Legal
Privacy policy
Last updated 8 October 2026
DirectoryBuilder (directorybuilder.com) is a free tool that estimates whether a niche directory website is worth building. This page explains what we collect, why, who processes it and what you can ask us to do. The short version: we collect what the tool needs to work, we do not sell data, and reports you run are public by default unless you keep them private with an account.
Who is responsible
The service is operated by the maker of Directify, based in the European Union. For anything in this policy, write to [email protected].
What we collect and why
Reports you run
The niche and location you type, the report generated from them (keyword, competition, business and plan data) and the time it was created. Reports are the product: they are stored so you and others can open them later. A report started without an account is public: it is unlisted for 24 hours, then it appears in the library, in search engines and in links you share. Reports started with an account are private to you until you make them public.
Rate limiting
To cap the number of new reports per day we store a hashed version of your IP address with each report you start, a db_visitor cookie containing a random identifier (one year), and short-lived counters keyed to that hash and cookie. None of this identifies you personally and it is not used for tracking across sites.
Accounts
If you create an account we store your email address, a display name, the time you last signed in, and the reports you own. Sign-in is by a single-use link emailed to you; we do not store passwords. If you sign in with Google we also store your Google account identifier and, if provided, your name and profile picture URL, as returned by Google. We only request Google's basic profile and email scopes.
We send transactional email only: sign-in links and a notification when a report you own is ready. There is no marketing list. Email is delivered through Amazon Web Services (Amazon SES).
Analytics
We use Plausible Analytics, self-hosted on our own server, which does not use cookies and does not store personal data or IP addresses. We see aggregate counts: pages viewed, referrers, countries, and events such as "report submitted" or "build button clicked". Nothing is tied to you and nothing leaves our infrastructure.
Bot protection and delivery
The site is served through Cloudflare, which processes connection data (such as IP addresses) to deliver pages and block abuse. The report form uses Cloudflare Turnstile to tell people from bots; Turnstile may set its own cookies for that purpose. Their handling of data is described in Cloudflare's privacy policy.
Server logs
Our web server keeps standard access logs (IP address, requested URL, time, browser) for security and debugging, rotated after a few weeks.
Where the report data comes from
Search volumes, keyword difficulty, live Google results, traffic estimates and business counts come from third-party data providers that aggregate Google Ads, Google Search and Google Maps data. Only the niche and location you type are sent to them; nothing about you is. The plan section of a report is drafted by an AI model (OpenAI) from the numbers in the report; again, only the report's figures are sent, not your identity.
Who processes data on our behalf
- Hetzner Online GmbH (Germany): hosting of the application and database.
- Cloudflare, Inc.: content delivery, DNS, bot protection (Turnstile).
- Amazon Web Services (Amazon SES, EU region): transactional email.
- Google LLC: sign-in with Google, only when you choose it.
- OpenAI and SEO data providers: generation of report content from the niche and location you enter.
We do not sell personal data and we do not share it with anyone else, except if required by law.
How long we keep things
- Public reports: indefinitely, as part of the library; they are refreshed periodically.
- Private reports and account data: for as long as you have an account. Delete your account and they are removed; reports you had made public stay in the library without a link to you.
- Sign-in links: 20 minutes; the record of the link is deleted shortly after.
- Rate-limit counters: 24 hours. Server logs: a few weeks.
Your rights
Under the GDPR and similar laws you can ask for a copy of the personal data we hold about you, have it corrected or deleted, object to or restrict its processing, and take it with you. You can make a report private, public, or delete it from your account page at any time. To delete your account entirely, or for any other request, email [email protected]; we answer within 30 days. You also have the right to complain to your local data protection authority.
Children
The service is not aimed at children under 16 and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, we will note the new date at the top and, for account holders, mention it by email or on the site.