Privacy Policy

What we collect

We only collect data needed to run AutoSEOPilot. Here’s the full list:

• Account info — your name, email address, and a hashed password (or, if you sign in with Google, the basic profile Google shares with us). We never see your Google password.
• Workspace & website data — workspace name, your site URL, and the page data we crawl (titles, headings, body text, URLs, internal links, and health/coverage signals).
• Competitor data — competitor URLs you submit for analysis.
• CMS & Search Console credentials — connection settings, API keys / webhooks, and OAuth tokens for your CMS and Google Search Console. We request the minimum scopes we need (Search Console access is read-only) so we can publish drafts to your CMS and read your search-performance data.
• Content— drafts, edits, and published content generated through the service.
• Usage data— how you interact with the service, collected via PostHog product analytics. Session replay masks input fields by default.
• Payment data — Polar is our merchant of record and handles all card details directly. We never see or store your card number.

How we use it

• To run AutoSEOPilot — crawling your site, researching keywords and search results, generating and publishing SEO content, and tracking rankings and AI-search visibility.
• To operate your account — authentication, billing (through Polar), and support.
• To communicate with you — service updates, billing notices, and material policy changes.
• To prevent abuse — detecting unauthorized access, spam, or fraud.

We never sell your data. We never use it to build advertising profiles.

AI content generation

To draft content, we send your site content, product/brand context, and keyword/SERP data to AI model providers, accessed through the Vercel AI Gateway. These providers process that data solely to generate the content you requested.

Model-training use is governed by the AI providers’ own API terms. AutoSEOPilot routes generation through the Vercel AI Gateway and relies on the applicable provider/API terms for training controls. We do not knowingly use your content to train AI models.

Generated content is stored in our database and in Cloudflare R2 object storage so you can access, edit, and publish it.

Who we share your data with

We use a small set of trusted services (subprocessors) to run AutoSEOPilot. Each one handles specific data:

• Polar— merchant of record for billing. Processes purchases, subscriptions, invoices, cancellations, and refunds on our behalf, and stores your card details. We never touch them.
• DataForSEO— SERP and keyword data. We send keywords and URLs and receive search results back.
• Vercel AI Gateway — AI content generation. It receives site content and keywords as prompts and returns generated drafts.
• Cloudflare (R2) — object storage for generated content artifacts.
• PostHog— product analytics and session replay, hosted in the EU (eu.posthog.com). Session replays mask all input fields by default.
• Google— sign-in (OAuth) and read-only Google Search Console data. We receive your email and basic profile and your search-performance data; Google does not receive your site content.
• Hetzner (via Coolify) — the servers and database that host AutoSEOPilot and store your data, provided through Coolify Cloud on Hetzner infrastructure in the European Union (Germany).
• Plunk— transactional email. When email delivery is enabled, we send welcome, password-reset, and payment-failed messages through Plunk. It receives the recipient’s email address and the rendered message body. Email delivery is optional and may be disabled; when it is, no email content leaves our servers.

We don’t share your data with anyone else. No ad networks, no data brokers, no exceptions.

Cookies

We use a strictly necessary cookie to keep you logged in (session authentication).

We also use PostHog for product analytics, session replay, and heatmaps. PostHog sets first-party cookies to understand how you use the product so we can improve it. PostHog is hosted in the EU (eu.posthog.com). No data is sold or shared with advertisers.

No marketing cookies. No tracking pixels. No ad networks.

Data storage & security

Your data is stored with our infrastructure providers, located in the United States and the European Union. All data is encrypted in transit (TLS) and encrypted at rest where supported by our providers.

We take reasonable security measures to protect your information, including access controls, encrypted communications, and regular reviews of who has access to production systems.

Your rights

You can request any of the following at any time by emailing hey@autoseopilot.com:

• Access— get a copy of the data we hold about you.
• Correction— fix inaccurate information.
• Deletion— delete your account and associated data (see “Data retention” below).
• Export— receive your data in a portable format.
• Opt out— disconnect your CMS or Google Search Console at any time; we remove the stored credentials immediately.

If you’re in the EU or UK, you also have rights under the GDPR to: restrict processing, object to processing, request data portability, and lodge a complaint with your local supervisory authority. If you’re a California resident, you have rights under the CCPA, including the right to know, delete, and opt out of any “sale” or “sharing” of personal data — we do not sell or share your data as those terms are defined.

Data retention

We keep your data while your account is active. When you delete your account, we perform a full deletion — not a deactivation: we cancel your billing and immediately purge your workspaces, generated content, and CMS / Search Console connections (including stored tokens) from our live systems.

Any remaining copies that exist only in encrypted backups are removed within 30 days. Disconnecting an individual CMS or Search Console connection deletes that connection’s stored credentials immediately. Payment records are held by Polar (our merchant of record) and retained as required by law and tax regulations.

International data transfers

Ideaplexa LLC is a US-based company. If you use AutoSEOPilot from outside the US, your data may be transferred to and processed in the United States or the European Union. We use standard contractual clauses or equivalent safeguards to protect your data during these transfers.

Children’s privacy

AutoSEOPilot is not directed at children under 16. We do not knowingly collect personal data from children under 16. If we become aware that we have, we’ll delete it promptly.

Changes to this policy

We may update this policy from time to time. For material changes, we’ll notify you by email before they take effect. The latest version will always be available on this page.

Contact

Questions about this policy or your data? Reach us at hey@autoseopilot.com.

AutoSEOPilot is operated by Ideaplexa LLC, a Wyoming limited liability company, USA.