1. Who is responsible
The controller of personal data processed through the Aseoma website and application (the Service) is Aseoma (Aseoma, we, us). Privacy questions and requests: [email protected].
We have not appointed a Data Protection Officer because our processing does not require one under Article 37 GDPR; the mailbox above is read by the people responsible for data protection.
This policy covers visitors of our website, people who use our free tools, and users of the Service. When you use the Service for an organisation and enter data about other people, that organisation is the controller of that data and we act as its processor under our Terms and Data Processing Agreement.
2. In short
- We collect what we need to run your account and the Service, and nothing more.
- We do not sell personal data, show ads in the Service, or build advertising profiles.
- We measure how our website and app are used (Google Analytics) and which of our Google Ads and Microsoft Advertising campaigns bring sign-ups and purchases. In the EEA, the UK and Switzerland no analytics or advertising cookies are set and no identifiers are sent until you accept; everywhere you can decline or change your choice at any time in Cookie settings.
- Our servers are in the European Union (Germany).
- Payments are handled by Creem; we never see or store your card number.
- You can access, correct, export or delete your data at any time by writing to us.
3. What data we collect
Account data
Your name, email address, password (stored only as a salted hash), organisation name, role, language, two-factor authentication secret and recovery codes (encrypted), the invitations you send and receive, and the dates of registration and sign-in.
If you sign in with Google, Google shares with us your name, your email address (and that Google has verified it) and your Google account identifier. We use them only to create your account and sign you in; we never receive your Google password.
Billing data
Creem (Armitage Labs OÜ (Estonia)), our Merchant of Record, runs the checkout and collects your name, email, billing address, VAT number, payment method and transaction history under its own privacy policy. We receive only what we need to run your subscription: customer and subscription identifiers, plan, status, amounts, invoice numbers and the country used for tax. We never receive full card numbers.
Customer Data you enter
Domains, keywords, locations, competitors, tags, notes, alert rules, notification channels (for example a Slack webhook address or a Telegram chat), report recipients, AI Writer topics and instructions, and the reports, audits and articles generated from them. Most of this is not personal data. If you connect Google Search Console we store an encrypted access token and the queries, pages, clicks and impressions Google returns for the properties you chose.
Website content we crawl
Site audits, speed tests and AI visibility checks read public web pages you point us to. These pages may contain personal data, such as an author’s name or a contact email. We store it only as part of the page analysis you asked for.
Free tools
When you use a free tool without an account, such as the free SEO audit, we store the domain you entered and a one-way hash of your IP address (never the address itself) to prevent abuse and apply daily limits.
Technical and usage data
Server logs with IP address, browser user agent, time, requested address and response code; security events such as failed sign-ins; and records of the actions you take, used for usage limits, history and support.
Advertising measurement (with your consent)
If you accept cookies, we record the ad click identifiers (gclid, gbraid, wbraid, msclkid) and campaign tags (UTM parameters) of the visit that brought you to our website and save them with your account when you sign up, so we know which campaign an account came from. We also report sign-ups, free trial starts, purchases (value, currency and order ID) and started free SEO audits to Google Ads and Microsoft Advertising, together with a SHA-256 hash of your email address. See Cookies and local storage for details.
Communications
Emails and messages you send us, with attachments, and our replies.
4. Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the Service: account, projects, rank checks, audits, reports, alerts | Account data, Customer Data, usage data | Performance of a contract (6(1)(b)) |
| Payments, invoices, tax and accounting | Billing data | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Service emails: verification, password reset, trial and usage notices, alerts and reports you set up | Name, email address | Contract (6(1)(b)) |
| Security, abuse and fraud prevention, limits of free tools, debugging, backups | Technical data, hashed IP address | Legitimate interest in a secure and reliable service (6(1)(f)) |
| Analysing public web pages you ask us to audit | Content of crawled pages | Legitimate interest of our customers and ours in website analysis (6(1)(f)) |
| Product news and tips | Email address | Legitimate interest for customers, with an unsubscribe link in every message (6(1)(f)); consent otherwise (6(1)(a)) |
| Support and answering your requests | Communications, account data | Contract or legitimate interest |
| Improving the Service with aggregated usage statistics | Usage records, aggregated | Legitimate interest (6(1)(f)); we build no advertising profiles |
| Understanding how visitors use our website and app, with Google Analytics (pages viewed, where visits come from, which steps lead to a sign-up or a purchase) | Pages visited, referrer and campaign tags, device and browser type, approximate location (country, region), conversion events, Google Analytics cookies | Consent (6(1)(a) GDPR; Art. 82 of the French Data Protection Act), which you can withdraw at any time in Cookie settings |
| Measuring which of our Google Ads and Microsoft Advertising campaigns lead to sign-ups, free trials, purchases and free audits | Ad click identifiers, campaign tags, conversion events, SHA-256 hash of your email address, Google Ads and Microsoft UET cookies | Consent (6(1)(a) GDPR; Art. 82 of the French Data Protection Act), which you can withdraw at any time in Cookie settings |
We do not sell or rent personal data, do not show ads in the Service, do not build advertising profiles, and do not make automated decisions that have legal or similarly significant effects on you. The only advertising-related use is the campaign measurement above, which you can decline or stop at any time, like the usage statistics.
5. AI features
When you use AI Writer, content briefs or title and description suggestions, the topic, keywords, page titles and instructions you enter are sent to our AI provider (OpenAI) to produce the text. Through the API we use, this data is not used to train AI models and is kept by the provider only for a limited time for abuse monitoring. Do not put personal data you do not want processed this way into AI instructions. AI visibility reports send the prompts you track, not your account data, to AI engines through our data provider.
8. International transfers
Our servers are in the European Union, and Creem, our Merchant of Record, is established in the EU (Estonia); any payment partners it uses are covered by Creem’s own privacy policy. Some providers above are established or process data outside the EEA, for example OpenAI and Postmark in the United States, and Google LLC in the United States for its APIs and, with your consent, Google Analytics and Google Ads measurement, and Microsoft Corporation in the United States for, with your consent, Microsoft Advertising measurement. For these transfers we rely on adequacy decisions of the European Commission where they exist (such as the EU-US Data Privacy Framework, under which Google LLC and Microsoft Corporation are certified) and otherwise on the Standard Contractual Clauses with additional safeguards. You can ask us for a copy.
9. How long we keep data
- Account and Customer Data: while your account exists. When you delete a project or ask us to delete your account, the data is removed from live systems within 30 days and from backups when they are overwritten, within a further 30 days.
- Rank history and Search Console data: for the history period of your plan; older data is deleted or aggregated.
- Free tool records: the domain and IP hash for 12 months, unless you create an account and keep the result.
- Analytics cookies:
_gaand_ga_*up to 2 years in your browser; Google Analytics keeps the event data for 14 months at most, then deletes it. - Advertising cookies:
_gcl_*andaseoma_adsup to 90 days in your browser; the click identifiers and campaign tags saved with your account at sign-up are kept and deleted together with your account. - Billing records: as long as tax and accounting law requires, usually 7 to 10 years, mostly held by Creem.
- Server and security logs: 90 days, unless needed to investigate an incident.
- Support messages: 2 years after the last message.
10. Security
Data is encrypted in transit (TLS) and stored on servers in access-controlled data centres. Passwords are hashed with a slow modern algorithm; Google tokens, two-factor secrets and notification secrets are encrypted in the application with keys kept outside the database. Each Workspace is isolated in the database by row-level security. Access to production systems is limited to named people using SSH keys and is logged. Two-factor authentication is available for every account.
No system is completely secure. If a breach affects your personal data we will inform you and the supervisory authority as Articles 33 and 34 GDPR require.
11. Your rights
Under the GDPR and the UK GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased when there is no longer a reason to keep it;
- restrict processing while a question about accuracy or lawfulness is settled;
- receive the data you gave us in a machine-readable format (portability);
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time, without affecting earlier processing;
- lodge a complaint with a supervisory authority, in particular in the country where you live or work.
To use a right, email [email protected] from the address of your account. We answer within one month, free of charge, and may ask you to confirm your identity. You can also change your details and delete projects yourself in the app.
12. If you live outside the EU
United States (including California): you may ask to know, correct and delete the personal information we hold about you. We do not sell personal information. The only disclosure that may count as “sharing” for cross-context behavioural advertising is the Google Ads conversion measurement described in Cookies and local storage; you can opt out of it at any time by declining in . We do not use sensitive personal information to infer characteristics. We will not treat you differently for using your rights.
Other countries (for example Canada, Switzerland, Brazil or Australia): we grant the same rights as described above. Write to [email protected].
13. Google API Services
Aseoma’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Sign in with Google only reads your name, email address and account identifier, to sign you in. Search Console data is used only to show your own reports in the Service and to combine them with your rank tracking; it is not used for advertising, not used to train AI models and not shared with third parties other than the hosting provider that stores it. You can revoke access at any time in the project settings or at myaccount.google.com/permissions.
14. Children
The Service is for professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We update this policy when our processing, providers or the law change. The date at the top shows the current version. We tell registered users about material changes by email or in the app before they take effect.
16. Contact
Aseoma. Privacy requests: [email protected]. Other questions: [email protected]. See also the contact page.
Questions about this document: [email protected]. See also our Terms, Privacy Policy and Refund Policy, or write to us from the contact page.