Privacy Policy

Last updated October 20, 2026

This Privacy Policy explains what personal data SEOToole (the "Service") collects, why, and what you can do about it. The Service is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] ("we", "us"), who is responsible for your data. Contact: info@seotoole.com.

1. Data we collect

Account data. Your name, email address and password (stored only as a secure hash). If you turn them on, your two-factor authentication settings and passkeys.

Billing data. Payments are handled by Stripe. We do not see or store your full card number. We keep your Stripe customer ID, your plan, invoices and payment status.

Usage data. The tools you run and what you enter into them (for example keywords, domains and URLs), the results, your projects, token usage, and API/MCP tokens (stored only as a hash).

AI assistant data. Messages you send to SAM and its answers.

Google data. If you connect Google Search Console or Google Analytics: your Google account email, the access tokens Google gives us (stored encrypted), and the reports we read for the sites and properties you choose.

Technical data. IP address, browser type and time of requests in our server logs, plus the cookies listed below.

2. Why we use it

• to create and secure your account and run the Service (contract);
• to take payments and keep accounting records (contract and legal obligation);
• to prevent abuse and keep the Service secure (legitimate interest);
• to send service emails such as verification, password reset and billing notices (contract).

We do not sell your personal data and we do not use it for advertising.

3. Google user data

We use data from Google APIs only to show you your own Search Console and Analytics data inside the Service. We do not use it for advertising, do not sell it, and do not let people read it except when you ask us for support, for security reasons, or when the law requires it. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in the Service or at myaccount.google.com/permissions.

4. Who we share data with

We use these service providers, only as needed to run the Service:

• Stripe — payments and invoices;
• DataForSEO — SEO data; the keywords, domains and URLs you look up are sent to it;
• OpenRouter and the AI model provider it routes to — your SAM messages and the data SAM uses to answer;
• Google — Search Console and Analytics (if you connect them), and web fonts loaded on our pages;
• [HOSTING PROVIDER] — servers that host the Service and our email.

Some of these providers are in other countries, including the United States. Where required, transfers are protected by standard contractual clauses or similar safeguards. We may also share data if the law requires it, or with a buyer if our business is sold.

5. Cookies

We only use cookies needed to run the Service: a session cookie to keep you logged in, a security (CSRF) cookie, and a "remember me" cookie if you choose it. We do not use advertising or analytics cookies.

6. How long we keep data

• account, project and usage data: while your account is active;
• server logs: about 14 days;
• backups: about 14 days;
• billing records: as long as tax and accounting law requires.

When you ask us to delete your account, we delete or anonymise your data within 30 days, except billing records we must keep.

7. Security

We use encrypted connections (HTTPS), hashed passwords and API tokens, encrypted Google tokens, and access controls so that each team only sees its own data. No system is perfectly secure, but we work to protect your data and will tell you about a breach that affects you where the law requires it.

8. Your rights

Depending on where you live, you can ask to access, correct, export or delete your data, and to object to or restrict how we use it. Email info@seotoole.com. You can also complain to your local data protection authority.

9. Children

The Service is not meant for anyone under 16, and we do not knowingly collect their data.

10. Changes

We may update this policy. We will post the new version here with a new "last updated" date, and tell you about important changes by email or in the app.