Privacy notice

This notice explains what personal data SEODash collects, why, who we share it with, how long we keep it, and your rights. It covers our website at seodash.com, the app at app.seodash.com, shared report and dashboard pages, our SEODash: SEO Checker browser extension, and the emails we send.

Who we are

SEODash is run by Blauer Digital Ltd, trading as SEODash, a company registered in England and Wales under company number 16749729. Our registered office is C/O Pollock Accounting Ltd, 3 - 4 Sentinel Square, London, United Kingdom, NW4 2EL. We are registered with the UK Information Commissioner's Office (ICO) as a data controller.

For anything about your personal data, email privacy@seodash.com . For everything else, email support@seodash.com .

The short version

• You sign in with Google. One Google sign-in is one SEODash account.
• With your permission, we read your Search Console and GA4 data to show it to you, to keep it past Google's 16-month limit, and to send the alerts and reports you set up.
• We do not sell your data, use it for advertising, or use your Google data to train AI models.
• We may share anonymized statistics about how customers use SEODash in talks and the press. They never come from your Google data, and they never identify you, anyone else or a property.
• AI features send property data, and anything you type into them, to Google's Gemini models. Google may process it in the United States.
• If another account connects the same property, it sees some of your settings for that property, but never who added them.
• If you delete your account, we delete your data after 30 days. We keep invoices for 6 years and tax records for 10 years because the law requires it.
• You can ask for a copy of your data, ask us to correct or delete it, and complain to us or to the ICO.

Our role: controller and processor

For your account, sign-in, billing, security, support and email data, and data about how you use SEODash, we decide how the data is used, so we are the controller.

For the Search Console and GA4 data of the properties you connect (we call it property data), and for the report recipients you add, we act as a processor for a business customer. The customer decides what to connect and who receives reports, and our Data Processing Addendum applies. If the property data is about your own clients or site visitors, your own privacy notice should tell them about it.

If you use SEODash for yourself rather than for a business, nobody else is the controller of that data, so we treat ourselves as its controller and this notice covers it.

Search Console data can contain personal data: search queries and page addresses sometimes include names or other details. We treat it as personal data, never as anonymous.

What we collect and why

Account and sign-in

When you sign in with Google we receive your Google account ID, email address, name, profile picture and language setting. We use them to create and run your account, recognize you when you come back, and contact you about the service. Lawful basis: contract.

Sessions and security

When you use the app we record your session: a random device ID stored in your browser, your browser type, your country, when you were last active, and a keyed hash of the network part of your IP address. We do not store your full IP address. We use this to limit how many devices can be signed in at once (one, plus one for each seat you buy), to spot misused accounts, and to keep the service secure.

When you sign in, Cloudflare Turnstile checks that you are a person. Your IP address is sent to Cloudflare for that check and we do not store it.

Lawful basis: legitimate interests (keeping the service and your account secure, and preventing fraud).

Google connections

When you connect Google, we store the permissions you granted and your Google access and refresh tokens, encrypted with AES-256-GCM. We use them only to read your data and to take the actions you ask for. Lawful basis: contract.

We ask Google for these permissions:

• Search Console, read: your properties, search performance, URL inspection and sitemap data.
• Google Analytics, read: reports for your GA4 properties.
• Search Console, manage: to add a property or submit a sitemap, only when you ask.
• Site Verification: to verify a domain you ask us to add.
• Your basic profile and email address, to sign you in.

Google lets you decline any of these. A feature that needs a permission you declined asks for it when you use it.

Search Console and GA4 data

For each property you connect we collect search queries, pages, countries, devices, dates, clicks, impressions, click-through rate and average position, URL inspection and sitemap results, and GA4 reports such as landing pages, channels, sessions, key events, revenue and ad cost. GA4 data comes as aggregated reports. We do not collect data about individual site visitors.

We use it to show your dashboards, alerts, reports and recommendations, and to keep an archive past Google's 16-month window. Lawful basis: we process it on behalf of the business customer who connected it; for a consumer, contract.

Content you create

Saved views, annotations, tags, clusters and groups, brand terms, experiments, alert and notification settings, report schedules, report branding, API keys, webhooks and your project start date. Lawful basis: contract. Some of these are shared with other accounts that connect the same property: see Shared property settings .

Reports, links and report recipients

If you schedule a report, we store the email addresses you send it to and send the report to them. You must have the right to send reports to the people you add. A recipient can ask us to stop at support@seodash.com .

If you create a share link or a public report, anyone with the link can see it. We store only a hash of the link, and you can revoke it at any time.

AI features

See AI features below.

Research data and AI Visibility

When you look up keywords, domains or search results, we send the keywords and domains to DataForSEO, which returns search volumes and rankings.

AI Visibility is off until you switch it on for a property. When you do, we suggest prompts based on that property's own search queries, and we send the prompts you keep, with your brand and competitor names, to DataForSEO. DataForSEO asks ChatGPT, Gemini, Google AI Mode and AI Overviews on our behalf and returns their answers and citations. Lawful basis: contract, and your instruction when you switch the feature on.

Page Memory

Once a week we load your public pages and record facts about them: the title, headings, canonical tag, robots tag, word count, structured data types and a fingerprint of the content. We do not store copies of the pages. Lawful basis: contract.

Emails

We send service emails: sign-in and security notices, alerts, scheduled reports, and billing and trial messages. They are part of the service. You can turn alerts and reports off in your settings.

We send product news only to customers who have not opted out, and every such email has an unsubscribe link. We keep a list of addresses that unsubscribed so we do not email them again. Lawful basis: contract for service emails; legitimate interests, or your consent where the law requires it, for product news.

Support

When you email us or use the contact form, we keep your messages and the details you give us so we can answer. Lawful basis: contract and legitimate interests. Our team looks at the data in your account only if you ask us to, for the property you name, or in the other cases listed under Google user data .

Billing and tax

Stripe takes your payment. We receive your name, email address, billing address, the country of your card, your subscription status and, if you are a business, your VAT number. We never see or store your full card number.

We keep invoices and accounting records, and the evidence we use to work out where you are for VAT (billing address, card country, IP country and any VAT number check), for as long as tax law requires, even after your account is deleted. Lawful basis: contract and legal obligation.

Free trial and abuse controls

To give each person one free trial and to stop people farming trials, we keep:

• a keyed hash of the email address of a deleted account, so the same Google identity does not get a second trial straight away;
• a record of each property connected during a trial, with a keyed hash of the Google account that connected it;
• a keyed hash of email addresses we have banned for abuse.

A keyed hash is a one-way code made with a secret key (a pepper). It cannot be turned back into an email address without that key, but it is still personal data. A nightly check flags a property connected by several trial accounts so a person can review it. It never bans anyone automatically. Lawful basis: legitimate interests (preventing fraud and abuse of the free trial).

Error monitoring and logs

When something breaks, the app sends an error report to Sentry: what failed, the page path, and your browser and operating system, with personal details removed before it is sent. Our hosting provider keeps request logs for a short time. We use both to find and fix problems and to keep the service secure. Lawful basis: legitimate interests.

Aggregated insights

We may share what we learn about how customers use SEODash in talks, interviews and press releases, for example how many accounts set up an alert in their first week. We build these insights only from data about how accounts use SEODash itself: which features they use and how often, the settings they choose (such as how many alerts or scheduled reports they set up), and plan choices such as monthly or yearly billing.

They never use Google user data. Nothing from your Search Console or GA4 properties goes into them, not even the list of properties you connect, and nothing worked out from that data, such as queries, pages, clicks, rankings, traffic or AI Visibility results. Google's Limited Use requirements do not allow that use, even when the data is aggregated or anonymized. We also never use what you write or type, such as annotations, brand terms or chat messages.

Every insight is aggregated and anonymized before anyone outside SEODash sees it. Anonymized means we remove names, email addresses, account IDs and anything else that could point to a customer, a person or a property, and we only publish a figure that combines at least 10 accounts. No customer, person or property can be identified from it, even combined with other information. Once anonymized, the figures are no longer personal data, and we may keep them.

Lawful basis: legitimate interests (promoting SEODash and sharing what we learn about how people use SEO tools). You can object at privacy@seodash.com , and we will leave your account out.

Browser extension

Our browser extension, SEODash: SEO Checker, checks the page you are viewing inside your browser. To do that it also requests the site's robots.txt, its sitemaps and the size of its images straight from that site, without your cookies. If you connect it to your account, it sends the address of the page you are on, without the query string or fragment, to SEODash when you open it, so we can show that page's Search Console data and Core Web Vitals. We look up Core Web Vitals with Google's Chrome UX Report API, and we send it the page's address (its origin and path) from our servers. The extension calls no other outside service. Its API key is stored in your browser.

The extension does not build a record of the pages you visit: the address goes to us only when you open the popup while signed in, and we do not keep a list of them. We use the address to fetch your results. The results sit in an encrypted cache, under a key that does not contain the address, for up to a day for Core Web Vitals and up to 30 days for Search Console figures. The one place we store a page's address is an annotation you choose to add to that page.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Our website

On seodash.com we use analytics and advertising tools only if you agree. See the Cookie policy .

Google user data

SEODash's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.

We do not use Google user data to develop, improve or train generalized AI or machine learning models.

In practice:

• We use Google user data only to provide and improve the features you see in SEODash.
• We do not sell it, use it for advertising, or pass it to advertising platforms, data brokers or information resellers.
• We transfer it only to run a feature you use (for example, sending a report to the recipients you chose, answering a chat question with Gemini, or running AI Visibility after you switch it on), to the subprocessors that help us run the service, for security, or to comply with the law. If our business is ever merged, acquired or sold, we transfer it only after you have explicitly agreed.
• Nobody at SEODash reads it unless you agree for specific data (for example, a property you name in a support request), it is needed for security or to investigate abuse, the law requires it, or it has been aggregated and anonymized for our internal operations.
• When you use webhooks, the SEODash API or the MCP connection, you send your data to tools you choose. That is your instruction, and those tools' own terms apply.
• We never publish insights drawn from Google user data, even aggregated or anonymized. The aggregated insights we share come only from how accounts use SEODash itself.

Revoking Google access

You can remove SEODash's access at any time on Google's Third-party apps and services page, or disconnect a Google account in SEODash under Account. After that we can no longer read your Google data and syncing stops. Data we already imported stays in your account until you remove the property or delete your account, and we then delete it as described in How long we keep data .

AI features and where they run

SEODash uses Google's Gemini models, through Google Cloud Vertex AI, for chat, AI summaries, Enhance and similar features.

• What we send: the property data needed for the answer (such as queries, pages and metrics), the settings that describe the property, and anything you type into chat or another AI feature. We do not send your name, email address or account details.
• Where: we send requests to Google's global endpoint, so Google may process them in the United States or in other countries where it runs the service.
• On what terms: Google processes the data as our processor under the Google Cloud data processing terms and does not use it to train its models. Google may keep a copy for up to an hour to answer follow-up questions faster.
• Chat history: we keep your 100 most recent conversations until you delete them or your account. Older ones are deleted automatically.

Anything you type into chat is sent to Gemini, so please do not type personal data about other people. AI-written text can be wrong: check it before you rely on it.

Shared property settings

More than one SEODash account can connect the same Search Console or GA4 property, for example an agency and its client. When that happens, the accounts share these settings for that property, so everyone works from the same setup:

• brand terms
• clusters and groups
• annotations
• saved views
• experiments
• report schedules
• alert thresholds
• the project start date

Who can see them. Only accounts that currently have access to the property through Google. Shared items do not show who added them: no name, email address or account. For report schedules, other accounts see the report and how many recipients it has, never the recipients' email addresses. Do not put anything in a shared item that you would not want others with access to the property to see.

When they are deleted.

• When anyone deletes a shared item, it is deleted for every account.
• Shared settings belong to the property, not to one account. If you remove a property from your account, the settings you added stay with it, for the other accounts connected to it and for any account that connects it later, until they are deleted or your account is.
• When your account is deleted, the items you added are deleted for every account.
• When an account is deleted and no other account has the property connected, every shared setting for that property is deleted, whoever added it.

Who we share data with

• Our subprocessors, the companies that host and run parts of SEODash for us, under written contracts. They are listed on our Subprocessors page.
• Google, when you sign in with Google and when we call Google's APIs for you. Google handles that data under its own privacy policy.
• Stripe, for payments. Stripe also uses some payment data for its own fraud prevention and legal duties, under its own privacy policy.
• People and tools you choose: report recipients, anyone with a share link, and the webhooks, API clients, MCP clients and browser extension you connect.
• Other accounts connected to the same property, for the shared settings described above.
• Authorities, advisers and buyers: where the law requires it, to our professional advisers under confidentiality, and to a buyer or successor if the business is sold or merged. We will tell you before your data moves to a new owner.

Where your data is stored

We are based in the UK. Your account data and your SEODash content are stored with Cloudflare in the EU. The archive of your Search Console and GA4 data is stored in Google BigQuery in the EU, and its backups in Cloudflare R2 in the EU. Until we finish moving off our previous database provider, some account data is also held with Supabase in London.

Some of our providers process data in other countries, including the United States. Cloudflare runs a global network, Gemini requests may be processed in the United States, Stripe and Sentry are US companies, Zoho may process our mailboxes outside the UK and the EU, and the AI services DataForSEO asks for AI Visibility may process prompts in the United States. The Subprocessors page lists each provider and where it processes data.

When we send personal data from the UK to a country the UK has not found adequate, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. For people in the EU, the European Commission has found that the UK protects personal data adequately, and our providers' transfers use the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Ask us at privacy@seodash.com for a copy of the safeguards.

How long we keep data

When we delete an account, we also revoke its Google access, API keys, share links, webhooks and report links. Some records that we must keep, such as invoices and tax evidence, stay for the periods above. Security and audit records are kept with personal details removed.

How we protect data

We encrypt data in transit, and we encrypt Google tokens, cached data and archive files at rest. We store IP addresses only as a keyed hash of the network part. Every request is checked against the account it belongs to, and our database enforces the same separation. Share links are stored as hashes. Error reports are scrubbed before they are sent. Only the people who need access to run SEODash have it. No service is perfectly secure, but if a breach puts you at risk, we will tell you and the ICO as the law requires.

Your rights

Depending on where you live, you have the right to:

• get a copy of your personal data;
• have it corrected;
• have it deleted;
• restrict how we use it;
• object to how we use it, including any use based on legitimate interests, and to direct marketing at any time;
• receive the data you gave us in a portable format;
• withdraw consent where we rely on it, without affecting what we did before.

Email privacy@seodash.com to use any of these rights. There is no self-serve export, so we send copies on request, including your chat history. We reply within one month. If a request is complex we can take up to two more months, and we will tell you why. We may need to confirm who you are first. It is usually free.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

Complaints

If you are unhappy with how we handle your personal data, tell us at privacy@seodash.com . We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live or work in the EU, you can complain to the data protection authority in your country.

Representative in the EU

We are appointing a representative in the EU under Article 27 of the EU GDPR and will name them here. Until then, people in the EU can contact us directly at privacy@seodash.com .

Children

SEODash is not for anyone under 18, and we do not knowingly collect data about children.

Changes to this notice

When we change this notice, we publish the new version here with a new version number and date. If a change matters to how we use your data, we tell you by email or in the app before it takes effect.

Contact

Blauer Digital Ltd, C/O Pollock Accounting Ltd, 3 - 4 Sentinel Square, London, United Kingdom, NW4 2EL. Company number 16749729. Privacy: privacy@seodash.com . Everything else: support@seodash.com .