Privacy Policy

We collect information in three ways: information you provide directly, information collected automatically when you use the service, and information from third parties (such as Google Search Console when you connect it).

Information you provide

• Account information: name, email, password (hashed, never stored in plain text), company name, and role.
• Billing information: handled by Razorpay. We receive payment status and transaction references, not your full card number.
• Communications: when you email us or use the contact form, we retain those messages so we can reply and reference them later.
• Content you create: projects, keyword lists, content briefs, comments, and other content you generate inside the platform.

Information collected automatically

• Usage data: pages visited, features used, query frequency, click patterns. Used to improve the product.
• Device data: IP address, browser type, operating system, screen resolution. Used for security and to render the UI correctly.
• Cookies and local storage: as detailed in our cookies section below.

Information from third parties

• Google Search Console and Google Analytics 4 data when you authorize those optional connections.
• OAuth profile data when you choose an available social sign-in method.
• Payment status and transaction references from Razorpay.

Google Search Console and Google Analytics 4 connections are optional. SEONova accesses Google data only after an authorized user starts the connection and grants the permissions shown on Google's OAuth consent screen. We request read-only permissions and do not use these connections to change your Google Analytics or Search Console configuration.

Google data we access

• Connection information: the Google account email used to authorize the connection, the permissions Google granted, and the selected Search Console site or Google Analytics property identifier and display name.
• Google Analytics 4 property metadata needed to list and select properties available to the authorized Google account.
• Google Analytics 4 reporting data for the selected property, including aggregated sessions, active and new users, page or screen views, engagement, average session duration, conversions or key events, traffic channels and campaigns, source information, page paths, country, device, browser, realtime activity, and cohort-retention metrics.
• Google Search Console reporting data for the selected site, including clicks, impressions, click-through rate, average position, queries, pages, countries, and devices.

How we use Google data

We use connected Google data only to provide and improve the user-facing integration features requested by the user: importing performance data, displaying analytics and SEO dashboards, generating reports, comparing search visibility with on-site engagement, and keeping those views synchronized. We do not use Google API data for advertising, retargeting, sale to data brokers, credit or lending decisions, surveillance, or training generalized artificial-intelligence or machine-learning models.

Storage and protection

• OAuth refresh tokens are encrypted at the application level using AES-256-GCM. They are excluded from ordinary database queries, logs, and client API responses. Short-lived Google access tokens are generated when needed and are not stored in our database.
• Production traffic is transmitted over HTTPS. Production databases and backups use infrastructure-provider encryption at rest.
• Connected data is separated by user and project. Authenticated access and project-authorization checks restrict it to authorized workspace users and the services required to operate the integration.
• OAuth requests use short-lived, signed state values to protect the authorization callback, and integration endpoints are authenticated and rate limited.

Sharing and Limited Use

We do not sell Google user data. We disclose it only to authorized members of the user's workspace, infrastructure service providers acting on our behalf where necessary to operate and secure the requested features, or when required by law. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Retention, disconnection, and deletion

• Stored Google Analytics daily reporting snapshots are automatically pruned after approximately 16 months. Short-lived on-demand and realtime report caches expire substantially sooner.
• Disconnecting a Google integration revokes the authorization where possible and deletes the stored OAuth credential, connected Google account email, granted permissions, and selected property or site from the active connection. Previously imported reporting history remains available under the retention schedule unless the project or data is deleted.
• Deleting a project permanently removes its stored Google Analytics and Search Console reporting data and connection history after the applicable account or project deletion period. Users may also request deletion by emailing privacy@seonova.io from the address associated with their account.

We use the information we collect to operate the service, communicate with you, improve the product, prevent abuse, and meet our legal obligations.

• Operate the platform: render the dashboard, run audits, deliver reports, sync integrations.
• Authenticate and secure your account: detect suspicious sign-ins, enforce rate limits, audit access.
• Communicate: send transactional emails (receipts, alerts, important updates) and optional product newsletters you can unsubscribe from.
• Improve the product: aggregated, anonymized service-usage analytics drive what we build next. Connected Google API data is subject to the narrower uses described in the Google API data section above.
• Prevent abuse and fraud: block scrapers, abusive automation, and violations of the Terms of Service.
• Meet legal obligations: comply with valid legal requests, tax requirements, and accounting laws in India and the jurisdictions where we have users.

We do not sell your personal information. We share data only with the sub-processors who help us run the service, with people you explicitly invite to your workspace, and where required by law.

Sub-processors

A current list of third-party services used to operate the production platform is published at /security. Provider terms and privacy documentation are linked there; contact privacy@seonova.io for current contractual details.

Within your workspace

Information you create inside SEONova is shared with the people you invite to your workspace. Workspace owners can see what every workspace member does inside the workspace.

Legal requirements

We may disclose information when required by law, court order, or to protect the safety of users or the public. Where legally permitted, we will notify you before disclosing your information.

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. No internet service can guarantee absolute security, but our current controls include:

• HTTPS for production network traffic and encryption at rest provided by our production infrastructure providers.
• Application-level authenticated encryption for stored OAuth credentials and strong one-way hashing for account passwords.
• Role- and project-based authorization, authenticated internal service communication, rate limiting, and separation of production service credentials.
• Logging and monitoring designed to detect operational and security failures without intentionally recording OAuth credentials.
• Dependency and release checks that block known high- or critical-severity findings from production releases.
• Documented deletion and credential-revocation paths for connected services and deleted projects.

To report a suspected vulnerability or security incident, contact security@seonova.io.

We keep your information only as long as we need to provide the service and meet our legal obligations.

• Active account data: retained while your account is active.
• After account closure: workspace data is preserved for 90 days in case you want to reactivate, then permanently deleted unless legal retention obligations require otherwise.
• Backups: encrypted backups are retained for 30 days, then overwritten.
• Billing records: retained for the period required by Indian tax law (typically 8 years).
• Support communications: retained for up to 2 years for context on future tickets.

Depending on where you live, you have specific rights over your personal information. We honor all of them globally, regardless of where you're located, because it's the right thing to do.

Your rights include

• Access - request a copy of the information we hold about you.
• Correction - request that we correct inaccurate information.
• Deletion - request that we delete your information (subject to legal retention requirements).
• Portability - request your information in a machine-readable format.
• Object or restrict - object to certain uses of your information, or ask us to restrict processing.
• Withdraw consent - where processing is based on consent, you can withdraw it at any time.
• Lodge a complaint - with your local data protection authority (in the EU), the Information Commissioner's Office (UK), the California Attorney General (CA), or India's Data Protection Board (DPDP).

How to exercise these rights

Email privacy@seonova.io from the email address associated with your account. We respond within 30 days, or sooner where the law requires.

We use a small number of cookies and local storage entries to operate the service. We do not use third-party advertising cookies.

• Essential cookies: authentication, session management, security. These cannot be disabled without breaking the service.
• Functional cookies: remember your preferences (dark mode, locale).
• Optional analytics: Google Analytics and Microsoft Clarity load only after you choose 'Accept analytics'. PostHog product analytics follows the same choice in the logged-in app.

Your analytics choice is stored in your browser and in a first-party SEONova consent cookie so it is honoured across seonova.io and app.seonova.io. You can change it at any time using Cookie settings in the footer or Accounts & Privacy in the app. Disabling essential cookies will prevent account features such as sign-in from working.

We're headquartered in India and use service providers that operate infrastructure in multiple countries. This means your information may be transferred across borders to operate the service.

Provider safeguards and contractual terms vary by service. Contact privacy@seonova.io for the current transfer details relevant to your account. A dedicated customer-selected data-residency option is not currently available.

SEONova is a business product not intended for children. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a child, email privacy@seonova.io and we will delete it.

We update this policy as our practices change. When required by law, we will provide notice before material changes take effect. The 'Last updated' date at the top of this page reflects the most recent meaningful change.

For privacy questions, data requests, or complaints, email privacy@seonova.io. For security issues, email security@seonova.io. For everything else, hi@seonova.io reaches the founding team directly.