Privacy policy
Draft: provided for information until legal review is complete.
seops (app.seops.app) shows a site's search, visitor and AI-visibility data in one dashboard. This page explains what data we process and why, where it is stored and your rights. seops is the data controller under GDPR and Turkish KVKK; contact: contact@seops.app.
Data we collect
- Account: your email address, name and profile picture from Google sign-in; your language, theme and setup status; team invitations you send.
- Session: one HttpOnly session cookie (seops_sid), valid for 30 days. The server stores only its SHA-256 hash. We use no advertising or tracking cookies.
- Sites: the domain you add, the Search Console property and Analytics property you choose, tracked keywords, AI-visibility prompts, your tasks, notes and (if enabled) prompt history.
- Site data: Search Console and Analytics reports you grant our service account read access to, crawl results for pages in your sitemap, page-speed measurements, index checks, rank checks, external security checks (HTTPS, headers, DNS records) and security findings your AI agent submits.
- Keys: Cloudflare, Bing, Yandex, WordPress, Hostinger, Supabase or Bluesky credentials you enter are stored encrypted with AES-GCM, shown only by their last 4 characters and used only for that site's reports or the actions you approve.
- Billing: your Paddle customer ID, subscription status, capacity, billing period and country. Card or bank details never reach seops; they are collected and stored by Paddle.
- Security records: short-lived request counters, webhook events and error logs to prevent abuse and reconcile payments.
How we use it
Only to run the dashboard: showing reports, producing daily alerts and weekly summaries, verifying site ownership, billing the capacity you choose and preventing abuse. We do not sell your data, use it for advertising or share it to train AI models.
Service providers
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting, database (D1), backups (R2), AI Gateway, security, cookieless visit statistics for this dashboard (Web Analytics) and the storage behind seops Analytics (Analytics Engine) |
| Sign-in, Search Console, Analytics, PageSpeed and URL Inspection APIs | |
| Paddle.com Market Limited | Merchant of record: checkout, payment methods, invoices, taxes and refunds. Paddle is an independent controller for payment data; see the Paddle privacy policy. |
| AI model providers (OpenAI, Anthropic, Google, Perplexity) | AI visibility: each prompt you track is sent, with the site's country for local search results, through Cloudflare AI Gateway to the AI engines enabled for your workspace (ChatGPT, Claude, Gemini, Perplexity), which answer with live web search; the answers and cited sources are stored in your workspace. Your brand terms are not sent; mentions and citations are detected in seops. "Generate with AI" in the prompt library or a server-side audit: the text you enter and the relevant site data are sent through Cloudflare AI Gateway to the provider you choose. Under the API terms of OpenAI, Anthropic and Google this data is not used to train their models; Perplexity's API terms apply to Perplexity. |
| Microsoft Bing, Yandex, IndexNow | Webmaster reports and URL notifications, if you connected a key |
| Bluesky | Publishing the Content and sharing posts you approve, if you connected an account |
Data may be processed on Cloudflare's global network, which involves international transfers needed to provide the service. The current list is on the subprocessors page.
seops Analytics (visit statistics on your site)
If you turn on seops Analytics, a 2.1 KB script (1.2 KB compressed) on your site sends each page view to i.seops.app. For this data you are the controller and seops is your processor; the Data Processing Addendum applies. What the script sends and what we keep:
- Collected per page view: page path (the script does not send the query string; only UTM tags, the presence of an ad click ID and the site-search parameter you allow with
data-searchleave the browser), referrer host and path, UTM parameters, hostname, screen width class (mobile, tablet, desktop), browser language, time on page and scroll depth when the visitor leaves, and the events you define (name plus up to 8 short properties). - Derived on our server and then discarded: the visitor's IP address and browser user agent. We use them only in the moment of the request, to derive country, region and city (from Cloudflare's geolocation), browser and operating system family, to filter known crawlers, and to compute a daily visitor hash: SHA-256 of a secret salt that changes every day, the IP address, the user agent and your site key, truncated to 16 hex characters. The raw IP address and user agent are not written anywhere, not even to logs. Each day's salt (Turkey time, UTC+3) is used only on that day and deleted two days after the day ends (daily job at 00:05 Turkey time), after which the hash cannot be recomputed.
- Not collected: no cookies, no localStorage or other browser storage, no persistent identifier, no fingerprinting beyond the daily hash, no cross-site or cross-day tracking, no form contents, no full URLs with query strings. The script does not run on localhost or in automated browsers.
- Retention: raw hits for 90 days on Cloudflare Analytics Engine; daily summaries (counts and top lists, no visitor hashes) for as long as the site exists in your account; everything is deleted within 30 days after you delete the site or your account.
- Visitors' rights: because we keep no identifier, we cannot find or delete one visitor's hits on request. Visitors of a site that uses seops Analytics should contact that site's owner, who is the controller.
Sentence you can add to your own privacy notice (also in the dashboard, under Analytics → Setup):
This site uses seops Analytics for visit statistics: no cookies are set, the IP address is hashed with a salt that changes daily and is not stored, and no visitor identifier is kept. Details: seops.app/legal/privacy
Bu site ziyaret istatistikleri için seops Analytics kullanır: çerez kullanılmaz, IP adresi günlük değişen bir tuzla özetlenir ve saklanmaz, ziyaretçi kimliği tutulmaz. Ayrıntı: seops.app/legal/privacy
seops.app (the public website)
The public website seops.app (product pages, guides, blog and free tools) keeps very little. seops is the controller for this data.
- Language cookie: when you pick a language from the menu, the site sets one first-party cookie,
seops_lang, holding only the language code (for exampletr). It is used to open the home page in that language on your next visit, and expires after 1 year. Without a pick, no cookie is set. - Theme in your browser: when you switch between light and dark mode, the choice is saved in your browser's localStorage (
seops:theme). It never leaves your browser and stays until you clear your site data. - Visit statistics: the site counts visits with seops Analytics itself, as described above: no cookies, no browser storage, no persistent identifier.
- Waitlist and newsletter: if you join the waitlist or sign up for new guides, we store your email address, the form you used, the page language and, for the waitlist, the plan and number of sites you entered, with the time and a one-way hash of your IP address and email address (used only to spot abuse). The data is stored in Cloudflare D1 and used only to email you when capacity opens for you or when new guides are published. It is kept until you ask us to delete it; there is no automatic deletion period yet. To delete it, write to contact@seops.app from that address.
AI connection (AITM)
When you connect an AI app such as Claude, it can only read your own workspace's data and add tasks, prompts, drafts or findings, within the scope you approve on the consent page. You can remove the connection at any time under My account → Connected AI apps. Prompt history can be turned off, masked or locked with a password; locked entries are encrypted and cannot be read by AI agents.
Retention
- Sites whose ownership is not verified within 7 days are deleted with their data.
- Expired sessions are cleaned up daily; cached reports are refreshed regularly.
- After you ask to close your account, your account and site data are deleted within 30 days, except records we must keep by law. Billing event records are kept for as long as tax and accounting law requires.
Your rights
You can access, correct, delete, object to processing and receive a portable copy of your data. Write to contact@seops.app; we reply within 30 days. You may also complain to your data protection authority.
Changes
If we update this page we change the date above and announce significant changes in the dashboard. Terms of use: here.