Privacy Policy
We hold as little about you as the product can work with: an email address, the URLs and keywords you ask us to look at, and a ledger of credits. It lives on a server in Germany. Here is the whole picture.
01Who is responsible
For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the data controller for personal data processed through seofixagent.com is:
- Service
- SEO Fix Agent — seofixagent.com
- Contact
- [email protected]
SEO Fix Agent is currently operated under this trading name. Registered company details will be published in this block as soon as the entity is formed; until then all legal notices should be sent to the contact address above and will be answered from it.
We have not appointed a Data Protection Officer, because the scale and nature of our processing does not require one. Privacy questions are handled directly by the operator at the address above.
02The short version
- We collect your name, email, a hashed password, and what you ask the tools to do.
- Everything is stored in a SQLite database on a single server in Germany (Hetzner), inside the EU.
- We use three processors: Stripe for payments, Resend for transactional email, Cloudflare for delivery, security and the Turnstile challenge.
- We run no analytics, set no advertising or tracking cookies, and sell your data to nobody. There is nothing to sell — see the Cookie Policy.
- You can export or delete everything by asking us. We will not make it difficult.
03What we collect
Account data
- Name — as you enter it at sign-up. A nickname is fine.
- Email address — your login identifier and the only channel we use to reach you.
- Password — stored only as a salted cryptographic hash. We cannot recover or read it.
- Email verification and session records — verification status, session tokens and their expiry, created by our authentication layer.
Usage data — the things you ask the tools to do
- Audited URLs and their results — the address you submitted, the score and grade, and the full findings JSON, kept so your audit history and the prompt studio work.
- Keyword queries and saved keywords — the seed terms you search and any keywords you save to a list, with their estimated volume, difficulty and intent.
- Projects — the project names and domains you create as workspaces.
- Credit ledger — an append-only record of every credit granted and spent, with a reason and a timestamp, so your balance can be verified.
If you submit a URL that itself contains personal data — a profile page, a query string with a name or an email in it — that data will be stored with the audit record. Please do not submit URLs containing anything sensitive, and remember that audit results are saved to your history until you delete them.
Billing data
- Stripe customer ID, your current plan, and your subscription ID. That is all we keep on our side.
- Card details are never sent to or stored by us. Payment credentials, billing address and tax location are collected and held by Stripe on Stripe's own checkout pages.
Technical data
- IP address — used transiently for rate limiting, for the Turnstile verification call, and by Cloudflare for security. We take it from the
cf-connecting-ipheader. It is not stored in a user profile. - Server logs — standard request and error logs generated by the application process, which may briefly contain IP addresses, timestamps and requested paths.
- Strictly necessary cookies — the authentication session cookie and Cloudflare's security cookies, detailed in the Cookie Policy.
04What we do not collect
- No access to your website. There is nothing to install, no OAuth grant, no plugin, no DNS change, no CMS or repository credential. The audit engine only fetches pages that are already public, the way a search engine crawler does.
- No analytics or advertising. No Google Analytics, no pixels, no fingerprinting, no cross-site tracking, no ad networks.
- No payment card data. It goes straight to Stripe.
- No special category data. We do not ask for and have no use for health, biometric, political, religious or similar sensitive data. Please do not send it to us.
- No data brokerage. We do not buy, sell, rent or trade personal data, and we do not use your content to train machine learning models.
05Why we use it, and our legal basis
Under Article 6 GDPR every processing activity needs a legal basis. Ours are set out below.
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account, authenticate you, keep you signed in | You cannot use the Service without an account | Contract — Art. 6(1)(b) |
| Run audits and keyword searches, store their results and your projects | This is the Service you asked for | Contract — Art. 6(1)(b) |
| Maintain the credit ledger and process payments through Stripe | To meter usage and take payment | Contract — Art. 6(1)(b) |
| Send transactional email — verification, password reset, billing and service notices | Required to operate the account securely | Contract — Art. 6(1)(b) |
| Rate limiting, Turnstile challenges, abuse prevention, server logs | Keeping the Service and the sites you audit safe from abuse | Legitimate interests — Art. 6(1)(f) |
| Keeping invoice and tax records | Accounting and tax law require it | Legal obligation — Art. 6(1)(c) |
| Any future optional analytics or marketing email | Only if we ever add it, and only if you opt in | Consent — Art. 6(1)(a), withdrawable at any time |
Where we rely on legitimate interests, we have balanced them against your rights: the processing is limited to security and availability, uses the minimum data needed, and you can object at any time under section 10.
We do not currently send marketing email. If that changes you will be asked to opt in first, and every such message will carry a one-click unsubscribe link.
06Who else processes your data
We use a deliberately small set of sub-processors. Each is bound by a data processing agreement and may only act on our instructions.
| Processor | What it handles | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application server and the database | Germany (EU) |
| Stripe | Payment processing, checkout, customer portal, tax calculation, invoices, card data | EU / US, under Standard Contractual Clauses |
| Resend | Delivery of transactional email — verification, password reset, service notices | EU / US, under Standard Contractual Clauses |
| Cloudflare | DNS, CDN, TLS, WAF and the Turnstile human-verification challenge | Global edge network, under Standard Contractual Clauses |
Running a site audit also means our server makes a request to the third-party website you named. That request carries our own crawler user agent and our server's IP address — not yours. Your IP address is never disclosed to a site you audit.
We may disclose data if we are legally required to — a valid court order or a lawful request from an authority — or to establish or defend legal claims. If a business transfer ever happened, personal data would move with it and you would be told in advance, with a chance to delete your account first.
07Where your data is stored
The application and its SQLite database run on a single server hosted by Hetzner in Germany. Your account data, audit results, keywords, projects and credit ledger are processed and stored inside the European Union.
Some processors above operate globally. Where personal data is transferred outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses and, where applicable, by the EU-US Data Privacy Framework, together with the supplementary measures those providers publish.
08How long we keep it
| Data | Retention |
|---|---|
| Account record (name, email, password hash) | For as long as your account exists, then deleted within 30 days of a deletion request |
| Audit results, keyword lists, projects | Until you delete them, or until your account is deleted |
| Credit ledger | Kept while the account exists; entries tied to a payment are retained with the invoice record |
| Billing and invoice records | Up to 10 years, as required by EU and Bulgarian accounting and tax law |
| Session records | Until the session expires or you sign out |
| Server and security logs | Rotated continuously; retained no longer than 90 days |
When you ask us to delete your account we remove your personal data and your content. Financial records we are legally required to keep are retained for the statutory period and are not used for anything else.
09How we protect it
- All traffic is served over HTTPS; the origin sits behind Cloudflare's WAF.
- Passwords are stored only as salted hashes, never in plain text or reversibly.
- Every database query for account content is scoped to the owning user, so one account cannot read another's audits, keywords or projects.
- Sign-up, sign-in and password reset are protected by Cloudflare Turnstile, and requests are rate limited per user and per IP address.
- The audit engine validates every URL it fetches and refuses private or reserved network addresses at each redirect hop, so it cannot be used to reach internal systems.
- Access to the production server is restricted to the operator and uses key-based authentication.
No system is perfectly secure. If a personal data breach occurs and it is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform you without undue delay where the risk is high.
10Your rights under the GDPR
You have all of the following rights, free of charge:
- Access (Art. 15) — a copy of the personal data we hold about you and an explanation of how it is used.
- Rectification (Art. 16) — correction of anything inaccurate or incomplete.
- Erasure (Art. 17) — deletion of your account and content, subject only to records we must keep by law.
- Restriction (Art. 18) — ask us to pause processing while a dispute about accuracy or legitimacy is resolved.
- Portability (Art. 20) — your data in a structured, commonly used, machine-readable format. Audits, keyword lists and the credit ledger export as CSV or JSON.
- Objection (Art. 21) — object to processing based on legitimate interests, including abuse prevention, on grounds relating to your particular situation.
- Withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time, without affecting processing already carried out.
- Complain (Art. 77) — to a supervisory authority, as described below.
11Exercising your rights and complaining
How to make a request
- Email [email protected] from the address on your account, with “GDPR request” in the subject line.
- Tell us which right you are exercising and what outcome you want.
- We may ask a question to confirm it is really you — we will not ask for an identity document unless there is genuine doubt.
- We answer within one month. If a request is unusually complex we may extend by two further months and will tell you why within the first month.
Account deletion can also be requested from the same address and takes effect within 30 days.
Complaining to a supervisory authority
If you think we have handled your data wrongly, please tell us first — we would rather fix it. You also have the right to complain directly to a data protection supervisory authority, in particular:
- the authority in the EU or EEA country where you live or work, or where the issue occurred; or
- the Commission for Personal Data Protection of the Republic of Bulgaria (Комисия за защита на личните данни), our lead authority; or
- in the United Kingdom, the Information Commissioner's Office (ICO).
12Children
The Service is a professional tool and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, email [email protected] and we will delete it.
13Automated decisions and profiling
We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not profile you for marketing.
The audit engine and the keyword tools are automated, but they analyse web pages and search terms, not people. The scores they produce say something about a page, never about you.
14Changes to this policy
We update this policy when the Service changes or a new processor is added. The revision date at the top always reflects the current version. For material changes — a new processor, a new purpose, a new legal basis — we notify account holders by email at least 14 days before the change takes effect.
15Contact
Privacy questions, data requests and complaints go to [email protected] and are read by the operator, not by a ticket queue.