Privacy Policy

1. Who we are

SEO Toolz operates https://seotoolz.app (“the Service”). We provide competitor keyword research and SEO analytics tools for digital agencies and freelancers. If you have questions about this policy, contact us at hello@seotoolz.app.

2. What data we collect

We collect the following categories of personal data:

• Account data: Your email address, name (if provided), and password (stored hashed via Supabase Auth).
• Billing data: Payment is handled by Stripe. We store your Stripe customer ID and subscription status. We never see or store card numbers.
• Project data: Websites, keywords, and competitor data you add to your projects, plus SEO metrics we collect about those sites over time.
• Google account data: If you connect Google Search Console we store search analytics (queries, clicks, impressions, positions) from your verified properties, accessed with the read-only webmasters.readonly scope. If you connect a Google Business Profile we store the associated location, review and listing data. If you sign in with Google we receive your email address, name and profile picture.
• Client portal users: If you invite a client to your portal, we store their email address and name to send sign-in links and control access.
• Lead-capture data: If you deploy the chat widget on a website, contact details a visitor submits (typically name, email, phone and their answers) are stored in your project. You are the data controller for these leads; we process them on your behalf.
• Usage data: Standard server logs including IP address, browser type, and pages visited. We do not use third-party analytics trackers.

3. How we use your data

• To provide and maintain the Service.
• To process your subscription and send transactional emails (receipts, password resets).
• To display your GSC and Business Profile data within the Service dashboard.
• To power AI-assisted features (for example the Action Engine, content briefs, executive summaries and the Google Ads Plan), which send the relevant project, crawl and keyword data to our AI providers to generate recommendations.
• To send product update emails (you can unsubscribe at any time).
• To investigate abuse and ensure platform security, including keeping a one-way hash of your email address after account deletion so a single free trial can be enforced per email.

We do not sell your personal data. We do not use your data to train AI models, and our AI providers are contractually bound not to train their models on data submitted through their APIs. We do not share your data with third parties except as described in section 4.

4. Third-party services

We use the following sub-processors. Each handles only the data needed for its function.

5. Google user data

SEO Toolz’s use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Search Console: we request the webmasters.readonly scope only (read-only access to your verified properties), and use that data solely to display search analytics in your dashboard.
• Business Profile: if you connect one, we read its locations, reviews and listing details only to power the Local SEO features in your dashboard.
• Sign-in with Google: we receive only your email, name and profile picture, used to create and identify your account.
• We do not transfer, sell, or use Google data for advertising or for AI/ML training, and we do not share it with third parties except sub-processors acting on our instructions.
• You can revoke access at any time via your Google account permissions page or by disconnecting in your SEO Toolz settings.

6. Data retention

We retain your account data for as long as your account is active. When you delete your account, your account, projects, crawl data, reports, portal users and integrations are removed and your sign-in email is released. The only thing kept is a one-way hash of your email address, retained to enforce one free trial per email; it cannot be reversed to recover your address.

Google Search Console data, crawl data, keywords, and reports are kept on the same basis as the rest of your project data — until you delete them, your project, or your account; we do not apply a separate fixed expiry to any of these. Historical SEO metrics (rankings, traffic, backlinks, AI visibility, local, PPC) are pruned on a schedule tied to your plan, from 1 month up to 36 months, or retained indefinitely on our top plan. Our internal usage/audit log is trimmed after around 13 months. Payment records are retained by Stripe as required by law.

7. Your rights (GDPR)

If you are located in the UK or European Economic Area, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate data.
• Erasure: Request deletion of your account and associated data.
• Portability: Receive your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, email hello@seotoolz.app. We will respond within 30 days.

8. Your rights (California and other regions)

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of any sale or sharing of it — a right that is already satisfied here since we do not sell or share personal information. We honour the Global Privacy Control browser signal automatically: if your browser sends it, analytics cookies stay off without you needing to do anything.

Residents of other countries with similar data protection laws (e.g. Canada, Brazil, Australia) have broadly equivalent rights to those listed in Section 7. Email hello@seotoolz.app for any request and we'll handle it under whichever law applies to you.

9. Cookies

Necessary cookies are always on and can't be switched off: an authentication session cookie for the main app (managed by Supabase) and a separate session cookie for the client portal. Without these you couldn't stay signed in.

Analytics cookies (Google Analytics) are only set if you accept them in the cookie banner shown on your first visit. They help us understand how the site is used — pages visited, rough visit duration, general location. We do not use them for advertising, and Google Signals / ad-personalisation is switched off in our configuration. You can change your choice at any time using the "Cookie settings" button shown in the corner of the site, or the "Cookie preferences" link in the footer.

We do not use advertising cookies or any third-party tracking cookies beyond the analytics above.

10. Security

We use industry-standard security measures including TLS encryption in transit, hashed passwords, and row-level security on our database. Access to production data is restricted to authorised personnel only.

11. Changes to this policy

We may update this policy from time to time. We will notify active users by email of any material changes. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

Questions about this policy? Email hello@seotoolz.app.