Privacy Policy

1. Introduction and Acceptance

This Privacy Policy ("Policy") governs the collection, use, storage, processing, and disclosure of personal information by SimplSEO ("we," "us," "our," or the "Company") through our web application, website, and related services (collectively, the "Service"). By accessing or using our Service, you ("User," "you," or "your") acknowledge that you have read, understood, and agree to be bound by this Policy in its entirety.

IMPORTANT: You must explicitly agree to this Privacy Policy during the onboarding process before you can access or use our Service. Your continued use of the Service constitutes ongoing acceptance of this Policy and any updates thereto.

If you do not agree with any provision of this Policy, you must immediately cease using the Service and delete your account. Disagreement with this Policy after account creation does not exempt you from the terms you previously accepted.

2. Definitions

For the purposes of this Policy, the following definitions shall apply:

• "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
• "Processing" means any operation or set of operations performed on Personal Information, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.
• "Google Search Console Data" means search performance data, including but not limited to keywords, search queries, page URLs, click-through rates, impressions, and average position rankings obtained through Google's Search Console API.
• "AI-Generated Content" means any content, suggestions, recommendations, or outputs produced by our artificial intelligence systems based on your data.
• "Training Data" means anonymized and aggregated data derived from user interactions used to improve our AI models and services.

3. Information We Collect

3.1 Account and Authentication Information

When you create an account or authenticate with our Service, we collect:

• Email Address: Collected through direct registration or Google OAuth authentication. Used for account identification, authentication, communication, and password recovery.
• Firebase User ID: A unique identifier assigned by Firebase Authentication to identify your account across our systems.
• Google OAuth Tokens: Access tokens and refresh tokens obtained through Google OAuth 2.0 authentication, used exclusively to access Google Search Console data on your behalf.
• Authentication Timestamps: Records of when you log in, log out, and authenticate with third-party services.

3.2 Business and Onboarding Information

During the onboarding process, we collect:

• Business Name: The name of your business or organization.
• Website URL: The primary URL of the website you wish to analyze and optimize.
• Business Type/Industry: The category or industry classification of your business (e.g., "Restaurant," "Law Firm," "E-commerce").
• Business Location: Geographic location information including city, state/province, and country.
• Google Search Console Property: The specific GSC property you authorize us to access.
• User First Name: Your first name for personalization of communications and the AI assistant.
• Onboarding Completion Status: Whether you have completed the onboarding process.

3.3 Google Search Console Data

With your explicit authorization via Google OAuth, we access and store the following data from your Google Search Console account:

• Search Queries/Keywords: The search terms users enter in Google that result in impressions or clicks to your website.
• Page URLs: The specific pages on your website that appear in search results.
• Impressions: The number of times your pages appeared in search results.
• Clicks: The number of times users clicked through to your website from search results.
• Click-Through Rate (CTR): The percentage of impressions that resulted in clicks.
• Average Position: The average ranking position of your pages in search results.
• Date-Based Performance Metrics: Historical performance data typically spanning the last 28 days.

Note: We only request read-only access to your Google Search Console data. We cannot modify, delete, or submit data to your Google Search Console account.

3.4 User-Generated Content and Interactions

We collect information you provide through your use of the Service:

• Focus Keywords: Keywords you select or designate for optimization tracking.
• Implemented SEO Tips: Records of which SEO recommendations you mark as implemented, including timestamps.
• Content Opportunities: Keywords and page opportunities you mark as "created" for tracking purposes.
• Chat Conversations: Messages you send to our AI SEO assistant, including questions, requests, and feedback.
• Intent Mismatch Analyses: Results of AI analyses comparing your page content with user search intent.
• Meta Title/Description Preferences: AI-generated meta titles and descriptions you accept or modify.

3.5 Automatically Collected Technical Information

We automatically collect certain information when you access or use the Service:

• Device Information: Browser type, operating system, and device identifiers.
• Usage Data: Pages visited, features used, time spent on pages, and navigation patterns.
• Log Data: Server logs including IP addresses, access times, and referring URLs.
• Local Storage Data: Information stored in your browser's local storage for session management and user preferences.

4. How We Use Your Information

4.1 Primary Service Purposes

• SEO Analysis and Recommendations: Processing your GSC data to identify optimization opportunities, track keyword rankings, and generate actionable SEO recommendations.
• AI-Powered Assistance: Using relevant website observations, saved account evidence, business details, and conversation context to generate personalized SEO guidance.
• Performance Tracking: Monitoring changes in your search performance over time and alerting you to significant changes.
• Content Optimization: Generating and suggesting improvements to meta titles, descriptions, and content based on search intent analysis.
• Page Updates: Providing in-app notices about saved result comparisons, published-page check-ins, verified technical concerns, and Google reconnection needs. If you opt in, we send a roundup to your verified sign-in email when new updates are available. These notices do not imply SEO success or that an edit caused a change.

4.2 Service Improvement

• AI Model Training: Using anonymized and aggregated data to improve our AI models' accuracy and relevance.
• Feature Development: Analyzing usage patterns to develop new features and improve existing functionality.
• Quality Assurance: Testing and debugging to ensure Service reliability and security.

4.3 Communication

• Service-Related Communications: Account verification, security alerts, and important service updates.
• Performance Notifications: Alerts when your pages start ranking or achieve significant milestones.
• Support: Responding to your inquiries and providing technical assistance.

5. Data Storage and Security

5.1 Storage Infrastructure

Your data is stored using the following services and technologies:

• Firebase/Firestore: Cloud-hosted NoSQL database provided by Google for storing user data, onboarding information, and application state.
• Firebase Authentication: Secure authentication service managing user credentials and OAuth tokens.
• Vercel: Cloud platform hosting our application with built-in security features.

5.2 Security Measures

We implement the following security measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL protocols.
• Encryption at Rest: Data stored in our databases is encrypted using industry-standard encryption algorithms.
• Access Controls: Strict Firestore security rules ensure users can only access their own data.
• User ID Hashing: For training and analytics purposes, user IDs are hashed using SHA-256 encryption before storage.
• Token Security: OAuth tokens are stored securely and refreshed automatically to maintain security.
• Environment Variables: Sensitive configuration data (API keys, secrets) are stored as encrypted environment variables, never in code.

5.3 Data Retention

We retain your data according to the following policies:

• Active Account Data: Retained for the duration of your account's existence.
• GSC Performance Data: Cached data is refreshed regularly; historical snapshots may be retained for trend analysis.
• Training Data: Anonymized training data may be retained indefinitely to improve our AI models.
• Mentor Conversations: Your messages and saved replies are stored so you can return to a conversation in the chat widget or SEO Mentor. Saving a conversation does not automatically train a model.
• Deleted Account Data: Upon account deletion, we will delete your Personal Information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., anonymized training data).

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We share data with the following categories of service providers:

• Google (Firebase, Google Cloud): Authentication, database hosting, and cloud infrastructure.
• Google Search Console API: To fetch your search performance data with your authorization.
• OpenAI: AI language model provider for generating SEO recommendations and powering our AI assistant. Your data may be processed by OpenAI's systems to generate responses.
• Vercel: Application hosting and deployment.
• Resend: For optional page-update emails, we send your verified recipient address and a short summary with page names, dates, and links. We do not include private search-query tables or chat content. Open and click tracking are disabled for these emails. Delivery, bounce, and complaint records help prevent duplicate or unwanted mail. Existing contact and access-request messages use our separate email service.

6.2 What We Do NOT Share

• We do not sell your Personal Information to third parties.
• We do not share your raw GSC data with other users or competitors.
• We do not provide access to your account credentials to any third party.
• We do not share your business-specific information with marketing or advertising networks.

6.3 Legal Disclosure

We may disclose your information if required by law, including:

• In response to valid legal process (subpoenas, court orders, government requests).
• To protect our rights, property, or safety, or that of our users or the public.
• To investigate potential violations of our Terms of Service.
• In connection with a merger, acquisition, or sale of assets (with prior notice to users).

7. AI and Machine Learning

7.1 How We Use AI

Our Service uses artificial intelligence and machine learning in the following ways:

• Personalized AI Assistant: The mentor uses relevant saved business information, website content, search observations, and conversation history as context when answering your questions. It does not create or automatically train a separate model for your business.
• Content Analysis: AI analyzes your page content to detect intent mismatches with search queries.
• Meta Content Generation: AI generates suggested meta titles and descriptions optimized for your target keywords.
• Keyword Classification: AI identifies generic vs. branded keywords and categorizes opportunities.

7.2 Mentor Conversations, Evidence, and Usage

The personalized mentor processes and stores the following information to answer questions and preserve your work:

• Saved Conversations: Your submitted messages, replies, and supporting references are stored with your account. New mentor conversations are not copied into separate training-event logs.
• Account Evidence: Relevant confirmed business details, website excerpts, dated search observations, and saved recommendations may be included in requests to OpenAI to answer your question.
• Operational Usage: Separate accounting records track model usage, estimated costs, timing, and request outcomes. These records exclude conversation message text.
• Public Documentation Research: When needed, the mentor searches official Google documentation using generic SEO topic terms. These public searches do not include your raw conversation, private Search Console queries or metrics, credentials, or unconfirmed business details.

Personalization and saved history do not automatically train a model or change your confirmed business profile. This mentor update does not itself remove records retained by earlier features; existing records remain subject to the retention and deletion provisions in this Policy.

7.3 Third-Party AI Processing

Our AI features are powered by OpenAI's language models. When you use AI features, your data (including business context, page content, and queries) may be sent to OpenAI for processing. OpenAI's data usage is governed by their privacy policy and API terms of service. We do not send your GSC authentication credentials or tokens to OpenAI.

8. Your Rights and Choices

8.1 Access and Portability

You have the right to:

• Access the Personal Information we hold about you.
• Request a copy of your data in a portable format.
• View your GSC data and analysis results through the dashboard.

8.2 Correction and Deletion

You have the right to:

• Correct inaccurate Personal Information through account settings.
• Delete your account and associated data through the Settings page.
• Request deletion of specific data by contacting us.

8.3 Consent Withdrawal

You may:

• Revoke Google Search Console access at any time through your Google Account settings.
• Opt out of notification emails through account settings.
• Delete your account to cease all data processing.

Note: Withdrawing consent may limit or prevent your ability to use certain features of the Service.

8.4 Account Deletion

You can delete your account at any time through the Settings page. Upon deletion:

• Your account credentials and associated Personal Information (GSC data, SEO analyses, chat history, etc.) will be deleted immediately.
• Anonymized training data may be retained as it cannot be linked back to you.
• Cached data and logs will be purged according to our retention schedules.
• Limited Retention for Product Improvement: We may retain your email address and basic account information (such as your website URL) for up to 90 days after deletion. This allows us to follow up for feedback to improve our service. This information is not used for marketing and will be permanently deleted after this period.
• This action is irreversible regarding your account access and primary data.

9. Consent Requirement for Service Use

BY USING OUR SERVICE, YOU EXPLICITLY CONSENT TO:

• The collection and processing of all data described in this Policy.
• The use of your data for AI processing, saved conversations, and usage accounting as described in Section 7.
• The sharing of your data with third-party service providers as described in Section 6.
• The storage of your data using the infrastructure described in Section 5.
• Receiving service-related communications at the email address associated with your account.

Mandatory Agreement: During onboarding, you will be required to explicitly acknowledge and accept this Privacy Policy before proceeding. You cannot use the Service without this acceptance. This consent is a condition of using our Service.

10. International Data Transfers

Your data may be transferred to, stored, and processed in countries other than your country of residence, including the United States. By using our Service, you consent to the transfer of your data to countries that may have different data protection laws than your jurisdiction. We ensure appropriate safeguards are in place for such transfers.

11. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect Personal Information from children. If you believe we have collected information from a child, please contact us immediately, and we will take steps to delete such information.

12. Changes to This Policy

We reserve the right to modify this Privacy Policy at any time. Material changes will be communicated via email or prominent notice within the Service. Your continued use of the Service after such modifications constitutes acceptance of the updated Policy. We encourage you to review this Policy periodically.

13. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your Personal Information, please contact us at:

We will respond to your inquiry within 30 days.

14. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the United States, without regard to its conflict of law provisions. Any disputes arising from this Policy shall be resolved in the courts of competent jurisdiction.