Privacy Policy

1. Controller and scope

SEO Actions controls data collected to run the site, accounts, billing, security, and customer relationship. The operating person or entity and fiscal address appear in the applicable order, invoice, receipt, or agreement. For visitors without a contract, contact support@seoactions.com; the controller is domiciled in Mexico.

When a customer uses SEO Actions to process data in its content, sites, or integrations, that customer determines purposes and means and SEO Actions acts as processor under its instructions and the DPA.

2. Data we process

• Account and profile: name, email, identifiers, organization, role, preferences, and authentication data managed by the identity provider.
• Commercial and transaction data: plan, subscription status, invoices, taxes, and payment metadata; the payment processor handles full card data where applicable.
• Customer Content: instructions, prompts, keywords, Brand DNA, drafts, files, images, calendars, sites, metadata, and generated results.
• Integrations: provider, identifiers, permissions, encrypted tokens or authorized credentials, settings, and data retrieved from connected CMSs, repositories, analytics, or social accounts.
• Usage and device: IP, browser, system, language, route, events, dates, logs, errors, performance, security, local storage, and cookies.
• Requested sources: public site content and accessible sources when a user requests audits, research, or source-based generation.
• Communications: support requests, feedback, messaging choices, and submitted documents.

3. Sensitive and third-party data

SEO Actions is not designed to collect sensitive personal data or regulated children's data. Do not submit it unless strictly necessary, legally supported, expressly consented where required, and protected by agreed safeguards. If you provide another person's data, you are responsible for notice and valid authorization or legal basis.

4. Purposes and legal bases

• Create accounts, provide contracted features, generate content, run workflows and integrations, and support users: contract performance.
• Handle charges, invoices, taxes, and accounting: contract and legal obligations.
• Prevent abuse, fraud, unauthorized access, and incidents; debug and secure the Service: legitimate interests, security, and legal duties.
• Measure use and improve performance and experience: consent for non-essential analytics where required; otherwise legitimate interests subject to your rights.
• Send operational and contractual notices: contract or law. Optional marketing relies on consent and offers unsubscribe.
• Answer lawful authority requests, enforce rights, and resolve disputes: legal duty and legitimate interests.

5. Artificial intelligence

Necessary inputs, content, and context may be sent to model providers through configured AI infrastructure. We do not use Customer Content to train our own models. Each provider's processing depends on the contract, settings, and feature, so do not include unnecessary secrets or personal data.

SEO Actions provides recommendations and content/SEO automation but does not make solely automated decisions producing significant legal effects about individuals. The user decides what to approve or publish.

6. Processors, integrations, and recipients

Depending on enabled features, we use providers for identity, cloud, database, storage, email, payments, analytics, observability, workflows, AI, search, and data extraction. These may currently include Clerk, Convex, Vercel, Sentry, Resend, providers reached through Vercel AI Gateway, Apify, and DataForSEO.

We also disclose data to services you connect, such as Google, GitHub, CMSs, repositories, or social networks, under your permissions. We may disclose to advisers, corporate acquirers, or authorities when necessary and lawful. We require confidentiality and protection appropriate to the role. We do not sell personal data for money or share it for cross-context behavioral advertising.

7. International transfers

Providers may process data outside Mexico or your country. Where required, we use recognized mechanisms such as contractual clauses, adequacy decisions, or European Commission Standard Contractual Clauses, with appropriate supplementary safeguards. You may request information about the applicable mechanism.

8. Retention

We retain data while an account is active and afterward only as needed to provide the Service, allow export, meet tax or legal duties, resolve disputes, prevent fraud, and enforce agreements. Security and support logs follow risk-based periods; backups expire in ordinary cycles. When no longer needed, data is reasonably deleted, blocked, or anonymized.

9. Security and incidents

We apply administrative, technical, and physical safeguards proportionate to risk, including access controls, logical separation, credential protection, encryption in transit and, where infrastructure supports it, at rest, logging, and incident management. No system is absolutely secure. We will give legally required breach notices and, for Customer Data, follow the DPA.

10. Your rights and choices

• Mexico: access, rectification, cancellation, and objection (ARCO), consent withdrawal, and restriction of use or disclosure.
• EEA/UK: access, correction, deletion, restriction, portability, objection, consent withdrawal, and complaint to an authority.
• California and similar laws: know, access, correct, delete, copy, and non-discrimination; we do not sell or share data for cross-context behavioral advertising.
• Cookies: accept or reject non-essential analytics and change the choice from the Cookie Policy.
• Messages: unsubscribe from marketing; essential operational notices continue while the relationship exists.

11. Exercising privacy rights

Email support@seoactions.com with your name, response channel, requested right, data description, and related account or project if helpful. We may request reasonable identity or authority verification without collecting more than necessary.

In Mexico, we will communicate our determination within 20 business days and, if granted, implement it within the next 15 business days, subject to lawful extensions and exceptions. Elsewhere we use applicable deadlines. Requests are free except permitted reproduction or delivery costs.

If SEO Actions only processes the data for a customer, we will refer the request to that customer or assist under its instructions.

12. Children

The Service is for adults and organizations, not children under 18. If we learn that a child's data was submitted without valid authorization, we will take reasonable steps to delete it.

13. Changes

We will post changes here and update the date. Where law requires, we will reasonably notify material changes before they apply. If a new purpose requires consent, we will request it first.

14. Contact and authority

Contact SEO Actions privacy at support@seoactions.com. In Mexico, you may also contact the Secretariat of Anticorruption and Good Government under the Federal Law on Protection of Personal Data Held by Private Parties. You retain the right to contact any competent authority where you live.