Privacy Policy

UK GDPR & PECR Transparency Notice • Last Updated: 5 October 2026

ChatSEO is committed to protecting your personal data and upholding your privacy rights in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Data Controller

ChatSEO acts as the Data Controller for personal data processed when you create an account, authenticate, or interact with our application.

Compliance & Privacy Team: privacy@chatseo.io

Jurisdiction: United Kingdom

2. Personal Data We Collect & Privacy by Design

We practice strict Data Minimisation (Article 5(1)(c) UK GDPR). We do not collect passwords, financial card details, or special category personal data:

Account Identity: Your email address and optional full name.
Authentication Data: Passwordless, single-use cryptographic magic login link hashes (stored in Redis with a 15-minute lifespan).
Technical Session Metadata: Client IP address and browser User-Agent for security session auditing and rate limiting.
Technical SEO Inputs: Public website URLs and search queries submitted for SEO audit and AI visibility tracking.

3. Lawful Basis for Processing (UK GDPR Article 6)

Contractual Necessity (Article 6(1)(b)): Processing your email, crawling requested websites, and delivering SEO visibility recommendations to fulfill our service agreement.
Legitimate Interests (Article 6(1)(f)): Maintaining session security, rate limiting to prevent service degradation, logging system errors with masked identifiers, and auditing account activity.

4. Third-Party Sub-Processors

We share technical query data only as necessary to perform AI evaluations. We never transmit your personal name, email address, or billing details to AI model providers:

Google Gemini API

Evaluates target queries and competitor visibility. Zero personal PII transmitted.

OpenAI API

Generates synthetic seed queries and keyword clustering prompts.

Google Search Console API

OAuth integration tokens encrypted at rest via Fernet AES-128-CBC.

Transactional SMTP Provider

Delivers encrypted single-use magic login links to your verified email.

5. Data Retention & Automated Storage Limitation (Article 5(1)(e))

We enforce automated lifecycle management to prevent unnecessary data retention:

Raw HTML Snapshot Blobs: Stripped automatically after 180 days via scheduled background maintenance tasks. High-level performance scores and metrics are retained.
Magic Login Tokens: Hard-deleted from Redis cache within 15 minutes.
Session Credentials: Terminated automatically upon logout or token expiry (30 days).

6. Cookies & PECR Compliance

ChatSEO uses strictly necessary session cookies (access_token, refresh_token) flagged with HttpOnly, Secure, SameSite=Lax to secure your authenticated session.

✓ We use zero third-party advertising pixels, zero Meta Pixels, and zero behavioral tracking scripts. Under Regulation 6 of PECR, strictly necessary session cookies are exempt from consent banners.

7. Your UK GDPR Data Protection Rights

You possess the following statutory rights under the UK GDPR:

Right to Data Portability (Article 20):

Download a complete structured ZIP archive of your websites, queries, and recommendations anytime from your Profile page.

Right to Erasure / Deletion (Article 17):

Permanently delete your account and all associated data directly from your Profile page Danger Zone.

Right to Rectification (Article 16):

Update your name and profile information at any time in Account Settings.

Right to Restrict Processing (Article 18) & Right to Object (Article 21):

Submit restriction or objection requests directly to privacy@chatseo.io. We will respond within 30 days.

8. Complaints & Supervisory Authority

If you have concerns regarding our processing of your personal data, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)

Website: https://ico.org.uk

Helpline: 0303 123 1113