Privacy Policy

Last updated: October 13, 2026

Türkçe

Effective date: October 13, 2026

This Privacy Policy explains how RoPi LLC ("we", "NO404") collects, uses and protects personal data when you use https://www.no404.tr. We act as the data controller for account data, and as a data processor for the visitor telemetry we handle on your behalf.

1. Data we collect

1.1 Account data

Your name, email address and a hashed password (we never store passwords in plain text). If you sign in with Google, we also store your Google account identifier and the OAuth tokens needed to call the Search Console API on your behalf.

When you create an account or accept our terms, we keep evidence of that acceptance: the date and time, which documents and which version of them you accepted, your IP address and your browser's user agent string. We keep it while your account exists and for up to 3 years after the account is deleted, so that we can show the agreement was made if a dispute arises; after that the IP address and user agent are erased.

1.2 Google Search Console data

With your explicit consent we request the read-only scope webmasters.readonly. We use it solely to (a) list the properties you have verified so you can pick one, (b) list the sitemaps you have submitted for that property, and (c) read aggregated search performance (clicks and impressions per page) for a website you have added, so we can show which of your 404 addresses still receive traffic from Google Search. Performance data is fetched when you open that report, held in memory for up to 6 hours and never written to our database. We do not modify anything in your Search Console account.

1.3 Website catalog

URLs, paths and page titles imported from the sitemap you select. This is business data about your website, not personal data about individuals.

1.4 404 event telemetry

When a visitor reaches a 404 page on your website, our endpoint records the requested path, the referring URL, the user agent string, a derived device/browser/bot classification, an approximate country, and the matching result. Regarding IP addresses:

  • we never store the raw IP address;
  • we store a salted, irreversible SHA-256 hash of it for unique-visitor counting;
  • we store a masked form with the final segment removed (e.g. 85.34.78.x) for network context in your dashboard.

1.5 Billing data

Paid plans are sold by Stripe acting as merchant of record. Stripe collects your payment and billing details — including any billing address and tax identifier needed for its own invoicing and tax obligations — as an independent controller under its own privacy policy. We receive only a customer identifier, subscription identifier, plan and billing period. We never receive or store your full card number.

1.6 Cookies

We use a strictly necessary, HttpOnly session cookie to keep you signed in, a language cookie and a cookie that stores your cookie choices. Optional tools load only after you allow them in the cookie banner: analytics — Google Analytics and the web analytics and session recording tools described in section 1.9, and advertising measurement — described in section 1.12. Analytics runs only on the public marketing and sign-in pages; the signed-in dashboard and admin areas are never measured or recorded. Advertising measurement is the one exception, and only if you allowed it: it runs on the public pages too, and in the dashboard it sends only conversion events: once when a payment completes and once right after you create an account. A guide request is reported on the public page where you submit the form. Until you decide, and if you reject, none of them loads. You can change or withdraw your choice at any time via “Cookie preferences” in the site footer or in your account settings; your choice is kept for 180 days and then asked again. So that we can show whether you gave or refused permission, we keep a record of each choice — a random identifier stored in the same cookie, the choice, the banner version and language, the date and, if you are signed in, your account — without your IP address or browser details. The record is deleted 3 years after the choice expires.

1.7 Website compatibility checker

When you enter a domain in the checker on our home page, our servers request a few public addresses of that website (the home page, a random non-existent address, robots.txt and the sitemap). We store the domain and the result (detected platform, 404 behaviour, whether a sitemap was found and the recommended setup) for 180 days to produce aggregate product statistics. This record contains no IP address, no cookie and no content of the checked website; your IP address is used only transiently, in memory, for rate limiting.

1.8 Bot protection on the contact form

When enabled, our contact form uses Cloudflare Turnstile to tell people from automated submissions. Your browser then sends your IP address and technical browser signals to Cloudflare, Inc., which processes them under its own privacy policy. We receive only a pass or fail result.

1.9 Web analytics and session recording

Only with your analytics permission, our public marketing and sign-in pages may load two further measurement tools run by third-party providers:

  • Web analytics — counts page views and measures how fast pages load, without setting cookies. Your browser sends the provider the address of the page, the referring page, your browser and device type and your IP address.
  • Session recording and heatmaps — records how our pages are used: clicks, scrolling, mouse movement and the page as it is displayed to you, together with your browser, device, screen size, an approximate location derived from your IP address and the page address. It sets its own cookies to link your visits. Sensitive fields such as passwords and email addresses are masked before the recording leaves your browser. We use the recordings and the aggregated heatmaps only to find usability problems and improve our pages.

These providers may process the data in the United States and may also use it, as independent controllers under their own privacy policies, to improve their own services. Recordings are kept by the provider for a limited period (at most 13 months). The signed-in dashboard and admin areas are never recorded. You can withdraw your permission at any time via “Cookie preferences”; the tools then stop loading and their cookies on our domain are removed.

1.10 Shopify app

If you install our Shopify app on your Shopify store, the app runs on our infrastructure and processes the following data only to connect your store to your NO404 account:

  • Store data — your store's myshopify.com address and primary domain, read once from Shopify at installation so that visitors are only sent to your own addresses; the installation and uninstallation dates; and the time the app last received a request from your storefront, which confirms that the setup works.
  • Shopify access — the access token Shopify issues for the single permission the app requests (write_app_proxy, needed to answer requests on your storefront). The app cannot access your customers, orders or products.
  • Settings — your NO404 API key and your redirect preferences. The key is kept on our server and never appears in your storefront's pages.
  • 404 requests from your storefront — every time a visitor reaches your store's 404 page, the app sends to the NO404 service: the requested path, the referring address, the visitor's network address with the last part removed (for example 85.34.78.0), an irreversible identifier derived from the full IP address with a key held only by the app and only for your store, the browser's user agent string and, where Shopify provides it, the visitor's country. The service records these as described in section 1.4; the identifier lets visitors be counted without the service ever receiving an IP address, and cannot be linked to the same visitor on another store. The full IP address never leaves the app — it is used only transiently, in memory, to derive that identifier and to rate-limit requests. The customer identifier Shopify attaches to storefront requests is not read.

The storefront script sets no cookies. So that the same address is not looked up twice, it keeps a small marker for each checked address in the visitor's session storage, which is cleared when the browser tab is closed.

When you uninstall the app, its access token is deleted immediately. Your store record and settings are kept so that a reinstall keeps your configuration, and are deleted permanently when Shopify sends its store data deletion request, 48 hours after uninstallation. The app keeps no personal data about your customers, so Shopify's customer data requests have nothing to return or erase. 404 records already written to your NO404 account remain there until your plan's retention period ends (section 6) or you delete them or your account. Shopify's own processing of your store's data is governed by Shopify's privacy policy.

1.11 Free broken link checker

The free broken link checker on our website does not scan your site from that page. When you enter a domain there, we store the domain, the language you used and an irreversible hash of your IP address for 180 days, so that we can measure how many visitors reach us through this page and which platforms they use. Your IP address itself is not stored.

In the background we run the compatibility check described in section 1.7 on the same domain and keep only its summary (detected platform, 404 behaviour and whether a sitemap was found) with that record; the result is not shown to you on that page. If you later create an account and add the same domain as a website, we mark that record as converted so that we can measure how well the page works. This match is made on the domain alone — we do not place any tracking identifier, cookie or fingerprint on your browser.

The actual scan runs only after you create an account and only against a website you have connected to your account.

1.12 Advertising measurement

If you allow “advertising measurement” in the cookie banner, we load the conversion tags of the search and social media advertising platforms we advertise on. They use first-party cookies on your browser: when you reach us from an ad, the ad click identifier in the address is saved, and the social media platform's pixel stores a browser identifier. Through these tags the platforms receive the address of the public page you visit, the type of event (sign-up, purchase or guide request) and, for a purchase, the amount excluding tax and the currency. As with any website that loads a third-party tag, the platform also receives your IP address and browser details itself.

We use this for three purposes: to measure whether our ads lead to sign-ups, purchases and guide requests; to improve how our ads are delivered; and to build an audience of visitors to our website so that we can show them our ads again on the social media platform (remarketing). On the search platform we keep personalisation signals switched off.

When you complete a payment, the tags receive the Stripe checkout session ID (so one payment is counted once), the amount excluding tax and the currency. When you create an account or request a guide, they receive only the fact that the event happened. We do not send your name, email address, phone number or any other account detail, and we do not use the platforms' advanced matching. Upgrades you make later from inside the dashboard are not reported.

The search platform acts as an independent controller for the data it receives through its tag. For the social media platform, we and the platform are joint controllers for the collection and transfer of this data through its pixel; what the platform does with the data afterwards is governed by its own privacy policy. The data may be processed outside your country (section 5), based on your permission. Advertising measurement is off until you allow it. You can withdraw your permission at any time via “Cookie preferences”; the advertising cookies are then deleted and nothing further is sent.

1.13 Connecting an AI assistant (ChatGPT)

You can connect ChatGPT, or another assistant that supports the Model Context Protocol, to your NO404 account. You approve the connection on a NO404 page while signed in, and the page shows whether the assistant may only read your data or may also change your redirects. Once connected:

  • What the assistant can receive: when you ask it, data from the websites in your own account: website names and addresses, 404 counts and trends, the requested paths and their timestamps, the referring site's domain (not the full address), the visitor's country and device type, the name and category of known bots, the traffic source, redirect suggestions, your redirect rules, and the results of your broken link scans and backlink checks. It never receives visitors' IP addresses, the irreversible identifiers described in section 1.4, full user agent strings, your API keys, your password or your billing details.
  • What we store: the name and return addresses of the connected application, the permissions you granted, when you connected and when it was last used, and irreversible hashes of its access tokens (never the tokens themselves). For each action the assistant performs we keep a log entry with the action, the website, whether it succeeded and, for redirect changes, the source and target path. We use this log for security and to answer your support requests.

The assistant's provider (for ChatGPT, OpenAI) processes what it receives under its own terms and privacy policy, as an independent controller. We send it only what you request through the connection. You can disconnect at any time under Settings → Connected apps in your dashboard, and access ends immediately. Changing your password also ends every connection.

2. How we use data

  • to create and secure your account and authenticate you;
  • to verify website ownership through Google Search Console;
  • to import your catalog and compute redirect suggestions;
  • to operate our Shopify app for stores that install it;
  • to show which of your 404 addresses still receive Google Search traffic;
  • to answer requests from AI assistants you have connected to your account (section 1.13);
  • to run the public compatibility checker and produce aggregate statistics from it;
  • to enforce plan limits, quotas and rate limits and to prevent abuse;
  • with your permission, to understand in aggregate how visitors use our public pages and to improve them;
  • with your permission, to measure whether our advertising leads to sign-ups and purchases;
  • to bill you and to provide support;
  • to comply with legal obligations.

We do not sell personal data, and we do not use your data to train machine-learning models.

3. Legal bases (GDPR)

  • Contract — providing the service you subscribed to.
  • Consent — connecting your Google account and the Search Console scope, and the optional analytics, session recording and advertising measurement tools you allow in the cookie banner; you may withdraw it at any time by disconnecting Google in your account settings, revoking access in your Google account or changing your “Cookie preferences”.
  • Legitimate interests — security, abuse prevention, service improvement, and keeping evidence of the terms you accepted.
  • Legal obligation — tax, accounting and lawful requests.

4. Sharing and sub-processors

We share data only with providers that help us run the service:

  • Stripe — payment processing and subscription billing;
  • Google LLC — sign-in, the Search Console API and, with your permission, Google Analytics;
  • Cloudflare, Inc. — bot protection on the contact form (Turnstile), when enabled;
  • our hosting and database provider — infrastructure on which the service runs;
  • our web analytics and session recording providers — the tools described in section 1.9, only with your permission;
  • our advertising platforms (search and social media): the conversion measurement and audience building described in section 1.12, only with your permission.

Some of these providers are described by category because we may change them over time; any replacement is bound by equivalent confidentiality and data protection obligations. You can request the current list of named providers at any time from support@no404.tr.

If you connect an AI assistant (section 1.13), we send it the data you request through that connection. The assistant's provider is not our sub-processor and acts under its own terms.

We may also disclose data where required by law or to protect our rights. We do not otherwise share, rent or sell personal data.

5. International transfers

Data may be processed in the United States and other countries. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

6. Retention

404 event records are retained for the retention window of your plan and are then deleted automatically by a scheduled cleanup job. Account and billing records are kept while your account is active and afterwards only as long as required for legal, tax and accounting purposes. When you delete your account, your websites, catalog entries and event records are deleted with it. Compatibility checker records and broken link checker records (section 1.11) are deleted after 180 days. Search Console performance data is not stored. Shopify app data is deleted as described in section 1.10. AI assistant action logs (section 1.13) are deleted after 180 days, and expired or revoked access tokens within 7 days. Evidence of your acceptance of our terms is kept as described in section 1.1.

7. Security

We use encrypted connections (TLS), hashed passwords (bcrypt), HttpOnly session cookies, per-website API keys with origin locking, and rate limiting. No system is perfectly secure, but we work to protect your data and will notify you of a personal data breach where legally required.

8. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. Residents of California may request disclosure of the categories of personal information collected and may opt out of "sale" or "sharing" — we do neither. Residents of Türkiye have equivalent rights under KVKK (Law No. 6698).

To exercise any right, contact support@no404.tr. We respond within 30 days. You may also lodge a complaint with your local supervisory authority.

9. Children

The service is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact support@no404.tr and we will delete it.

10. Changes

We may update this policy. Material changes will be announced by email or in-product notice before they take effect, and the effective date above will be updated.

11. Contact

RoPi LLC — Wyoming Limited Liability Company
30 N Gould St, Ste N, Sheridan, Wyoming, 82801, United States
Privacy requests: support@no404.tr
General support: support@no404.tr