Privacy Policy

What we collect

We only collect data needed to run AutoSEOPilot. Here’s the full list:

• Account info — your name, email address, and a hashed password (or, if you sign in with Google, the basic profile Google shares with us). We never see your Google password.
• Workspace & website data — workspace name, your site URL, and the page data we crawl (titles, headings, body text, URLs, internal links, and health/coverage signals).
• Competitor data — competitor URLs you submit for analysis.
• Search and measurement data — search queries, URLs, and request parameters sent to DataForSEO, the SERP, keyword, competitor, and AI/search evidence returned for your workspace, and Google Search Console performance data when you connect it.
• CMS & Search Console credentials — connection settings, API keys / webhooks, and OAuth tokens for your CMS and Google Search Console. We request the minimum scopes we need (Search Console access is read-only) so we can publish drafts to your CMS and read your search-performance data.
• Content — drafts, edits, and published content generated through the service.
• Usage data — how you interact with the service, collected in production through PostHog product analytics, session replay, and heatmaps. Our replay configuration masks input fields, page text, and element attributes.
• Payment data — Polar is our merchant of record and handles all card details directly. We never see or store your card number.

How we use it

• To run AutoSEOPilot — crawling your site, sending necessary search queries, URLs, and request parameters to DataForSEO for SERP, keyword, competitor, and AI/search research, generating and publishing content, and showing Google Search Console performance with supporting search evidence.
• To generate drafts — sending site content, product and brand context, and approved research evidence to the Vercel AI Gateway, which routes requests to configured AI model providers.
• To operate your account — authentication, billing (through Polar), and support.
• To communicate with you — service updates, billing notices, material policy changes, and other lifecycle or workspace-service messages described below.
• To prevent abuse — detecting unauthorized access, spam, or fraud.

We never sell your data. We never use it to build advertising profiles.

When email delivery is configured, service emails may include welcome and account-setup messages, password-reset messages, payment-failed and other billing notices, account-deletion verification and completion messages, analysis-complete alerts, draft-ready-for-review alerts, publish-complete alerts, publish-failed alerts, measurement-ready/outcomes-ready alerts, weekly program digests, and business-profile update notices. Email delivery may be disabled; when it is disabled, no email is delivered by AutoSEOPilot.

AI content generation

To draft content, we send your site content, product and brand context, and approved keyword/SERP or other research evidence to the Vercel AI Gateway. The gateway routes requests to configured AI model providers, which process the prompts and return model outputs under the applicable gateway and provider terms.

Model-training use is governed by the AI providers’ own API terms. Retention and training practices for data sent through that path are governed by the applicable provider/API terms. We do not knowingly use your content to train AI models ourselves.

Generated content is stored in our database and in Cloudflare R2 object storage so you can access, edit, and publish it.

Who we share your data with

We use a small set of trusted services (subprocessors) to run AutoSEOPilot. Each one handles specific data:

• Polar — merchant of record for billing. Processes purchases, subscriptions, invoices, cancellations, and refunds on our behalf, and stores your card details. We never touch them.
• DataForSEO — external search research. We send search queries, URLs, and request parameters and receive SERP, keyword, competitor, and AI/search evidence back.
• Vercel AI Gateway — AI request routing. It receives site content, product and brand context, and approved research evidence as prompts and routes them to configured model providers, which return generated outputs.
• Cloudflare (R2) — object storage for generated content artifacts.
• PostHog — production product analytics, session replay, and heatmaps, hosted in the EU (eu.posthog.com). Our configuration masks input fields, page text, and element attributes in replays. We do not show a separate analytics consent banner.
• Google — sign-in (OAuth) and read-only Google Search Console data. We receive your email and basic profile and your search-performance data; Google does not receive your site content.
• Hetzner (via Coolify) — the servers and database that host AutoSEOPilot and store your data, provided through Coolify Cloud on Hetzner infrastructure in the European Union (Germany).
• Plunk — transactional email. When email delivery is enabled and Plunk is configured, applicable service emails are sent through Plunk. It receives the recipient’s email address and the rendered message body. Email delivery is optional and may be disabled.

We do not use ad networks or data brokers for the service, and we do not sell your data.

Cookies

We use a strictly necessary cookie to keep you logged in (session authentication).

We also use PostHog for product analytics, session replay, and heatmaps in production. PostHog sets first-party cookies to understand how you use the product so we can improve it. Replays mask input fields, page text, and element attributes. PostHog is hosted in the EU (eu.posthog.com), and we do not show a separate analytics consent banner.

No marketing cookies. No tracking pixels. No ad networks.

Data storage & security

Your data is stored with our infrastructure providers, located in the United States and the European Union. All data is encrypted in transit (TLS) and encrypted at rest where supported by our providers.

We take reasonable security measures to protect your information, including access controls, encrypted communications, and regular reviews of who has access to production systems.

Your rights

You can contact us about the following by emailing [email protected]:

• Access — get information about the data we hold about you, subject to applicable law and verification.
• Correction — fix inaccurate information.
• Deletion — request account deletion, subject to confirmation and the checks described in “Data retention” below.
• Content export — use supported content export options where available. These are content exports; we do not currently provide a complete account-level export of every workspace, billing, analytics, connection, or internal artifact record.
• Disconnect a connection — disconnect a CMS or Google Search Console connection. We delete the stored local connection credentials from AutoSEOPilot; disconnecting does not by itself revoke authorization held by the external provider.

Depending on where you live, applicable law may provide additional rights. We evaluate requests under the law that applies to you and may need to verify your identity.

Data retention

We keep your data while your account is active and for as long as needed to operate the service. Account deletion is separate from subscription cancellation and requires authentication and explicit confirmation. Depending on the sign-in method, an email confirmation may also be required.

Deletion is fail-closed and may remain pending until active subscriptions and checkouts are canceled or verified absent, applicable Google OAuth access is revoked, PostHog historical erasure is verified where enabled, and stored artifacts are purged and verified. If a required check cannot be verified, deletion does not complete. Once it completes, local account and workspace records, stored connection credentials, and workspace artifacts are removed through the deletion process. Published content already sent to your CMS remains there.

Disconnecting an individual CMS or Search Console connection deletes the connection’s stored local credentials from AutoSEOPilot, but does not by itself revoke authorization held by the external provider. Account deletion attempts and verifies applicable Google OAuth revocation. We do not promise instant deletion or a universal backup-deletion deadline. Polar payment records and records held by Google, PostHog, DataForSEO, the AI Gateway or model providers, and the email provider may be retained under their own terms and applicable legal, tax, or compliance obligations.

International data transfers

Ideaplexa LLC is a US-based company. If you use AutoSEOPilot from outside the US, your data may be transferred to and processed in the United States or the European Union. We use standard contractual clauses or equivalent safeguards to protect your data during these transfers.

Children’s privacy

AutoSEOPilot is not directed at children under 16. We do not knowingly collect personal data from children under 16. If we become aware that we have, we’ll delete it promptly.

Changes to this policy

We may update this policy from time to time. For material changes, we’ll notify you by email before they take effect. The latest version will always be available on this page.

Contact

Questions about this policy or your data? Reach us at [email protected].

AutoSEOPilot is operated by Ideaplexa LLC, a Wyoming limited liability company, USA.