Privacy Policy | SEOStudio

Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

This Privacy Policy ("Policy") describes the privacy practices of Digital Front LLP ("we," "us," "our," "Company"), a company registered at 3rd Floor East, 21 Foley Street, London W1W 6DR, United Kingdom (Registration No: OC457050), in connection with SEOStudio (https://seostudio.com), including all associated websites, applications, and services (collectively, the "Service"). As the data controller, we are responsible for determining the purposes and means of processing your personal data.

By accessing or using the Service, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not agree with this Policy, please do not access or use the Service.

1. Information We Collect

We collect information in several ways: directly from you, automatically through your use of the Service, and from third-party sources.

1.1 Information You Provide Directly

Account Information:

Name, email address, and username
Password and security credentials
Profile picture and biographical information
Phone number (if provided)
Organization name and role (for team accounts)

Billing and Payment Information:

Billing name and address
Payment method details (credit card number, expiration date, CVV)
Tax identification numbers (VAT, GST, etc.)
Transaction history and invoices

Note: Payment information is processed by our third-party payment processor(s) and is not stored on our servers except as necessary for record-keeping.

Communications:

Messages you send through the Service
Support inquiries and correspondence
Survey responses and feedback
Testimonials and reviews (with your consent)

User Content:

Files, documents, and data you upload
Content you create, share, or store on the Service
Comments, notes, and annotations

1.2 Information Collected Automatically

Device and Browser Information:

Device type, model, and manufacturer
Operating system and version
Browser type and version
Screen resolution and display settings
Device identifiers (including advertising identifiers)

Usage Information:

Pages and features accessed
Time spent on pages and features
Clicks, scrolls, and interactions
Search queries within the Service
Date and time of access
Referring and exit pages

Network and Location Information:

IP address
Internet service provider
General geographic location (city, region, country)
Time zone settings

Cookies and Similar Technologies:

Session cookies and persistent cookies
Pixel tags (web beacons)
Local storage and session storage
Mobile advertising identifiers

For more information about our use of cookies, please see our Cookie Policy.

1.3 Information from Third Parties

OAuth and Social Login Providers: When you choose to log in using a third-party service (such as Google, GitHub, or Microsoft), we receive basic profile information as authorized by you through that service. If you connect Google Search Console or Google Analytics, see Google User Data below.

Payment Processors:

Transaction status and confirmation
Fraud prevention and verification data
Chargeback and dispute information

Analytics and Advertising Partners:

Aggregated usage statistics
Attribution and conversion data
Ad performance metrics

Session Recordings: If enabled, and only after you accept analytics cookies, we may record how you interact with the Service (page layout, clicks, scrolling and navigation) to find where it is hard to use. All text and form inputs are masked before anything leaves your browser, and sign-in, account settings, billing and checkout pages are never recorded. You can turn this off at any time by withdrawing analytics consent in our cookie settings or opting out of analytics in your account settings.

2. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data under the following legal bases:

Contractual Necessity:

To create and manage your account
To provide the Service you have requested
To process payments and fulfill subscriptions
To provide customer support

Legitimate Interests:

To improve and develop our Service
To analyze usage patterns and optimize performance
To prevent fraud and ensure security
To send service-related communications
To protect our legal rights

Consent:

To send marketing communications
To use cookies for analytics and advertising
To process special categories of data (if applicable)
To transfer data internationally (where consent is required)

Legal Obligation:

To comply with applicable laws and regulations
To respond to lawful requests from authorities
To maintain records as required by law

You may withdraw your consent at any time where we rely on consent as the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

3. How We Use Your Information

3.1 Providing and Maintaining the Service

Creating, managing, and authenticating your account
Processing transactions and managing subscriptions
Delivering the features and functionality you request
Storing and managing your User Content
Providing technical support and responding to inquiries

3.2 Improving and Developing the Service

Analyzing usage patterns to improve features
Conducting research and analysis
Developing new products, features, and services
Testing and debugging
Training machine learning models (using aggregated or anonymized data), never including Google user data

3.3 Communications

Sending transactional emails (account confirmations, password resets, receipts)
Providing service updates and administrative notifications
Sending marketing communications (with your consent or as permitted by law)
Responding to your inquiries and support requests
Sending surveys and requesting feedback

3.4 Security and Fraud Prevention

Detecting, investigating, and preventing fraudulent transactions and abuse
Monitoring for security threats and vulnerabilities
Enforcing our Terms of Service
Verifying user identity
Protecting against unauthorized access

3.5 Legal and Compliance

Complying with applicable laws, regulations, and legal processes
Responding to lawful requests from government authorities
Establishing, exercising, or defending legal claims
Enforcing our agreements and policies

3.6 Google User Data

This section explains how SEOStudio handles data it receives from Google APIs ("Google user data"). It applies in addition to the rest of this Policy. Where they differ, this section governs.

What we access.

Sign in with Google: your name, email address and profile picture (scopes openid, email, profile), to create and sign in to your account.
Google Search Console (read-only, webmasters.readonly), only when you connect it: the list of properties in your account, and, for the property you choose, search performance (queries, pages, clicks, impressions, click-through rate, position, dates, countries, devices), sitemaps and the index status of your pages.
Google Analytics (read-only, analytics.readonly), only when you connect it: the list of your Analytics accounts and properties, and, for the property you choose, traffic reports such as sessions, users, page views, engagement, channels, landing pages and key events.

We never change anything in your Google accounts.

How we use it. Only to provide and improve the features you see in SEOStudio: your search and traffic reports, the recommendations for your website (for example pages with a low click-through rate, searches you already rank for, pages that are not indexed), the keyword research for your project, and the answers the built-in AI assistant gives to your own requests. We do not use Google user data for advertising, we do not sell it, and we do not use it to decide creditworthiness or for lending.

AI processing. When you ask the AI assistant a question, or a feature you start needs it, the Google user data needed for that request is sent to the AI model provider that runs the request. We use it only to produce the answer for you. Google user data is never used to train, fine-tune or improve AI models, ours or anyone else's. We use model providers under terms or settings that do not allow training on our inputs.

Sharing. We share Google user data only with service providers that help us run the features above, under contract and only for that purpose: our hosting and database providers, the AI model providers described above, and our keyword data provider, which receives search query text (never your clicks, impressions or account details) to return search volumes. We may also share it when the law requires it, to protect security (for example when investigating abuse), or as part of a merger, acquisition or sale of assets, with your prior consent. We do not transfer it to advertising platforms, data brokers or information resellers.

Human access. Our staff do not read your Google user data unless you ask us to (for example in a support request), it is needed for security (for example investigating a bug or abuse), the law requires it, or it is aggregated and used for internal operations.

Storage and security. Google user data is stored on our servers and encrypted in transit (TLS). Access tokens are encrypted at rest with AES-256. We keep synced reports for as long as your project exists, so that your history stays available.

Deletion and control.

Disconnect a Google integration in Settings > Integrations at any time. This deletes the stored access token at once, and we stop reading new data.
Delete a project to delete all Google user data synced for it. Delete your account to delete all of it.
Revoke our access at any time at https://myaccount.google.com/permissions.
Or write to [email protected] to ask us to delete your Google user data. We do it within 30 days.

Limited Use. SEOStudio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Contact. Questions about this section: [email protected].

4. How We Share Your Information

We do not sell your personal information. Google user data is shared only as described in Google User Data (section 3.6). We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party vendors, consultants, and service providers who perform services on our behalf, including:

Cloud hosting and infrastructure providers
Payment processors and billing services
Email delivery services
Customer support platforms
Analytics providers
Security and fraud prevention services

These service providers are bound by contractual obligations to protect your information and may only use it for the purposes for which it was disclosed.

Sub-Processor Changes: We maintain a list of sub-processors who process personal data on our behalf. We will provide you with reasonable advance notice of any intended changes to our sub-processors, either through email notification or by updating the list on our website. If you have objections to a new sub-processor, you may contact us to discuss your concerns. A current list of our sub-processors is available upon request.

4.2 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, including:

Court orders and subpoenas
Requests from law enforcement or government agencies
Legal proceedings and litigation
National security requests

4.4 Protection of Rights

We may disclose information when we believe disclosure is necessary to:

Protect our rights, property, or safety
Protect the rights, property, or safety of our users or the public
Investigate potential violations of our Terms of Service
Detect, prevent, or address fraud, security, or technical issues

4.5 With Your Consent

We may share your information with third parties when you have given us your explicit consent to do so.

4.6 Aggregated or Anonymized Data

We may share aggregated or anonymized information that cannot reasonably be used to identify you.

5. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction.

5.1 Transfer Safeguards

When we transfer personal data internationally, we implement appropriate safeguards:

Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses with our service providers to ensure adequate protection for data transferred outside the EEA.

Adequacy Decisions: We may transfer data to countries that have been recognized by relevant authorities as providing an adequate level of data protection.

Data Processing Agreements: We maintain data processing agreements with all third parties who process personal data on our behalf.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected:

Account Information: Retained for the duration of your account plus a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements.

Billing and Transaction Data: Retained for a minimum of seven (7) years to comply with tax and accounting requirements.

Usage Data and Analytics: Typically retained for up to two (2) years for analysis and service improvement.

Communication Records: Support correspondence retained for up to three (3) years after resolution.

User Content: Retained until you delete it or for a reasonable period after account termination.

You may request deletion of your personal information at any time, subject to our legal obligations and legitimate business interests.

7. Data Security

We implement appropriate technical and organizational security measures:

7.1 Technical Measures

Encryption of data in transit using TLS/SSL
Encryption of data at rest using industry-standard algorithms
Secure password hashing
Multi-factor authentication options
Regular security testing and vulnerability assessments
Firewalls and intrusion detection systems
Access controls and role-based permissions

7.2 Organizational Measures

Employee training on data protection and security
Background checks for employees with access to personal data
Confidentiality agreements with employees and contractors
Incident response procedures
Regular security audits and reviews

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure.

7.3 Security Incidents

In the event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

Right to Access: Request a copy of the personal information we hold about you.

Right to Rectification: Request correction of inaccurate or incomplete personal information.

Right to Erasure: Request deletion of your personal information, subject to certain exceptions.

Right to Restriction: Request that we restrict the processing of your personal information.

Right to Data Portability: Receive your personal information in a structured, commonly used format.

Right to Object: Object to processing of your personal information for direct marketing or based on legitimate interests.

Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond within the timeframe required by applicable law (typically 30 days).

Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. If we use automated decision-making, we will inform you and provide meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing. You may request human intervention, express your point of view, or contest any automated decision.

9. Rights for Specific Jurisdictions

9.1 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the rights described above, plus:

Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

9.2 United States Residents

California (CCPA/CPRA): If you are a California resident, you have the following rights:

Right to Know: Request information about personal information collected, sources, purposes, and third parties with whom it is shared
Right to Delete: Request deletion of personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information (Note: We do not sell personal information)
Right to Non-Discrimination: We will not discriminate against you for exercising your rights
Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to purposes necessary to provide the Service

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Other US State Laws: If you are a resident of a US state with comprehensive privacy legislation, you may have similar rights including:

Right to access, correct, and delete your personal data
Right to data portability
Right to opt out of targeted advertising, sale of personal data, and profiling
Right to appeal our decisions regarding your privacy requests

To exercise any of these rights, contact us at [email protected]. We will verify your identity before processing your request.

9.3 Brazilian Residents (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including access, correction, deletion, portability, and the right to revoke consent.

9.4 Canadian Residents (PIPEDA)

If you are located in Canada, you have rights under PIPEDA, including access, correction, and withdrawal of consent.

10. Children's Privacy

The Service is not intended for children under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately.

11. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to third-party services.

We encourage you to review the privacy policies of any third-party services you access. We are not responsible for the content, privacy practices, or data handling of third-party services.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. There is no uniform standard for responding to DNT signals.

Currently, our Service does not respond to DNT signals. However, you can manage your privacy preferences through our cookie settings and the options described in this Policy.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

Notification of Changes:

We will post the updated Policy on the Service with a new "Last Updated" date
For material changes, we will provide additional notice via email or a prominent notice on the Service
We will obtain your consent where required by law

Your continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.

14. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Digital Front LLP (Data Controller)
3rd Floor East, 21 Foley Street, London W1W 6DR, United Kingdom
Registration No: OC457050

Data Protection Inquiries: [email protected]

Website: https://seostudio.com

Supervisory Authority: If you are located in the EEA, UK, or Switzerland and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

By using the Service, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy.