Privacy policy

Last updated: 26 October 2026 · Operator: SEO Autopilot (contact via the email on your invoice / support channel)

This policy explains what we collect when you use SEO Autopilot, why we collect it, and the choices you have. By creating an account you agree to this policy together with our Terms of service.

1. Data we process

Account — email address and a hashed password (we never store your password in plain text).
Billing — plan, quota usage, and Stripe customer/subscription identifiers. Card details are handled by Stripe; we do not store full card numbers.
Site & brand — brand name, description, audience, voice, colors, timezone, article language, logo file, and CMS connection details (WordPress, Shopify, or Wix). CMS secrets (application passwords / API tokens) are encrypted at rest.
Content — keywords, article drafts, published HTML, featured images, generation status, and related job logs.
Optional Google Search Console — if you connect GSC, we store an OAuth token so we can fetch keyword seeds for your property.
Technical — session cookies, basic server logs (IP, user agent, timestamps), and rate-limit counters needed to protect the service.

2. Why we process it

Provide the product (scan, schedule, generate, publish).
Authenticate you and secure the service.
Bill subscriptions and enforce monthly article quotas.
Send transactional email (welcome, password reset, job failures, quota / payment notices) when SMTP is configured.
Improve reliability (error diagnosis, abuse prevention).

Legal bases (where GDPR applies): contract performance, legitimate interests in securing and operating the service, and consent where you connect optional third-party accounts (e.g. GSC).

3. Processors & subprocessors

Anthropic — article and keyword generation (prompts include your brand context).
Pexels — stock photography search for article images / covers.
Stripe — payments and customer portal.
Your CMS — WordPress, Shopify, or Wix APIs when you publish.
Hosting / email — the cloud host and SMTP provider you (or we) configure for the deployment.

We do not sell personal data. We do not use your article content to train public models beyond what those processors disclose in their own terms.

4. Retention

Account and site data are kept while your account is active. After deletion requests we remove or anonymize personal data within a reasonable period, except records we must keep for legal, tax, or fraud-prevention reasons (e.g. billing events). Server logs are rotated on a short cycle.

5. Your rights

Depending on your location you may request access, correction, export, or deletion of your personal data, and you may object to certain processing. Email support from the address on your account to exercise these rights. You can also disconnect CMS / GSC credentials in Settings, and manage Stripe billing via the customer portal.

Self-serve full account deletion may not yet be in the product UI; contact support and we will delete your account and associated site data.

6. International transfers

Depending on hosting and processor locations, data may be processed outside your country. Where required, we rely on appropriate safeguards (e.g. standard contractual clauses used by those providers).

7. Security

We use HTTPS in production, HTTP-only session cookies, encrypted CMS secrets, and access controls on the application database. No method of transmission or storage is 100% secure; report suspected incidents to support promptly.

8. Children

The service is not directed at children under 16. We do not knowingly collect their data.

9. Changes

We may update this policy. Material changes will be reflected by the “Last updated” date above and, where appropriate, a notice in the product or by email.

10. Contact

Questions about privacy: use the support email associated with your SEO Autopilot deployment or invoice.