Privacy Policy

1. Information We Collect

To provide, protect, and optimize our autonomous AI SEO platform, we collect the following categories of information:

• Account & Contact Data: Name, business or personal email address, company name, website URLs, and authentication credentials (including Google OAuth identity tokens and one-time verification passcodes).
• SEO Project & Domain Telemetry: Target website domain names, sitemap URLs, target geographic regions, search query clusters, competitor URLs, and content generation prompts.
• Security & Anti-Bot Verification Telemetry: IP addresses, browser fingerprint attributes (Canvas/WebGL hashes, user agents, screen geometry), cryptographic Proof-of-Work (PoW) verification metrics, request timestamps, and click-fraud mitigation telemetry collected via our defensive edge middleware to protect digital ad campaigns and web assets from malicious bot traffic.
• Payment & Billing Data: Transaction references, subscription status, billing country, and tax identifiers. All direct credit card and payment processing is handled via PCI-DSS compliant third-party payment gateways.

2. Legal Bases for Processing (GDPR Art. 6)

We process personal and technical data under the following recognized legal bases:

• Performance of a Contract: To provision your user account, execute autonomous SEO audits, generate L1-L3 semantic Silo matrices, and manage your active subscriptions.
• Legitimate Interests: To detect and prevent click fraud, mitigate automated bot attacks, safeguard platform stability, and protect client advertising budgets.
• Compliance with Legal Obligations: To adhere to applicable corporate accounting, tax, anti-fraud, and statutory requirements.
• Consent: For opt-in communications, direct consultations, or when you explicitly authenticate via third-party identity providers (e.g. Google Sign-In).

3. Use of AI & LLM Inference Engines

OpenSeoLab utilizes specialized large language models (LLMs) to perform semantic clustering, intent classification, and content generation. Customer proprietary data, internal company notes, and confidential SEO research data are NEVER used to train public foundational AI models. All inference calls to upstream model APIs are performed under strict enterprise data protection agreements with zero-data-retention guarantees where supported.

4. Data Sharing & Sub-processors

We do not sell, rent, or trade your personal data. We disclose information only to vetted third-party service providers bound by strict confidentiality and data protection agreements:

• Payment Processing & Merchant of Record: Lemon Squeezy (Lemon Squeezy LLC, lemonsqueezy.com), Stripe, and PayPal. For digital software subscriptions and API licenses, Lemon Squeezy acts as our authorized Merchant of Record, processing payments, calculating applicable sales tax/VAT, and maintaining PCI-DSS Level 1 compliance. OpenSeoLab does not store credit card numbers.
• Edge & Infrastructure: Cloudflare (DDoS mitigation, edge routing, CDN, WAF protection).
• Authentication & Identity: Google Identity Services (OAuth 2.0 single sign-on).
• Email Dispatch: Transactional SMTP infrastructure (for 6-digit OTP delivery and system alerts).
• Law Enforcement: Only when strictly required by enforceable court orders or applicable mandatory statutory law.

5. International Data Transfers

Because OpenSeoLab serves a global user base across North America, Europe, the UK, Asia-Pacific, and Latin America, data may be transferred to and processed on secure servers located outside your country of residence. In such cases, we ensure adequate legal safeguards in compliance with GDPR Chapter V, including European Commission Standard Contractual Clauses (SCCs) and high-grade cryptographic controls.

6. Your Global Privacy Rights

Depending on your jurisdiction, you possess the following rights regarding your personal data:

• Right of Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and associated personal data.
• Right to Data Portability: Obtain your semantic data, site structure matrices, and generated articles in machine-readable format.
• Right to Restriction & Objection: Object to processing based on legitimate interests or direct marketing.
• California Privacy Rights (CCPA/CPRA): Right to know, right to delete, right to correct, and right to opt-out of sharing (OpenSeoLab does not sell personal information).

To exercise any of these rights, contact our Data Protection Officer at: [email protected].

7. Data Retention & Security

We implement defense-in-depth security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, salting and hashing of authentication credentials, and strict zero-trust role-based access controls. Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or to comply with statutory legal requirements.

8. Contact Information

For inquiries, privacy requests, or formal notifications regarding this Privacy Policy:

OpenSeoLab Data Protection Team
Email: [email protected]
Corporate Inquiries: [email protected]
Service Support: [email protected]