Privacy policy

Who is responsible

The operator identified above is the controller for account administration, billing and service security data.

For personal data you place in a workspace, you determine the purposes and we process it on your instructions as described in the DPA.

Use the contact details above for privacy questions or requests.

Data we collect

• Account email, name, provider identifier and profile image from Google or GitHub sign-in, plus workspace memberships and invitations.
• Workspace settings, sites, app identifiers, connector credentials, metrics, observations, findings, work items, agent submissions, uploaded reports and usage records.
• Search Console search performance, queries, pages, indexing and URL Inspection data, including imported Search Console AI and Discover reports.
• GA4 traffic and referral metrics, Google Play vitals, statistics, reviews and public listings, and PageSpeed Insights and Chrome UX Report performance data.
• Bing Webmaster and imported Bing AI reports, Yandex Webmaster metrics, Apple App Store Connect reports, public App Store listings and Apple Ads search popularity.
• Public site pages, sitemaps, robots rules, uptime and TLS certificate information for audits, plus IndexNow submissions you configure.
• AI visibility prompts, answers and citations from OpenAI, Perplexity, Gemini and Anthropic, brand mentions from Reddit and YouTube searches through Composio or imports, Hermes snapshots and cookieless first-party visit totals from your connected sites.
• Subscription identifiers and status from Stripe, and technical request and error information needed to secure and operate the service.

Cookies

We use only essential authentication cookies, not tracking or advertising cookies.

The signed HttpOnly session cookie lasts up to 30 days and uses SameSite=Strict.

Temporary HttpOnly cookies protect sign-in, invitations and Google connection flows and expire after 10 minutes.

Authentication cookies use the Secure flag in production.

You can remove cookies in your browser, which may sign you out or interrupt authentication.

When you open a public page while signed out, a small request adds one to an anonymous daily count for that page and for the utm_campaign value in the link, if there is one. It sets no cookie and uses no browser storage, we do not store your IP address or user agent with it, and it is skipped when your browser sends Do Not Track or Global Privacy Control.

Purposes and legal bases

We process account and billing data to perform our contract with you and provide your workspace.

Our legitimate interests are keeping the service reliable, preventing abuse and investigating security incidents.

We process records needed to meet legal obligations, including applicable accounting and tax requirements.

You choose which connectors to authorise and may withdraw that authorisation at any time.

Where we rely on consent, you may withdraw it without affecting earlier lawful processing.

We process customer-controlled workspace data on the customer's instructions and legal basis.

Google user data

Connecting Google requests the following exact OAuth scopes:

• https://www.googleapis.com/auth/webmasters.readonly reads your Search Console properties, search performance and URL indexing information.
• https://www.googleapis.com/auth/analytics.readonly reads your GA4 properties and analytics reports.
• https://www.googleapis.com/auth/androidpublisher reads Google Play app and review information for your connected apps.
• The androidpublisher scope permits more than reading, but SEO Perch uses it only for reads and does not publish or change your apps.
• When you configure a Google Play service account, vitals and bulk statistics also use playdeveloperreporting and devstorage.read_only permissions.
• If you press Set it up for me or Allow sitemap submits on a site, Google is separately asked for https://www.googleapis.com/auth/siteverification, which verifies that you own the domain, and https://www.googleapis.com/auth/webmasters, which adds the site to Search Console and submits its sitemap.
• SEO Perch uses the siteverification scope only when you start that setup. The webmasters scope is used for that setup and, once granted, by the Search Console indexing connector of that site to tell Google that its sitemap changed, at most once a day. Google treats that as a hint and does not promise to crawl. Both scopes are used only for the domain of that site.
• Google sign-in separately requests openid, email and profile to identify your account.
• Connected Google metrics are used only to show you your own metrics in SEO Perch and the reports you authorise.
• We never sell Google user data, use it for advertising or use it to train AI models.
• Google connector data is not sent to the AI visibility providers.
• Humans do not read Google user data except with your affirmative consent, when necessary for security or to comply with law.
• Refresh tokens are encrypted at rest with AES-256-GCM under SECRETS_KEY.
• Disconnecting Google revokes the token with Google and removes the stored refresh token after revocation succeeds or Google confirms it is already invalid.
• Disconnecting stops future collection; use workspace deletion or contact us to erase stored data.

SEO Perch's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

Plan observation retention limits are 90 days for Free, 365 days for Pro and the operator's Personal plan, and 730 days for Agency.

Scheduled pruning uses the workspace retention_days setting and defaults to 180 days when it is unset.

Pruning preserves the latest observation run for each site and observation kind, so these records may remain longer.

Other workspace records remain until deleted or the workspace is deleted, rather than expiring under observation retention.

Account records are separate from workspace records; contact us to request account deletion.

We retain billing or security records only as needed for legal obligations, disputes and security purposes.

Workspace owners can export records at /api/workspace/export and delete a customer workspace with DELETE /api/workspace.

Secret values are excluded from exports.

Service providers and subprocessors

We use the following providers only for the relevant enabled service, with access limited to what that service needs.

Some providers also act as independent controllers for their own account, payment or platform obligations.

• Railway hosts the application and PostgreSQL database, including stored workspace data.
• Stripe handles subscriptions, payment details and billing records when billing is enabled.
• Google APIs supply connected Search Console, Analytics, Play and PageSpeed data and support Google sign-in.
• GitHub supports GitHub sign-in.
• Microsoft Bing Webmaster, Yandex Webmaster and Apple services supply the data you choose to connect.
• OpenAI, Perplexity, Google Gemini and Anthropic process the prompts you configure for AI visibility checks when enabled.
• Composio handles configured integrations, including brand mention searches across Reddit and YouTube.
• Telegram and your configured webhook recipient receive inbox digests when you enable those channels.
• Sentry receives server error messages, stack traces and diagnostic context only when SENTRY_DSN is configured.

Sharing and international transfers

Workspace members and agents you authorise can access data within their permissions.

Enabled providers receive only data needed for the selected function; AI providers receive configured prompts, not connected Google metrics.

We may disclose data when required by law or necessary to protect service security.

Providers may process data outside the European Economic Area.

Where required for those transfers, we use the European Commission's Standard Contractual Clauses and appropriate supplementary safeguards, or an applicable adequacy decision.

Contact us for information about the safeguards that apply to your data.

Security

Production connections use TLS to protect data in transit.

Stored connector secrets and Google refresh tokens use AES-256-GCM encryption under SECRETS_KEY.

Workspace permissions, signed sessions and access checks limit access to customer data.

No system can guarantee absolute security.

Your rights and policy changes

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability of your personal data.

You may object to processing based on legitimate interests and withdraw consent where it is used.

Contact the operator above, or your workspace controller for data they control.

We may verify your identity before responding and will respond within the applicable legal time limit.

You may complain to the Belgian Data Protection Authority or your competent local supervisory authority.

We notify you through the service or account email before material policy changes take effect.

We seek renewed consent before using Google data for any new purpose that requires it.

Belgian Data Protection Authority