Privacy Policy

SEO Agent ("we", "the Service") is an SEO automation tool for small and medium businesses. It researches keywords, writes content, publishes it to the customer's own website, and reports on the results. This document explains what we collect, how we use it, and what your rights are. It is the English version of our Hebrew policy and describes the same practices.

1. Information we collect

• Account details: name, email address, hashed password.
• Site data: Google Search Console and Google Analytics data, only for accounts you connected yourself. See section 9.
• Generated content: the articles and content the system produces for you.
• Payment data: processed by PayPlus. We never store card numbers.
• Logs: IP address, browser type, pages viewed, for security and product improvement.
• Cookies: a session cookie only (HttpOnly, Secure). No advertising cookies.
• Pages on your own website: we read your public pages to find SEO defects, and we snapshot the SEO elements of a page (title, description, canonical, schema markup, not the body text) before any change you approve.
• Email opens and clicks: some service emails include a 1x1 tracking pixel and links routed through our server, so we can tell whether the message was opened or clicked. This is never used for advertising and is not shared.

2. How we use it

• To deliver the service: keyword research, content creation, article management.
• To improve the product and secure the system.
• To send service and transactional email (no marketing email without consent).
• To meet legal obligations.

3. Third parties

• Google LLC - for the Search Console, Analytics, Indexing and Google Ads connections you authorise (subject to Google's privacy policy).
• Anthropic PBC - the AI engine that generates content. Data is sent for processing and is not retained permanently by Anthropic.
• PayPlus - payment processing.
• Hetzner - server infrastructure and logs.

We do not sell, rent or share personal information with advertisers or data brokers.

4. Security

• HTTPS on all traffic.
• Passwords hashed with bcrypt (cost 12).
• OAuth credentials stored encrypted (AES-256-CBC).
• fail2ban, restricted access, logs retained for 12 months.

5. Retention

Account data is kept while the account is active. After account deletion, data is removed within 30 days, except records the law requires us to keep (up to 7 years for transaction records).

6. Your rights

• Access the information we hold about you.
• Correct inaccurate information.
• Delete your account and your data.
• Receive your data in a portable format.

Privacy requests: [email protected]

7. Cookies and email tracking

We use a session cookie only, to keep you signed in. We do not run Google Analytics, Meta Pixel or third-party advertising cookies on our own site. Separately, some emails we send contain an open pixel and click-tracked links, as described in section 1.

8. Changes

We will announce material changes by email 30 days in advance.

9. Google account data we access

When you connect a Google account, you grant us limited access to your data through Google's APIs. These are the permissions we request and why:

• Google Search Console (read) - the list of your verified sites and their search performance data (queries, impressions, clicks, average position, landing pages), so we can show which keywords your site ranks for and where the gaps are.
• Google Search Console (write) - exactly one write operation is used: submitting a sitemap that already exists on your site, when we detect it was never submitted. We do not add, verify or delete sites.
• Google Analytics (read) - aggregate traffic data (visitors, pageviews, top pages), so we can show the effect of the content produced for you.
• Google Indexing API - requesting a recrawl of URLs we published on your own site, so new content is indexed sooner.
• Google Ads (read) - the search terms report of the ads account you connect (term, impressions, clicks, CTR, conversions, last 90 days) and the landing pages of its campaigns, so we can show which searches you already pay for and have no organic content answering. We never create, edit, pause or delete campaigns, ads, keywords, budgets or accounts, and we never write anything to the ads account.

How it is stored. OAuth tokens are stored encrypted (AES-256-CBC) and bound to your account only. The data we pull is stored in your own workspace and displayed to you in your own dashboard.

What we do not do. We do not sell Google user data, do not transfer it to advertisers or data brokers, do not use it for advertising, and do not use it to train AI models. Humans access it only with your explicit permission, for support you asked for, or where the law requires it.

Deletion and revoking access. You can disconnect any Google connection at any time from our settings screen, or revoke it directly at Google Account permissions. On disconnect we delete the tokens immediately and the pulled data within 30 days. Deleting your account deletes both.

10. Contact

Privacy questions: [email protected]
SEO Agent, Israel