SEO Buddy Privacy Policy
SEO Buddy helps you organize and execute your SEO work. To do that we need some of your data, and you deserve to know exactly what we take, why we take it, where it goes and how to get it deleted. No legal wallpaper, no 14,000 pixels of boilerplate: this page is the complete picture.
1. Who we are
seobuddy.com and its sub-domains ("SEO Buddy", "we", "us") are owned and operated by InfiniteQuant Ltd, a company registered in the Commonwealth of The Bahamas (Suite 219, Lagoon Court - Sandyport, Nassau - New Providence, The Bahamas). For all data protection matters you can reach us at [email protected] or through our contact form.
2. What we collect
Data you give us
- Account data: name, email address and a password (stored only as a salted cryptographic hash; we can never read it). Optionally a company name and website domain for your projects.
- Project content: the domains, keywords, checklists, notes and campaign settings you create inside the product.
- Billing data: handled by our payment processor (see section 6). We receive your name, email, country and the plan you bought. We never see or store your full card number.
- Communications: messages you send us through the contact form, support email or interviews you agree to.
Data collected automatically
- Usage and log data: IP address, browser type, pages visited, actions performed and timestamps. We use this to run, secure and improve the service.
- Cookies and similar technologies: detailed in section 5.
Data from connected accounts
- Google Sign-In: if you register or log in with Google we receive your name, email address and profile picture from Google.
- Connected mailboxes (outreach features): if you connect an email account for outreach campaigns, we access it strictly as described in section 4.
We do not collect special categories of data (health, beliefs, biometrics) and we ask you not to put any into the product.
3. How and why we use it
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Providing the service | Your account, projects, checklists, campaigns | Contract |
| Billing | Subscriptions, invoices, refunds | Contract, legal obligation |
| Security | Login protection, fraud and abuse prevention, backups | Legitimate interest |
| Support | Answering your messages | Contract |
| Product improvement | Aggregated usage statistics | Legitimate interest |
| Marketing | Newsletter, product updates | Consent, withdrawable any time via the unsubscribe link in every email or in your settings |
We do not sell your personal data. We do not rent it. We never have and we never will.
4. Google user data (Gmail and Google Sign-In)
SEO Buddy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
What we request and why
- Google Sign-In (basic profile): your name, email address and profile picture, used only to create and identify your SEO Buddy account.
- gmail.send: used exclusively to send, from your own mailbox, the outreach emails that you compose and schedule in your campaigns. Nothing is ever sent without a campaign you configured and launched yourself.
- gmail.readonly / gmail.modify: used exclusively to detect replies to the outreach emails sent by your campaigns, so that scheduled follow-ups are cancelled and the conversation appears in your campaign inbox. We look for replies to campaign message threads; we do not scan, index or analyse the rest of your mailbox.
What we will never do with Google user data
- Never use it for advertising, retargeting or market research.
- Never sell it, rent it, or transfer it to data brokers or any third party, except as necessary to provide the feature (secure hosting), to comply with the law, or as part of a merger with equivalent protections.
- Never use it to train artificial intelligence or machine learning models, whether generalized or otherwise.
- Never allow humans to read it, unless (a) you explicitly ask us to for support and give consent, (b) it is necessary for security purposes such as abuse investigation, (c) required by law, or (d) the data has been aggregated and anonymised for internal operations.
Storage, protection and deletion
- OAuth tokens are stored encrypted at rest and are never exposed in logs, exports or to other users.
- Campaign email content and reply metadata are stored only as long as the campaign exists in your account.
- Disconnecting your Google account in SEO Buddy, or revoking SEO Buddy's access from your Google Account permissions page, immediately stops all access. We then delete the associated tokens, and the cached Gmail data is deleted with your campaigns or on request within 30 days.
- Deleting your SEO Buddy account deletes the associated Google user data on the same schedule (section 8).
5. Cookies and analytics
We use the following categories:
| Category | Tools | Purpose |
|---|---|---|
| Strictly necessary | SEO Buddy session and security cookies | Login sessions, security. Cannot be switched off. |
| Analytics | Google Analytics, Google Tag Manager, Ahrefs Analytics | Aggregate statistics about how the site and product are used. |
| Advertising (public website pages only) | Google Ads, Meta, X (Twitter), Quora and Reddit pixels | Measuring our ad campaigns for visitors of the marketing site. |
| Affiliate | Awin | Attributing purchases referred by our partners. |
You can block non-essential cookies in your browser settings, use the Google Analytics opt-out, and where a consent banner is shown you can refuse non-essential categories. Doing so never affects the product itself.
6. Who we share data with
| Provider | Role | What it processes | Location |
|---|---|---|---|
| Paddle | Merchant of record and payment processing | Name, email, country, purchase | UK / EU |
| Amazon Web Services | Hosting and backups | All service data, encrypted infrastructure | United States |
| Cloudflare | Content delivery, DDoS protection | Traffic data | Global network |
| Sign-In, Gmail features (at your request), analytics, advertising | See sections 4 and 5 | United States / global | |
| Twilio SendGrid, Mailchimp, Amazon SES | Sending transactional emails and newsletters | Email address, name | United States |
| Bonjoro | Personal welcome videos | Email address, name | Australia / US |
| Gravatar (Automattic) | Profile pictures | Hashed email address | United States |
Beyond these processors, we disclose personal data only if the law genuinely requires it, to protect our users or our rights, or, if SEO Buddy is ever acquired, to a successor bound by this same policy. We publish material changes to this list here.
7. International transfers
Our servers are located in the United States and our processors operate globally. Where data of EU/UK residents is transferred internationally, we rely on our processors' Standard Contractual Clauses and equivalent safeguards (for example, Paddle and Google both maintain EU data transfer frameworks).
8. How long we keep data
- Account and project data: kept while your account is active. When you delete your account, or ask us to, personal data is deleted within 30 days, except minimal records we must keep (for example invoices, for tax law).
- Google user data: see section 4; deleted with the connected campaigns, on disconnection, or on request within 30 days.
- Backups: encrypted backups roll over automatically; deleted data disappears from them within 35 days.
- Server logs: kept up to 12 months for security, then deleted or anonymised.
9. How we protect data
- All traffic to and from SEO Buddy is encrypted with TLS.
- Passwords are stored only as salted PBKDF2 hashes. OAuth tokens and application secrets are stored encrypted.
- Two-factor authentication is available on every account, and we encourage you to enable it in Settings → Security.
- Production access is restricted to authorised personnel on a need-to-use basis, over encrypted connections.
- Daily encrypted backups protect against data loss; restore procedures are tested.
- We review our dependencies and infrastructure for vulnerabilities and apply security patches as part of ongoing maintenance, and our Google-connected features undergo the industry CASA security assessment process.
No online service can promise absolute security. If we ever discover a breach affecting your personal data we will notify you and the relevant authorities without undue delay, and tell you plainly what happened and what we are doing about it.
10. Your rights
Depending on where you live (GDPR in the EU/UK, CCPA/CPRA in California, and similar laws elsewhere) you have the right to:
- Access the personal data we hold about you and receive a copy in a portable format;
- Correct inaccurate data (most of it directly in your account settings);
- Delete your data ("right to be forgotten");
- Object to or restrict processing based on legitimate interest;
- Withdraw consent at any time (for example unsubscribe from marketing in one click);
- Not be discriminated against for exercising any of these rights;
- Complain to your local data protection authority.
To exercise any of these, email [email protected] from the address on your account. We answer every request and never charge for it.
11. Children
SEO Buddy is a professional tool, not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
When we change this policy we update the date at the top. For material changes, such as a new category of data or a new purpose, we notify you by email or in the product before the change takes effect. We keep this page as the single, current source of truth.
13. Contact us
InfiniteQuant Ltd (operating SEO Buddy)
Suite 219, Lagoon Court - Sandyport
Nassau - New Providence
The Bahamas
Email: [email protected]
Contact form: seobuddy.com/contact