Privacy policy

1.Who we are

The extension and this website are made and run by SBMM (sbmm.com.pk), based in Pakistan. In this policy "SBMM", "we" and "us" mean SBMM.

You can reach us at [email protected] or through the Feedback page on this website.

2.What the extension reads on pages

The extension only reads what it needs to show its tools, and only on the pages listed below.

• Search results pages on Google (50 country versions), Bing, Yahoo Search, DuckDuckGo, Brave Search and Yandex: the search keyword, the addresses (URLs) and domains of the results, and the titles, snippets and layout of the results page.
• Google Maps and the local results on Google: the business details shown on the page (name, categories, rating, review count, website, phone, address, opening hours and Google IDs such as Place ID and CID).
• Reviews on Google Maps: when you open a business and scroll its reviews, the extension keeps a copy of the review text, rating, date and the reviewer first name, so the Business Profile Audit can group them into themes. These stay on your computer only.
• Any website you open: to show the top bar, the extension reads the domain name and, inside your browser, the page itself (word count, last updated date, CMS, ad networks and AEO/GEO score).
• The page you audit: when you click the extension icon, the page title, meta tags, headings, links, images, structured data and similar SEO elements are read inside your browser to build the audit. To check image sizes and formats, your browser downloads the images that page already uses, from wherever that page loads them.

3.What the extension sends to SBMM servers

To look up SEO metrics, the extension talks to our server at ext.sbmm.com.pk. It sends only the following:

• Domain names of search results, of businesses shown on Google Maps, and of the website you are on (for the top bar and the popup Overview). Only the domain, for example example.com, not the page you are reading.
• Page addresses (URLs) of the search results shown on a results page, to fetch page level numbers such as page authority, headings and schema.
• The keyword you searched and your search country, to show volume, cost per click, competition and trend.
• For keyword difficulty on Google: the keyword and the public titles, links and short descriptions of the top results shown on that page, plus which result features Google showed (for example ads or a map pack).
• A URL you choose to check in the Redirects tool, to trace its redirect path.
• With every request: an anonymous install ID (a random code created when you install the extension) and the extension version. The install ID is not linked to your name, email or website account. It lets us apply fair-use limits, stop abuse and count how many installs are active. Our server keeps the install ID with the extension version and the dates it was first and last seen, nothing else.

4.What the extension never collects

• Your name, email address, passwords, payment details or any other personal details.
• The full addresses of the pages you read. When the top bar is open we receive the domain name of the site you are on, with the anonymous install ID, to show its numbers. Hide the top bar, or turn off "Site metrics" or "Top bar" in Settings, to stop this.
• The content of the pages you read or audit. Page audits, AEO/GEO scores, the detector, link tools and the text extractor all run inside your browser.
• Your keyword projects, colour picks, screenshots or saved reviews. These stay on your computer.
• Form inputs, messages, cookies or login sessions of the websites you visit.

5.Requests your browser makes directly

Some tools work by having your own browser fetch public information directly, without passing through SBMM. These requests come from your computer, so the site that answers sees your IP address like any normal visit.

• Google Maps: business details, business lists for the audit, competitor lists and the rank check grid are fetched from Google Maps in your browser, one request at a time, only for businesses on pages you open or audits you start. Business rows on Google pages use your normal Google session, the same way the Maps page itself does.
• Business websites in the Business Profile Audit: the home page, up to two contact or about pages, robots.txt, llms.txt and sitemaps (only on the same website) are read to compare them with the profile.
• Sitemaps and robots.txt of the website you are on, to count its pages for the top bar, and of a site you crawl with the Link Finder or Internal Link Graph (the crawl also opens up to 300 pages of that same site to map its links). The top bar also reads the site's own ads.txt file to fill the Monetized cell, and the page audit and AEO/GEO check may load the current page and its robots.txt again from the same website.
• A public website traffic estimate service receives, straight from your browser, the domain names of search results and of the site you are on when the top bar is open, to show monthly visits (answers are cached in your browser for 24 hours). Public WHOIS services receive domain names to fill domain age when our server has no value yet.
• A public web archive receives domain names to show since when copies of a site exist.
• Google search suggestions: the "Load long-tail ideas" button and Keyword Ideas send your seed keyword and its variations to Google's public suggestion service. Keyword Ideas results are stored only in your browser.
• URLs Indexed: only when you click it, a Google search for "site:" plus the domain opens in a background tab and the result count is read. Because it is a normal Google search in your browser, it may appear in your Google activity if you are signed in to Google.
• Map tiles from OpenStreetMap are loaded to draw the geo-grid map in the rank check. Map data © OpenStreetMap contributors.
• Site favicons in the popup Tools list are loaded from Google's public favicon service.

6.Links you choose to open

Some buttons simply open another website in a new tab, for example directory searches in the NAP check, "check it yourself" links in Local AEO, review and profile links, free SEO checker pages in the Quick Check line and the popup Tools list. Nothing is sent to those sites until you click, and from then on their own privacy policies apply. The Quick Check buttons go one step further: they open a free traffic or backlink checker on a third-party SEO website, fill in the address of that result and press the check button on that site for you. That website then receives the address you chose to check, together with your IP address like any normal visit. The extension does not read anything back from that page. You can remove the Quick Check buttons in Settings.

Right after a new install, the extension opens the welcome page on this website once. When you remove the extension, your browser opens our feedback page so you can tell us why. The address only says that the visit came from a removal. No install ID or anything else about you is attached to either address, and sending the form is optional.

7.What is stored in your browser

The extension uses your browser storage (extension storage and, for Keyword Ideas, a local database) to remember settings and to avoid repeating lookups. This data never leaves your computer.

• Settings: your on/off choices for SBMM and each feature, colour theme, sidebar and top bar state, filters, weak limits, chosen country and saved map areas.
• Caches of public SEO numbers for domains and pages (from a few hours up to 30 days, with size limits).
• Business details from Google Maps (about 3 days, up to 1,000 businesses).
• Reviews you loaded on Google Maps: up to 300 reviews for each of up to 40 businesses, deleted after 30 days, reviewer first name only.
• Keyword Ideas projects and results, until you delete them.
• Colour picker history and the anonymous install ID.

8.How to clear extension data

• Delete a Keyword Ideas project from its Project settings.
• Remove the extension (right-click the icon and choose "Remove from Chrome", or use chrome://extensions). This deletes everything it stored in your browser, including the install ID.
• Clearing your browser's site data does not remove extension storage. Removing the extension does.

9.Switching SBMM or a feature off

The extension popup has an ON/OFF power button in its header and a Settings tab with a switch for every feature: the result bars, the sidebar, the keyword line, keyword difficulty, Quick Check, each search engine, the business rows on Google Maps and in Google results, review capture, the top bar, its site numbers and each top bar tool. Your choices are saved only in your browser.

When SBMM is off, the toolbar icon shows an OFF badge, nothing runs on the websites you visit and the extension sends no lookups for them, to our server or to any of the services listed in this policy. When a single feature is off, that feature stops running and makes none of its requests. For example, turning off Site metrics stops the top bar lookups for the sites you visit, and turning off review capture stops saving reviews.

10.Permissions explained

Chrome shows these permissions when you install. Here is what each one is used for.

• storage: saves your settings, caches and keyword projects in your browser.
• activeTab: lets the popup read the page you are on, but only after you click the extension icon.
• scripting: runs the extension's own bundled page audit, AEO/GEO check, color picker, screenshot and area capture tools on the current tab when you use them, and fills in the address on the checker page after you click a Quick Check button. No code is ever loaded from a server.
• downloads: saves screenshots, CSV exports, reports and extracted text to your computer when you click a download button.
• Access to ext.sbmm.com.pk: our server, which returns SEO metrics.
• Access to a public website traffic estimate service: fills monthly traffic for search results and for the site you are on.
• Access to a public SEO checker website: opens its free traffic or backlink checker and fills in the URL, only when you click a Quick Check button.
• Access to all websites: needed so the top bar and its tools (color picker, screenshots, text extractor, bulk opener) work on any site, so the result bars work on Google and other search engines, the business rows work on Google Maps, and the Business Profile Audit can read the business website. The extension does not read forms, passwords or cookies on these sites.
• A small script on Google Maps pages copies the review lists Google already loads for the business you are viewing, so they can be saved locally for the Reviews tab. It ignores everything else, and it copies nothing when "Review capture for Business Audit" is off in Settings.

11.This website and accounts

You can read this website without an account. An account is optional and is used to send feedback, see our replies and, in a future version, to sign in to the extension.

• Account details: your name, email address and password. Passwords are stored only as a secure one-way hash and are never visible to us.
• Email codes: 6-digit codes for email verification and password reset are stored as a hash and expire after 15 minutes.
• Account activity: when the account was created and when you last signed in.
• Feedback: the type, message, optional rating and the page you sent it from. Guests also give an email and an optional name so we can reply. With each message we store your browser name (user agent) and a one-way hashed form of your IP address to fight spam.
• Session cookie: one cookie that keeps you signed in for up to 7 days. It is strictly necessary and is not used for tracking.
• IP address: used in memory for rate limiting and security, for example to stop password guessing. Our hosting and network providers may keep short technical logs.
• Fonts: the pages load their fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.
• Store reviews: the home page shows public reviews of the extension from the Chrome Web Store. Our server reads the public store page every few hours and keeps the reviewer's public display name, profile picture link, star rating, review text, date and the extension version it was written for. Profile pictures load from Google's image servers. If you wrote a review and want it removed from this website, write to us.
• We do not use analytics, advertising or tracking cookies, and we do not embed social media trackers.

12.Google reCAPTCHA

Sign up, sign in, password reset and the feedback form may show a Google reCAPTCHA checkbox to stop bots. When it is shown, Google receives information about your device and your interaction with the checkbox under the Google Privacy Policy and Terms of Service. We only receive a pass or fail answer.

13.Emails we send

We send emails only for your account and your feedback: verification codes, password reset codes and replies to your feedback. We do not send newsletters or marketing emails.

14.Where SEO numbers come from

Metrics such as authority scores, links, traffic, keyword volume and rank are estimates about public websites and keywords. Our server gets them from third-party SEO data providers and public sources and caches them. We send these providers only domain names, page addresses and keywords, never information about you.

15.How we use data

• To show SEO metrics, keyword data and keyword difficulty in the extension.
• To run and protect the service: fair-use limits, stopping abuse and fixing errors.
• To manage your website account and answer your feedback.
• To improve the extension, using the bug reports and ideas you send us.

16.Chrome Web Store Limited Use

The use of information received from Chrome extension APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use data from the extension only to provide and improve its single purpose: showing SEO signals and tools in your browser. We do not sell it, we do not use or transfer it for advertising, credit checks or lending, and we do not let humans read it except with your consent, for security reasons, to follow the law, or in aggregated form for running the service.

17.Who we share data with

We do not sell, rent or trade personal data. We share data only with service providers that help us run the service, under their own security and privacy terms:

• Hetzner (Germany): hosts our servers and databases.
• Cloudflare: network security and delivery between you and our servers.
• Google: reCAPTCHA on the website forms, fonts and reviewer pictures on the website, and the Chrome Web Store, which delivers the extension and hosts its public reviews.
• Our email delivery provider: sends verification codes and feedback replies.
• Third-party SEO data providers: receive domain names, page addresses and keywords only, as explained above.

18.How long we keep data

• Website accounts and their feedback: until you delete your account.
• Guest feedback: as long as needed to answer it and improve the extension. Ask us and we will delete it.
• Verification and reset codes: 15 minutes.
• Cached SEO metrics on our server are about public domains, pages and keywords, not about you, and are refreshed or removed over time.
• Anonymous install records (install ID, version, first and last seen dates): while the extension is in use. Records of installs that are no longer seen may be removed at any time.
• Public store reviews shown on the website: while they are public on the Chrome Web Store, or until you ask us to remove one.
• Extension data in your browser: until it expires as described above, or until you remove the extension.

19.Your choices and rights

• Delete your account at any time from the Account page. This deletes your account and all feedback linked to it straight away.
• Change your name or password on the Account page.
• Turn SBMM off with the power button in the popup header, or switch single features off in the Settings tab. Hide the top bar so the extension looks nothing up while you browse. Remove the extension to delete everything it stored.
• Ask us for a copy of your website data, or to correct or delete it, by writing to [email protected].

20.Security

Connections to our servers use HTTPS. Passwords and email codes are stored only as hashes, the session cookie cannot be read by page scripts, and forms are protected against automated abuse. No system is perfectly secure, but we work to protect your data and fix problems quickly.

21.Children

The extension and website are made for people learning and doing SEO and are not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we will delete it.

22.International users

We are based in Pakistan and our servers are hosted in Germany. If you use the extension or website from another country, your data is processed in these countries. We apply the same protections to everyone.

23.Changes to this policy

When the extension or website changes how data is handled, we update this page and the "Last updated" date. Important changes may also be announced on this website. Please check this page from time to time.

24.Contact

Questions or requests about privacy: email [email protected] or use the Feedback page on this website.