QotlerYour data, handled carefully.
What Qotler can see, what it can do, and what it will never do without you. Below that: where your data lives, how it's protected, and how to report a problem.
Read-only Google access
Search Console and Analytics connect with read-only permissions. Qotler can see your data but can't change your Google settings.
Tokens encrypted at rest
Google connection tokens are encrypted in the database and never sent back to the browser.
Your workspace is isolated
Your data is scoped to your workspace, with access checks in the app and row-level security in the database.
Nothing ships without you
Every page change, pull request, post and reply waits for your approval. Coding can open pull requests but can't merge them.
Public pages only
Qotler reads your public website, never anything behind a login. Its reader refuses private and internal network addresses.
You control connections
Disconnect Google or any other integration at any time, and Qotler stops reading from it.
What we keep, and why.
What Qotler stores
- Your company documents in Mind, and their versions
- Search Console and Analytics numbers for your selected property
- Suggestions, your decisions and their results
- Before snapshots of changed pages, so results are fair
- Encrypted connection tokens
What it doesn't touch
- Pages behind a login or paywall
- Your Google settings or verification
- Your code's main branch, directly
- Your social accounts without your approval
Where your data lives.
A small number of well-known providers, each doing one job. Here's the path a request takes.
- You sign in. Supabase handles sign-in and issues a short-lived token (a JWT). Your password is never stored by Qotler in plain text.
- The app calls the API. The web app and API run on Amazon Web Services (EC2) in the ap-south-1 region, in Mumbai. The API verifies your token on every request and only accepts calls from Qotler's own web address.
- The API checks your workspace. Every read and write is scoped to the workspace you belong to, and Postgres row-level security enforces the same rule a second time in the database.
- Background work goes in a queue. Expert runs and daily result checks are queued in Redis, which holds short-lived job information and powers our rate limits.
- Workers do the work. They read your public pages, call Google's read-only APIs and send the needed context to AI providers, all within your workspace's daily spend cap.
- Results are stored. Mind, suggestions, decisions and results live in Supabase's Postgres database. Files you upload are kept in a private Amazon S3 bucket in the same Mumbai region.
The full list of providers, with what each one handles and where, is in our Privacy policy.
The controls in place.
Not a checklist for show. These are running in Qotler today.
Encrypted on the wire
Every connection to Qotler uses TLS, and HSTS tells browsers never to fall back to an unencrypted connection. Calls from our servers to Google, AI providers and other services use TLS too.
Encrypted in storage
The database and its backups are encrypted at rest by our database provider, and uploaded files are encrypted at rest in S3. Google refresh tokens get an extra layer: they're encrypted at the column level with pgcrypto, and never leave the server.
Two locks, not one
Your sign-in token is checked on every API request, then your workspace membership is checked in the API and again by row-level security in Postgres. A bug in one layer doesn't open your data to another workspace.
Keys stay on the server
Privileged database keys and provider API keys live only on our servers. The browser gets your own session token and nothing more. The API refuses requests from any web origin other than Qotler's.
Rate limits on every AI call
Every endpoint that calls an AI model is rate limited, so a runaway script or a stolen session can't hammer the system or run up costs.
Least access
Production access is limited to the people who need it to run the service. We don't look at your workspace content unless you ask us to for support, or we must for security or legal reasons.
A hard stop on AI spend.
AI models cost money every time they run. A bug, a loop or a misuse could, in theory, run up a large bill in hours. We don't leave that to chance.
Every workspace has a hard daily cap on AI spend. When a workspace reaches it, work pauses automatically and we're alerted. Nothing keeps running in the background, and you're never charged extra for it. Work picks up again the next day.
Combined with rate limits on every AI-calling endpoint, the cap means a problem stays small: one workspace, one day, a known ceiling.
It reads your site, and only your site.
Any tool that fetches a URL you give it can be tricked into fetching something it shouldn't. Ours is built to refuse.
Security people call this risk server-side request forgery (SSRF): someone enters a URL that points not at a public website but at an internal address, hoping the server will fetch it and reveal something private. Qotler's reader has three defences:
- Private addresses are blocked. The reader refuses private and reserved IP ranges, such as 10.x.x.x, 192.168.x.x, 127.0.0.1 and cloud metadata addresses.
- It checks the address it actually connects to. The reader resolves the domain name first, then checks the resulting IP before connecting. That stops "DNS rebinding", where a domain looks public at one moment and points inside the network the next.
- Redirects are checked too. If a page redirects, the new destination goes through the same checks, and redirects into private ranges are refused.
It also only reads. It doesn't sign in, fill in forms or read anything behind a login or paywall.
What each connection can do.
In plain words, before you click "Allow".
Can see
Clicks, impressions, queries, pages and indexing status for the property you choose.
Can't do
Change settings, submit or remove sitemaps, add or remove users, or touch your verification.
Can see
Traffic, engagement and conversion reports for the property you choose.
Can't do
Edit the property, change events or conversions, add users, or see your billing.
Can see
Public Lighthouse and Core Web Vitals results for your public URLs.
Can't do
Anything in your accounts. It needs no access to them.
Can do
Open pull requests with proposed site fixes on the repositories you connect.
Can't do
Merge them. You review and merge, or close them.
Revoke Google access any time from Qotler or from your Google Account's third-party connections page. When you disconnect, we delete the stored token and the Google data from that connection. Our use of Google data follows the Google API Services User Data Policy, including its Limited Use requirements; see the Privacy policy.
What the models see.
Qotler's experts run on models from Anthropic, OpenAI and xAI. Which model handles which task is configurable. Each task sends only the context it needs: for example, the relevant parts of your Mind, the text of a page under review, or a summary of your Search Console numbers.
What we do
- Use providers' business APIs, whose terms say API inputs aren't used to train their models by default
- Send task context, not your whole workspace
- Keep provider keys on our servers only
What we don't
- Train our own models on your data
- Sell your data, or use it for ads
- Let AI output ship without your approval
Providers may keep API data for a limited time for abuse and safety monitoring, under their own terms. We'll list any new AI provider in our Privacy policy before it handles your data.
If something goes wrong.
How we'd handle a security incident, and how you'd hear about it.
Our notice will say what happened, what data was involved, what we've done about it, and what, if anything, you should do. If the incident involves a provider, we'll pass on what they tell us.
Found a vulnerability?
Email security@qotler.com. We aim to acknowledge reports within two working days.
Please include
- What you found and where: the URL, endpoint or feature.
- Steps to reproduce it, and what an attacker could do with it.
- Screenshots, requests or a short proof of concept if you have one.
- How you'd like to be credited, if at all.
Please don't
- Access, change or delete data that isn't yours. Use your own test account.
- Run denial-of-service tests, spam, or social-engineer our team or users.
- Share the issue publicly before we've had a reasonable time to fix it.
If you follow these rules and act in good faith, we won't pursue legal action against you, and we'll keep you updated as we fix it. We don't run a paid bug bounty yet.
Where we honestly stand.
No badges we haven't earned.
SOC 2 and ISO 27001
Qotler is not certified yet. Both are on the roadmap; we'll publish the reports when we've been audited.
Privacy law
Our Privacy policy covers the GDPR, UK GDPR and India's DPDP Act, including your rights and how to use them.
Google API policy
Our use of Google data follows the Google API Services User Data Policy, including Limited Use.
Need a security questionnaire answered or a data processing agreement for your company? Email privacy@qotler.com and we'll work through it with you.
Can Qotler change my website on its own?
No. Every change waits for your approval, and Coding can only open pull requests. It can't merge them.
Who can see my data?
People in your workspace. Workspaces are isolated from each other, by checks in the API and by row-level security in the database. Our team doesn't look at your content unless you ask for help or we must for security or legal reasons.
Can I revoke Google access?
Yes, any time, from Qotler or from your Google account. We delete the stored token and the Google data from that connection when you disconnect.
Is Qotler certified?
Not yet. SOC 2 and ISO 27001 are on the roadmap, and we'll publish the reports when we've been audited.
Do AI providers train on my data?
We use their business APIs, whose terms say API inputs aren't used to train their models by default. Qotler doesn't train its own models on your data either.
Where is my data stored?
The app runs on AWS in Mumbai (ap-south-1), uploads are in a private S3 bucket in the same region, and the database and sign-in run on Supabase. AI providers process task context to do the work. The full list is in the Privacy policy.
Can Qotler read pages behind my login?
No. It reads public pages only, and it never signs in to your site or fills in forms.
What stops a runaway AI bill?
A hard daily spend cap on every workspace. When it's reached, work pauses automatically until the next day, and you're never charged extra.
Do you sell my data?
No. We don't sell it, and we don't use it for advertising.
How do I delete my account and data?
Delete your account in the app or email privacy@qotler.com. We delete your data within 30 days, except what we must keep for legal, billing or security reasons.
How do I report a security issue?
Email security@qotler.com. See responsible disclosure above for what to include.
Privacy policy & terms
The detail behind this page, in full.
Privacy policy →
What we collect, why, who processes it, how long we keep it, and your rights. Includes our sub-processor list.
Terms of service →
The agreement for using Qotler: your content, approvals, acceptable use, billing and cancellation.
Questions? privacy@qotler.com for data, security@qotler.com for vulnerabilities, or contact us.
Be first to meet your marketing team.
Qotler opens on 1 December 2026. Leave your email and we'll tell you the moment it's live.
Launching in
Launching 1 December 2026. One email when we go live, nothing else.