Privacy Policy

Last updated: 25 October 2026

1. Who we are

SEO Web Data is an SEO auditing, monitoring and reporting tool. Customers ("you", "your account") add websites they own or are authorised to analyse, and the service crawls those sites, runs technical and on-page SEO checks, produces an SEO score, tracks keywords, rankings, backlinks and AI-search visibility, and — where you choose to connect them — pulls in data from your own Google Search Console, Google Analytics 4 and Google Business Profile accounts.

For the account, usage and technical data described below, the data controller is Cyber Investments Ltd (trading as Seo Web Data), company number 17510180, 6 Hill Rise, Seaford, United Kingdom, BN25 2UA, registered with the UK Information Commissioner's Office (ICO) under registration number ZC270114. For data that you or your clients put into or connect to the service about other people (see section 3), you or your agency decide why and how it is used, and we process it on your behalf.

2. The short version

• We collect what we need to run your account, bill you, crawl the sites you add, and show you reports.
• Google data you connect is read-only to us in practice, is used only to show you your own reports, is encrypted at rest, and is never sold or used for advertising. It is sent to an AI provider only if an owner or admin of your account turns that on, and it is never used to train AI models (sections 3.11 and 5).
• We only load Google Analytics on our own sites, and only remember an affiliate referral, after you click Accept in the cookie banner (sections 3.12 and 3.17).
• We do not sell personal data.
• You can disconnect any Google connection, delete a website, or delete your account whenever you like (sections 8 and 9).

3. Information we collect

3.1 Account and billing information

When you create an account we collect your name, email address, password (stored as a salted hash, never in plain text), your chosen plan, and the websites you add. If you turn on two-factor authentication, we store the authenticator secret (encrypted) and one-time backup codes (hashed).

Payments are handled by Stripe. Your card details are entered on Stripe's own pages and never reach our servers. We store the Stripe customer and subscription identifiers, your plan and billing status, and the invoice information Stripe sends us, so that we can show your plan and keep your subscription in sync. Stripe's use of your data is described in its own privacy policy.

3.2 Team members and client portal users

If you invite colleagues, we store their name, email address and role (owner, admin or member). If you are an agency and give your own clients a portal login, we store each client user's name and email address, which websites they can see, the portal settings you choose, and any notes they choose to leave for your team. Invitation emails are sent by us on your behalf. If you use a custom portal domain, we store the domain name and the DNS ownership-check record you set up.

3.3 Crawl data and website information

When you add a website and run a crawl, we fetch and store publicly-accessible pages of that website (page addresses, titles, headings, meta tags, links, images, structured data, response codes, and similar) purely to generate your SEO analysis, score and issue list. We do not store the full body text of pages — only a hash used to spot duplicate content. We respect each site's robots.txt and apply hard limits on crawl depth and page count. You confirm, by adding a website to your account, that you own it or are otherwise authorised to have it crawled and analysed.

We also make regular requests to the websites you add for the monitoring features you switch on — for example uptime, SSL certificate expiry, page-speed and Core Web Vitals checks — and keep the results (status, response time, scores) so you can see trends.

3.4 Keyword, ranking, backlink and competitor data

We store the keywords, prompts, competitor domains and locations you ask us to track, and the results: rankings, search-result snapshots, backlink lists, brand and social mentions, and estimated traffic. To produce this data we send the relevant keywords, domains, URLs and locations to third-party SEO data providers (for example DataForSEO) and to the search and AI engines you choose to track. These lookups relate to websites, brands and keywords, not to individuals. Some third-party data is publicly available information about other websites and, in the case of social mentions and reviews, may include the public name or handle of the person who posted (see 3.7).

3.5 Google Search Console (a feature you connect, for your own sites)

If you connect Google Search Console, we ask for a Google OAuth grant limited to the https://www.googleapis.com/auth/webmasters.readonly scope, plus openid and email (used only to show which Google account is connected). We never ask for write access to Search Console and cannot change your Search Console properties. We use the connection to pull search performance data — queries, pages, clicks, impressions, click-through rate, average position, countries, devices and search appearance — for the properties you select, store it so you can see history, and use it to show you reports and opportunities (for example pages with high impressions and a low click-through rate).

3.6 Google Analytics 4 (a feature you connect, for your own sites)

If you connect Google Analytics 4, we ask for a separate grant limited to https://www.googleapis.com/auth/analytics.readonly (plus openid and email for the same labelling purpose). This is a distinct connection from Search Console — you can connect either, both or neither, and they don't need to use the same Google login. We use it to pull aggregate usage data for the property you select — users, sessions, engaged sessions, engagement rate, conversions and events, with breakdowns by landing page, channel and device — and to show it alongside your Search Console data. We do not receive information that identifies individual visitors to your site.

3.7 Google Business Profile (a feature you connect, for your own locations)

If you connect Google Business Profile, we will ask for a third, separate grant using Google's https://www.googleapis.com/auth/business.manage scope (plus openid and email). Google offers only this single scope for Business Profile, and it technically permits editing as well as reading. SEO Web Data only reads: it does not edit your profile, reply to reviews or publish posts. Business Profile access also depends on Google approving our access to its Business Profile APIs. That approval is not in place yet, so the Business Profile feature is currently shown in the app as unavailable and no Business Profile permission is requested from anyone. This section describes how it will work once it is available, and we will update this policy before we request that permission.

For the locations you choose to link, we pull and store: the business name, address, phone number, website, opening hours, categories and photos; reviews (star rating, review text, date, the reviewer's display name as Google provides it, and your reply, if any); local posts; and profile performance figures (views, searches, and calls, direction requests and website clicks). We use them to show your profile details and rating trends, to flag unanswered or low-rated reviews, to compare your listing with your own website and reference details, and to show performance over time. Review data is personal data of the reviewers; we use it only to show you your own reviews and analysis of them.

3.8 Social mentions, review sources and directory checks

Where you use brand-mention, social-mention, review-monitoring or citation features, we look up publicly available pages and listings (for example web pages, public social posts and business directories) and store what we find: the page or post address, platform, title or excerpt, date, engagement counts where reported, and, for social posts, the public account name or handle. If you add a post or page to your link-building pipeline, we also store the prospect details you enter (for example a contact name, email address and your notes).

3.9 Files and data you upload or connect

• Server log files. If you upload web-server access logs, we read them once and store only aggregated results (counts by date, page path, bot and response status). We do not store the individual log lines or visitor IP addresses.
• CSV imports. Keyword and prospect lists you import are stored in your account.
• WordPress plugin. If you pair the SEO Web Data Fixes plugin, we store the site address, the pairing details, and the fixes you queue with their before and after values, so that you can review and revert changes. Nothing is changed on your site until you choose to apply it.
• Exports and reports. Files and reports you generate are stored temporarily so you can download them and, for scheduled reports, are emailed to the recipients you set.
• Core Web Vitals beacon. If you install our optional beacon script on your website, it sends page-performance timings for visits to that page to us. It does not use cookies and we do not store the visitor's IP address, user agent or the page's query string.

3.10 Integrations you set up: email, Slack, Teams, webhooks and API access

• Alerts and weekly digest emails are sent to the recipients you add (up to 25 per digest), who may not have accounts. We store their email addresses and unsubscribe status. Every digest includes an unsubscribe link.
• Slack and Microsoft Teams. We store the incoming-webhook URL you provide (encrypted) and the delivery status, and post the alerts and summaries you choose to that channel. If you use the /seo Slack commands, we store the Slack workspace and channel identifier that you link.
• Webhooks. We store your endpoint URL and signing secret, and send the event payloads you select to that endpoint.
• API and connector keys (including Looker Studio and Google Sheets connectors) and a log of API requests made with them — the time, endpoint and status, kept for a limited period.

3.11 AI features in your account

The AI features in the dashboard (for example title and meta-description suggestions, content ideas, prompt tracking and the AI SEO Assistant) are optional and run only when you use them. When you use one, we send a prompt to the AI provider configured for your account (which may be a provider you choose and supply your own API key for, such as OpenAI, Mistral AI, Anthropic or Google Gemini, or another supported provider). The prompt is built from data our own tools have collected — for example page titles, headings, keywords, crawl results, issues, changes between crawls, rank checks made by our own tools, search-engine update dates and backlink data from third-party providers — and the provider processes it on our behalf to write the answer. We store the request, the answer, usage counts and estimated cost. Any API key you supply is stored encrypted.

Data we receive from Google (Search Console, Analytics 4 and Business Profile) is not included in these prompts unless an owner or admin of your account turns on "Use Google data in AI answers" under Settings > AI Assistant. While it is off, the AI features do not answer questions about your Search Console or Analytics figures, or about your Business Profile, and where the dashboard explains a change in your traffic or a traffic alert it does so with fixed rules and templates inside the application, not with AI.

If it is turned on, then when you use an AI feature that needs them (for example the traffic explanation, the SEO Autopsy summary or the AI SEO Assistant), we include only the Google figures that answer needs — for example totals for the last 28 days and your top pages and queries, never a full export — in the prompt. They are sent only to:

• Mistral AI (Mistral AI SAS, France), which processes them on our behalf under a data processing agreement, with use of the data for model training switched off; or
• the AI provider whose API key your account has added, if you use your own key. That provider then processes the data under your own agreement with it.

If the provider serving your account is neither of these, Google data is not sent even when the setting is on. Analytics figures are aggregated and contain no individual visitors. Google data is never sent to Sera, our help assistant (3.16). You can turn the setting off at any time and it takes effect for the next AI request. We do not use Google user data to develop, improve or train generalised AI or machine-learning models, and we do not allow our AI providers to do so. Please do not type passwords or other sensitive personal information into AI features.

3.12 Website analytics (cookies on our own sites)

Like most websites, seowebdata.com and stats.seowebdata.com use Google Analytics (GA4) to understand how visitors use our own marketing site and dashboard — for example which pages are viewed, how long a session lasts, and general device and location information reported by Google Analytics. This is separate from the SEO data we produce about your websites; it is about visits to our sites.

These analytics cookies are only set with your consent. On first visit you will see a cookie banner; Google Analytics does not load until you click "Accept", and if you click "Reject" no analytics cookies are set. You can change your choice at any time using the "Cookie settings" link in the footer. We implement Google's Consent Mode, which signals your choice to Google's tags on every page load, consistent with Google's EU/UK user consent policy. We do not use advertising cookies or advertising features.

3.13 Contact form and support messages

When you use our contact form we receive your name, email address, subject, message, the time, and your IP address (used to deal with abuse). The message is delivered to our support mailbox by email, not stored in the website, and we keep it for as long as needed to handle your enquiry and any follow-up.

3.14 Technical and security data

We log IP address, browser or user-agent, timestamps and request paths for security purposes (for example rate-limiting login attempts and diagnosing errors), and use a session cookie (which also carries our CSRF protection) that the dashboard needs in order to work. These are strictly necessary and are not subject to the cookie banner.

3.15 Free domain tools (no account needed)

When you use a free tool at seowebdata.com/free-tools, we receive the domain, host name or web address you enter and the result of the check. To apply fair-use limits and block abuse, we store the tool used, the domain you entered, the time, and a keyed, one-way hash of your IP address (never the address itself). The tools do not use cookies and do not require an account. We delete these records after 30 days.

3.16 Sera, our AI assistant (the chat button on this site)

Sera is an AI assistant, not a person. Opening the chat stores nothing. When you send a message, we store the conversation (your messages and Sera's replies), the time of each message, which of our pages were used to answer, whether you rated a reply as helpful, and a keyed, one-way hash of your IP address (never the address itself), used to apply fair-use limits and block abuse. Your messages, together with extracts from our own help pages, are sent to our AI model provider to write each reply; that provider processes them on our behalf to produce the answer. The chat uses no cookies: your browser keeps a random conversation code in its local storage (for up to 7 days of inactivity) so the chat survives a page reload, and "Close" or "New chat" clears it. We use stored conversations only to answer you and to improve Sera's answers and our documentation, and we delete them automatically 90 days after the last message. If you press "Talk to a human" and choose to include the conversation, it is copied into the contact form in your own browser; nothing is sent until you submit the form. Please do not type passwords, payment card numbers or other sensitive personal details into the chat.

3.17 Our affiliate programme

If you are an affiliate. If you take part in our affiliate programme, we collect your name and email address, your account details, your referral code, the bank account or PayPal details you give us so that we can pay you, the date you accepted the affiliate terms, and records of the clicks, sign-ups and commission linked to your referral link. We use this to run the programme, calculate and pay commission, check for self-referral and misuse, keep tax and accounting records, and contact you about your account, payouts and a monthly summary of your activity. Payout details are visible only to you and to our staff.

If you arrive through an affiliate's link. If you reach us through an affiliate's referral link and you click Accept in the cookie banner, we store a cookie (sw_ref) containing the affiliate's referral code, for up to 60 days. If you then sign up, we record which affiliate referred you so that they can be credited. The affiliate is told only how many people signed up and the commission earned, not your name or details. We count the click on the link, but we do not store your IP address or device details with it. If you click Reject, no referral cookie is set and no referral is recorded.

4. How we use information, and our legal bases

We use the information above to: provide, secure and support the service you asked for (contract); take payment and keep billing records (contract and legal obligation); send service emails such as invitations, alerts, digests and reports you have set up (contract or legitimate interests); prevent abuse and keep the service secure (legitimate interests); improve our documentation and product using our own analytics and Sera conversations (consent for analytics cookies, otherwise legitimate interests); run our affiliate programme and pay commission (contract, with legitimate interests in preventing fraud and abuse of the programme, and a legal obligation to keep accounting records; the referral cookie is set only with your consent); and comply with the law. Where we rely on your consent, you can withdraw it at any time.

5. Google API Services — Limited Use disclosure

SEO Web Data's use and transfer to any other app of information received from Google APIs (Search Console, Analytics 4 and Business Profile) adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice this means:

• We only use Google data to provide and improve the user-facing SEO, analytics and local-search reporting features you can see in your dashboard.
• We do not sell Google user data.
• We do not use Google data for advertising, including retargeting, personalised or interest-based advertising.
• We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
• We send Google user data to an AI provider only after an owner or admin of your account has turned on "Use Google data in AI answers", only to produce the AI answers you ask for in your dashboard, and only to Mistral AI or to the provider of your own API key (see 3.11). You can withdraw this at any time.
• We do not transfer Google data to third parties except as needed to provide the features you use (for example our hosting and database providers, and the AI provider described above if you turn that on), to comply with the law, or as part of a merger or sale of the business with notice to you.
• We do not allow people to read Google data except with your consent, to investigate a support issue you raise, to comply with the law, or to protect against fraud or security threats.

Google data at a glance

Connection	Scope requested	What we read	Why
Search Console	webmasters.readonly	Queries, pages, clicks, impressions, CTR, position, country, device, search appearance	Search performance reports and opportunities
Analytics 4	analytics.readonly	Aggregate users, sessions, engagement, conversions, events, landing pages, channels	Traffic reports alongside Search Console
Business Profile	Not requested yet. Planned: business.manage (read only in practice)	Location details, reviews, posts, performance figures	Local profile, review monitoring and local performance reports
All three	openid, email	The Google account's email address	To show which Google account is connected

6. Data storage and security

OAuth tokens for Google Search Console, Google Analytics 4 and Google Business Profile, AI provider API keys and Slack or Teams webhook URLs are encrypted at rest (AES-256-GCM) and are decrypted only at the moment they are needed to make the request. Passwords are hashed, not stored reversibly. Every account's data is kept separate from other accounts, and all traffic to and from the dashboard is served over HTTPS. We offer optional two-factor authentication. No system is perfectly secure, but we take reasonable steps to protect your information.

7. Who we share information with

We do not sell personal data. We share it only with service providers who process it on our behalf, and only as needed:

• Google — the APIs you connect, and Google Analytics on our own sites if you accept analytics cookies.
• Stripe — payment processing and subscription billing.
• Our bank and PayPal — to pay commission to affiliates, using the payout details they give us.
• Hosting, database and email-delivery providers — to run the service and send its emails.
• AI model providers — for the AI features and Sera (sections 3.11 and 3.16). They receive data obtained from Google only if your account turns that on, and then only Mistral AI or the provider of your own API key (section 3.11). Sera never receives it.
• SEO data providers — for rankings, backlinks and traffic estimates (section 3.4).
• Slack, Microsoft Teams and any webhook endpoint you configure — if you switch those integrations on.

We may also disclose information where the law requires it, to protect our users or the service, or in connection with a merger, acquisition or sale of the business (with notice to you).

8. How long we keep data

We keep account, crawl, ranking, Google and report data while your account is active so that your SEO history remains available. Detailed data types are kept for a period set by your plan and then automatically deleted; some are first summarised into compact totals. You can see the retention windows that apply to your account in your dashboard settings. If you delete a website from your account, its crawl history is deleted. If you delete your account (Settings, Privacy & your data), we delete your account data and disconnect any Google integrations straight away, except where we must retain limited records for legal, security or accounting reasons. Backups made before the deletion are overwritten within 35 days. Aggregated log-analysis data can be cleared at any time from the website's log-analysis page. Usage records from the free domain tools are deleted after 30 days. Conversations with Sera are deleted 90 days after their last message. Generated export files are deleted shortly after creation, and API request logs are kept for a limited period. Affiliate and payout records are kept while the affiliate takes part and for six years afterwards, for tax and accounting purposes.

Google data. You can disconnect Search Console, Analytics 4 or Business Profile at any time from your dashboard, which deletes the stored token and stops all further access; you can also revoke SEO Web Data's access directly at myaccount.google.com/permissions. To have previously synced Google data deleted, remove the website or account, or contact us and we will delete it.

9. Your rights and choices

Depending on where you're located (for example under the UK or EU GDPR or US state privacy laws such as the CCPA/CPRA), you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. You can do most of this directly in your account (edit details, download a copy of your personal data, export your SEO data, disconnect integrations, delete websites or your account), or by writing to us through our contact page. You can unsubscribe from any digest with the link in the email. If you are in the UK or EU and are unhappy with how we handle your data, you also have the right to complain to your data protection authority, such as the UK Information Commissioner's Office (ico.org.uk). Our ICO registration number is ZC270114.

10. Agencies and their clients

If you use SEO Web Data to manage other businesses' websites or give clients a portal login, you are responsible for having the right to add their websites and data, for telling them how their data is used, and for the client users you invite. In respect of that client data we act as your processor and handle it only on your instructions and as described in this policy.

11. Cookies and local storage summary

The full list, with names and lifetimes, is in our Cookie Policy.

• Strictly necessary — a session cookie on stats.seowebdata.com, which also provides CSRF protection. Always on; the dashboard cannot function without it.
• Preference — a small localStorage entry recording your cookie-banner choice, so we don't ask again for 180 days.
• AI assistant — if you use the Sera chat, small localStorage/sessionStorage entries holding the random conversation code (up to 7 days of inactivity), whether you have opened the chat before, and the chat's settings for your current visit. These are not cookies and are never used for tracking or advertising.
• Affiliate referral — if you arrive through an affiliate's link on stats.seowebdata.com and click Accept, a first-party cookie (sw_ref) holds the affiliate's referral code for up to 60 days so they can be credited if you sign up. Not set if you click Reject.
• Analytics — Google Analytics (GA4) cookies on seowebdata.com and stats.seowebdata.com. Set only after you click Accept in the cookie banner; governed by Google Consent Mode.

12. International data transfers

Google, Stripe, our AI and data providers and our hosting providers may process data outside your country. Where applicable, transfers are covered by the providers' own data-processing terms and safeguards, such as Standard Contractual Clauses or the UK International Data Transfer Addendum.

13. Children's privacy

SEO Web Data is a business tool and is not directed at, or intended for use by, children. We do not knowingly collect personal data from children.

14. Changes to this policy

We'll update the "Last updated" date above when this policy changes, and for material changes we'll provide a more prominent notice (for example a dashboard banner or email).

15. Contact us

Questions about this policy or your data can be sent to us through our contact page, or by post to Cyber Investments Ltd t/a Seo Web Data, 6 Hill Rise, Seaford, United Kingdom, BN25 2UA.