a relay server that we operate; the relay passes the request to Bing and Bing’s answer back, and stores nothing.

Core Web Vitals come from Google’s Chrome UX Report, a public dataset aggregated across Chrome users. It contains no data about individual visitors.

GitHub and coding agents

Agency projects can install the Opmerk GitHub App. It reads issue and pull request metadata for the repositories you choose, creates issues from feedback when you ask it to, and moves feedback when the linked pull request merges. It has no access to your code.

A personal MCP token lets a coding agent of your choice read the feedback, tasks, pages and measurements your own role allows and record progress on them. The token grants nothing beyond your existing access and can be revoked on your account page.

Where data is stored and who processes it

Opmerk runs on Cloudflare: Workers for the application, D1 for the database and R2 for screenshots and files. Secrets such as API keys and OAuth tokens are encrypted before they are written to the database. All traffic uses TLS.

The services below process data on our behalf, each for the purpose named. We add a service here before it goes live.

How long data is kept

Account data is kept while the account exists. Project data is kept while the project exists and is removed when the project is deleted. Expired sessions are deleted automatically. The technical log of calls to AI services, which holds the request, the answer and the error if any, is kept for thirty days. Cloudflare’s request logs follow Cloudflare’s retention.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, ask us to restrict or stop processing it, and receive the data you gave us in a portable form. Write to the address below; we answer within one month. If you think we handle your data unlawfully, you can also complain to the data protection authority in your country.

Project members can delete their own feedback and comments in the workspace; a Project Admin can delete a project; a System Admin can delete an account.

Children

Opmerk is a business tool and is not directed at children. We do not knowingly process data of anyone under sixteen.

Changes to this policy

When the product starts processing data in a new way, this page changes before the feature goes live and the date at the top is updated. The changelog records the release.

Contact

Opmerk is operated by the company named at the top of this page. Questions and requests about your data go to the e-mail address there.