Privacy policy

1. What the code measures on our customers' sites

When a customer installs our measurement code on their site, for that traffic we act as a data PROCESSOR: we measure under the site owner's instructions.

What is collected per visit: a random visitor identifier (stored in the browser, isolated per site: it never links data across different sites), sessions and events (page views, clicks with the clicked element's text, scroll depth, real interaction time, form submissions WITHOUT their content, and conversions with their value if the site defines them), technical signals (browser and version, operating system, language, timezone, screen size), the visit's origin (referrer, UTM parameters and click ids such as gclid or fbclid), the approximate location reported by the hosting at country, region and city level, and speed metrics (Web Vitals).

The IP address is never stored in plain text: it is stored encrypted (AES-256-GCM, recoverable only in a security incident) along with a hash used to detect abuse, and it is automatically deleted after 90 days by a daily purge. Location is NOT derived from that stored IP; it comes from hosting headers at visit time.

The code does not read form contents, does not collect passwords or payment data, and uses no advertising cookies.

2. If you are a visitor of a site using our measurement

The code honors the browser's privacy signals: with Global Privacy Control (GPC) or Do Not Track enabled, nothing is measured on that visit.

The controller for that site's data is its owner. You can still write to us via /contacto: we will handle your request (access, deletion) together with them and reply within 30 days.

3. If you start signing up

From the moment you enter your email in "Create account" or continue with Google, we keep your sign-up even if you don't finish it: your email, how far you got (sign-up, site scan, site added, business profile, payment, finished) and when you reached each step, the site you scanned, your language and whether you came by email or with Google.

We use it so you can pick up where you left off, to write to you if you stopped halfway, and to see which step people get stuck on so we can improve it. Legal basis: the pre-contract steps you ask us for when you sign up, and our legitimate interest in helping you finish signing up and in improving it. You can object at any time via /contacto.

If you continue with Google, Google confirms your email, name and profile picture. We only keep the email.

4. Your account data (if you are a customer)

For your account we act as the CONTROLLER. We store: your email, your site's name and domain, the platform it is built with (if you tell us), the business profile you fill in when signing up, the language you choose in the dashboard, your contact messages, and the sign-in links (magic links), which expire after 15 minutes. Connector sessions and tokens are stored hashed, never in plain text, and Google access is stored encrypted.

If you subscribe to a paid plan, payment is handled by Stripe. We store your Stripe customer and subscription ids, the plan, the payment status and the dates of each billing period. We never see or store your card details.

5. What you store and generate in the app

Conversion goals: name, key, the rule that defines the conversion (an event, a URL or an element of the site), its value, where it came from (the dashboard, the monthly plan or your assistant), the role of whoever created it (team or customer) and the dates of changes and archiving. If you change a goal's rule, its results are recalculated backwards too, because the rule is applied to the measurement already stored.

Tasks and calendar: title, note, date, status (pending, done or dismissed), the goal they are tied to, and who originated them (you, the team, the monthly analysis or your assistant). They are used to follow the work on your site. You can see all of them; the ones the team owns are closed only by the team.

Competition: the searches you track, the domains, URLs and titles that appear in the results, their positions and the features of the results page, with the date of each capture; plus your verdicts (whether a domain is a competitor or not) and your notes. Captures come from search results providers or are saved by your assistant with what it saw.

Site memory: notes, corrections and preferences about your site. They come from you (in the dashboard or the chat), from the team, or from earlier sessions of your assistant. They can be read from the dashboard and the chat, and we take them into account in the analysis. You can ask us to delete them, fully or partially.

6. Diagnostics and artificial intelligence

For opportunities, scoring, indexing, performance and page health we use your Search Console and Analytics metrics, our own measurement, the indexing status Google reports, a review of your site's public pages (what any visitor sees) and speed measurements.

The monthly analysis processes that data, aggregated and without visitors' personal data, with artificial intelligence models from external providers acting as processors: only to write your analysis, your plan and content drafts.

AI prompts: these are questions we build from real searches for your site and ask AI assistants, through a provider, to see whether they mention you. They are our inferences: they are not people's conversations and we do not capture anyone's chats.

7. The connector for assistants (ChatGPT, Claude)

Each connector call receives the site and the details of your question (for example a date range, a search, a goal or a filter) and returns to the assistant what you asked for: your site's metrics (Search Console, Analytics and our own measurement), goals and their results, tasks, competition, memory notes and the site's settings.

Those responses are received by the assistant you connected (for example ChatGPT or Claude) and are subject to that service's privacy policy.

Some tools write data inside SEO Programático, always at your request: creating, editing or archiving goals; saving search captures; saving verdicts and notes about competitors; and creating, completing or dismissing tasks. None of them modifies your Google account or your site.

If you disconnect the assistant, we delete its access tokens. What is already stored in your account stays.

8. Product updates and offers by email

When you create your account you agree to receive occasional product updates and promotional emails about seo-programático. We keep a record that you agreed, when, and to what wording.

Legal basis: your consent. You can withdraw it at any time with the unsubscribe link in every email or by writing to us via /contacto. Unsubscribing doesn't affect your account or the service emails (sign-in links and notices about your account).

We never give your email to third parties so they can send you their advertising.

9. What we use the data for

To provide the service: showing you your site's measurement (in your dashboard and your chat), producing your diagnostics, your monthly analysis and your plan, keeping the network healthy (bot classification) and supporting you. Also to help you finish signing up (section 3) and to send you product updates and offers (section 8). Legal basis: performing the service you request, the site owner's legitimate interest in measuring their own traffic and, for promotional emails, your consent.

We do not sell data, we do not use it for third-party advertising, and we never link visitors across different customers' sites.

10. Who receives data

Infrastructure: Vercel (app hosting and geolocation headers) and Supabase (database).

Email: Zoho Mail (transactional email: sign-in links and notices) and the provider we use to send product updates and offers.

Payments: Stripe, if you subscribe to a paid plan (it receives your email and the payment details you give it directly).

Artificial intelligence model providers: they receive aggregated data about your site (metrics, searches, pages and diagnostic results) to write your analysis, your plan and content drafts.

Search results and SEO data providers: they receive searches, domains and public URLs to capture results, search volumes, backlinks and answers from AI assistants.

Google: besides reading Search Console and Analytics with your permission, we use its public speed measurement tool on your site's public pages.

The assistant you connect: it receives the results you request through the connector, and they are subject to that assistant's privacy policy.

Some of these providers are outside the European Economic Area, mainly in the United States. In those cases the transfer relies on the EU-US Data Privacy Framework, when the provider is certified, or on the European Commission's standard contractual clauses.

SEO Programático does not sell the data or use it for third-party advertising.

11. How long we keep each thing

Encrypted IP and its hash: 90 days (automatic daily purge). Measurement events and sessions: while the site's account is active. Goals, tasks, competition captures, site memory, stored Google metrics, analyses and technical logs (errors and connector usage): while the account is active. Contact messages and requests: up to 24 months. Sign-in links: expire after 15 minutes.

Unfinished sign-ups: 12 months from your last step; then we delete them. The record that you agreed to promotional emails: while we send them and for up to 3 years after you unsubscribe, so we can show that you agreed.

If you delete your account, we delete your site's data within 30 days. Automatic database backups may keep deleted data for up to 7 more days; after that it is gone.

If you disconnect the assistant, we delete its tokens. If you revoke Google access, we stop reading and delete that access; metrics already stored stay in your account so you don't lose your history if you reconnect, and they are deleted with the account or when you ask.

12. Your rights and how to exercise them

You can ask for access to your data, a copy to take elsewhere, correction or deletion (the whole account, one site, or just the memory), and you can also restrict its use or object to it, by writing to us via /contacto. We reply within 30 days.

If you agreed to promotional emails, you can withdraw that consent at any time (section 8). Withdrawing it doesn't affect what we did before.

You can revoke the connector's access at any time: remove it from your assistant, disconnect it from Integrations in the dashboard, or type "switch account" in the chat (it revokes the session tokens).

If you think we haven't handled your data properly, you can complain to the data protection authority in your country. In Spain it is the Agencia Española de Protección de Datos (aepd.es).

13. Data processing agreement for customers

If your company needs a data processing agreement (DPA) formalizing section 1 (instructions, subprocessors, assistance and deletion), write to us via /contacto and we will sign one.

14. Google data you connect (Search Console and Analytics)

If you connect your Google account, we access, in READ-ONLY mode, your Google Search Console metrics (impressions, clicks, position, queries, pages and indexing status) and your Google Analytics 4 metrics (sessions, users, page views and conversions). Search Console and Analytics are connected separately, each with its own permission. We do not modify, create or delete anything in your Google account.

We use this data ONLY to show you your dashboard and generate the SEO analysis of YOUR own site. It is transmitted in only two cases: to the assistant you connect, when you request that data through the connector, and to AI providers acting as processors to write your analysis. We do not sell it, do not use it for advertising, and do not use it to train general artificial intelligence models.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We store the aggregated data needed for your dashboard and an encrypted access for each connection. You can revoke access anytime at https://myaccount.google.com/permissions, from Integrations in the dashboard, or via /contacto: we stop reading and delete that access. Metrics already stored stay in your account so you don't lose your history if you reconnect, and they are deleted when you delete the account or ask via /contacto.

15. Changes

If this policy changes materially, we announce it in the app. The date of the last update is at the top.