Privacy Policy

This policy explains what personal data we collect when you visit seomise.com or use SEOmise, why we use it, who we share it with, how long we keep it and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and, where it applies, the UK GDPR.

1. Who we are

SEOmise is operated by SEOMISE LTD, of Unit 2, Chruch Street, Kilcock Co. Kildare, W23 HW89.

For anything about your personal data, contact us by e-mail at [email protected].

2. When we are controller and when we are processor

• Controller. We decide how and why your account, billing and security data is used, data about visitors to this website, AskMise conversations and leads, and the anonymous statistics described in section 7. This policy covers that data.
• Processor. The websites, Google Business Profiles, reviews, visitor data from the Live view tracker and other content a customer adds to a workspace belong to that customer. We process it on the customer's instructions to provide the service, under the Data Processing Agreement. If you are a visitor to a customer's site or a reviewer, the customer is the controller; please contact them first and we will help them answer.
• ReFame. When a reputation agency uses ReFame, the agency is the controller of what it monitors and we are its processor.

3. What we collect

• Account data: your name, e-mail address, phone number, role, password (stored only as a one-way hash), two-step sign-in settings and recovery codes (also hashed), sign-in history and the versions of our terms and this policy you accepted, with the time.
• Billing data: your plan, billing period, invoices and the customer reference held by our payment provider. Card details are entered on the payment provider's own pages and never reach our servers.
• Workspace and project data: the websites, competitors, keywords and apps you add; scan, audit and rank results; backlink data; the changes you approve; your industry; and what you do in SEOmise (for example which suggestions you accept, edit or reject).
• Connected Google data: if you connect them, Search Console, Analytics (GA4), Google Ads and Google Business Profile data such as search figures, locations, reviews, questions and posts.
• Website data through connectors: if you install the WordPress, Laravel or universal connector, it sends us information about your site (pages, settings, software versions, missing pages) and applies the changes you approve.
• Visitor data through the tracker: if you add the Live view tracker to your site, it records visits, pages, clicks and scrolling, with IP addresses shortened by default. This is your data; we process it for you.
• AskMise and pop-ups: the questions you ask our assistant on this website and its answers, and, if you give them, your first name, e-mail address and phone number (stored encrypted), the kind of business, your website address and the checks the assistant ran. Pop-ups ask for the same details and record the consent line you agreed to, its version and the time. Newsletter sign-ups are confirmed by e-mail first (double opt-in).
• Free audits: the website address you check and the results. To show where the site is hosted, we look up the site's DNS records and the server's country and network operator. To apply the daily limit we keep a random number in a cookie and a keyed hash of your IP address, never the address itself.
• Messages: e-mails and help requests you send us, and our replies.
• Reports we make for businesses: our staff may check a business's public website and send the business a short report as a private link, to an address the business publishes for enquiries (or to you, if you subscribed to our newsletter). We keep the report, the address it went to (encrypted), whether the e-mail and the report were opened, the buttons pressed and the offer claimed. Only when you allow analytics cookies do we also record how long the report was read, how far it was scrolled and which parts were opened; never when your browser sends Global Privacy Control or Do Not Track. No other company's tracker is used. Every such e-mail has a one-click opt-out, after which we never contact the address again.
• Help centre questions: what you ask our assistant (AskMise) in the help centre or on this website, its answers, any rating you give, the page you asked from, the kind of device and the browser language, linked by a random number in a cookie and a keyed hash of your IP address (never the address itself).
• Security data: an audit log of security-relevant actions and an action timeline per project. In the audit log, IP addresses are kept only as a keyed hash.
• Cookies: see the Cookie Policy.

We collect this data from you, from people in your workspace, from the services you connect, from our payment provider and from public sources (such as the public web pages our crawler reads). We do not buy personal data.

4. Why we use it and our lawful basis

Purpose	Lawful basis (GDPR Article 6)
Creating and running your account and workspace, and the features you use	Contract
Taking payment, issuing invoices and keeping accounting records	Contract, and legal obligations under tax and company law
Service e-mails: invitations, password resets, alerts, reports you schedule, notices about changes to our terms	Contract
Keeping the service secure: two-step sign-in, rate limits, the audit log, investigating misuse	Legitimate interest in protecting the service and our customers
Improving the service, including training and testing our own models and rules, and building anonymous statistics (section 7)	Legitimate interest in a better product (you can object)
Answering your questions, AskMise and support	Contract, or legitimate interest in replying
Following up a lead from AskMise, a pop-up or the free audit; newsletters and offers	Consent, which you can withdraw at any time
Sending a business a report on its public website, to an address it publishes for enquiries, and seeing whether it was read	Legitimate interest in offering our service to businesses (you can opt out with one click; sole traders only with their consent)
Complying with lawful requests from authorities	Legal obligation

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to what is needed.

5. The Data Vault

We keep an encrypted record of the outside calls SEOmise makes (for example to search-data and AI providers), the answers that come back, AskMise conversations, pages our crawlers fetch and audits, so we can check what happened, avoid paying twice for the same answer and investigate problems. Records are encrypted, passwords and keys are removed before anything is written, and each record is deleted at the end of its retention period: at most 1 year, and sooner where the data's source requires it (for example 30 days for Google data). Only staff with special permission can open the Vault, with a fresh two-step code each time, and every look is logged.

6. AI

AI features run when someone in a workspace uses them (and for AskMise on this website). Only the text needed for the task is sent to the AI provider, through our own gateway. AI output is a draft: a person approves it before it is published anywhere. Under our agreements with them, we do not allow the AI providers we use to train their models on customer data sent through SEOmise. The AI Transparency Statement has the details.

7. How we use data to improve SEOmise

We use the data the service handles (scans, audits, searches, results, AskMise conversations, and which suggestions people accept or reject) to operate, secure and support SEOmise, to improve it, including developing, training, testing and evaluating our own models, rules, rankings and recommendations, and to build aggregated, de-identified statistics and benchmarks. We keep it for the periods in the Data Retention Policy.

• We de-identify or aggregate data wherever we can.
• Anonymous group figures are built only from groups of at least 10 separate businesses (an agency and its clients count as one), no single business may make up more than 30% of a group, and a little random noise is added to each figure. They never contain names, domains or website addresses.
• Text people type is never pooled as written; at most it is reduced to topics and counts, with personal data removed first.
• Google data (Search Console, Analytics, Business Profile and any other Google API user data) is never used to develop, improve or train AI or machine-learning models, and is never pooled.
• Google API user data and Limited Use. SEOmise's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words:
  • We only ask for the Google access a feature you switch on needs, and use it only for that feature: Search Console for your search figures (and, only if you switch it on, to submit your sitemap); Analytics (GA4) for visits and conversions; Google Business Profile to show your locations, reviews, questions and posts and, when you approve them, to publish your replies and posts; Google Ads to report on campaigns and, if you switch it on, to send offline conversions from your leads.
  • When you ask for a draft (for example a review reply), the text needed for it is sent to our AI provider only to write that draft for you; it is not used to train their or our models.
  • We do not sell Google data, use it for advertising, or transfer it to anyone except to provide these features, to comply with the law, or as part of a merger or sale with the same protections.
  • Our staff read Google data only with your permission (for example when you ask support for help), for security or abuse investigations, or where the law requires it.
  • Copies of Google's answers kept in our encrypted record of outside calls (section 5) follow the same rules and are deleted within 30 days where Google's terms ask for it.
  • You can disconnect Google at any time in the project's settings, and remove SEOmise's access in your Google Account under Security → Third-party apps with account access. We then stop fetching and delete the stored Google data within our retention periods.
• Bing reports you upload are not pooled, and data licensed from search and backlink providers is used only as their licence allows.
• Opting out: a workspace owner can switch off Help improve SEOmise's advice under Account. From the next daily update the workspace's figures are left out of every pooled figure. Use of the data inside your own workspace continues, because the service needs it to work for you.
• Objecting: where personal data is involved our lawful basis is legitimate interests, and you can object at any time by e-mail at [email protected] or under Account → Privacy. We will stop unless we have compelling legitimate grounds.

The Data Use Policy explains this in more detail.

8. Who we share it with

We use the service providers (sub-processors) below. This list is generated from the services switched on in this installation, so it is always current. The maintained list, with transfer safeguards, is on our sub-processors page, and workspace owners can accept our Data Processing Agreement.

Each provider acts on our instructions under a data processing agreement. Agencies that serve you through SEOmise see the data in the projects they manage for you. We may also disclose data where the law requires it, to protect our rights, or to a buyer of our business, who would be bound by this policy. We never sell personal data.

9. Transfers outside the EEA and the UK

Some providers process data outside the European Economic Area or the United Kingdom. When they do, the transfer is protected by an adequacy decision (for example the EU–US Data Privacy Framework for certified US companies) or by the European Commission's Standard Contractual Clauses, with the UK addendum where UK data is involved. You can ask us for a copy of the safeguards.

10. How long we keep it

The Data Retention Policy lists every period. In short:

• Account and project data: while your workspace exists. When a project is deleted, its scans, issues, backlink data and timeline go with it.
• Scan history: older scans are deleted every day according to your plan (below). The Day 0 baseline (your first scan) and the latest scan of every site are always kept while the project exists, so you can see progress from the start.
• Google Business Profile content: 30 days, refreshed from Google while you stay connected.
• Leads from AskMise, pop-ups and the contact form: 12 months after their last change. Help centre questions and AskMise conversations on this website are deleted automatically 12 months after the last message.
• Audit log: kept for the life of the workspace; it is append-only and its IP addresses are keyed hashes.
• Billing records: as long as tax and company law requires, even after an account is closed.
• A closed account can be brought back for 14 days and is erased after 30 days.

Before anything you can see is deleted automatically, the app warns you with a countdown at the top of every page (by default 14 days before, 7 days before and on the day), so you can export it first; the help article "What gets deleted and when" lists every kind.

Scan history per plan:

• Free: 30 days
• Personal: 1 year
• Business: 2 years
• Agency: 3 years
• Workspaces without a plan keep scan history for 10 years

11. Your rights

You have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to our use of it, to receive the data you gave us in a portable format, and to withdraw consent. You can do most of this yourself under Account → Privacy: download your personal data (JSON and CSV), ask for a correction, restrict or object to optional processing, and erase your account (it runs after a cooling-off period of 14 days, which you can cancel). Workspace owners can also export or delete the whole workspace. For anything else, contact us by e-mail at [email protected]. We answer within 30 days and may ask you to confirm who you are first.

12. Children

SEOmise is a business service and is not meant for anyone under 16. We do not knowingly collect children's data.

13. Complaints

If you are unhappy with how we handle your data, please tell us so we can put it right. You also have the right to complain to the Data Protection Commission (DPC) (dataprotection.ie), or to the supervisory authority where you live or work.

14. How we protect it

Data is encrypted in transit (HTTPS). Passwords and recovery codes are hashed; API keys, connection tokens and the Data Vault are encrypted at rest. Access inside a workspace is limited by role, two-step sign-in is available to everyone and required for our staff, and support access to a workspace needs a recorded reason. Our security page has more.

15. Cookies

We use only the cookies needed to run the site and the app; the Cookie Policy lists every one.

We do not use advertising, analytics or other third-party tracking cookies. If that changes, we will ask for your consent first; you can review your choice at any time with Cookie settings.

16. Changes to this policy

When we change this policy we publish a new version with what changed. If a change materially affects how we use your data, we tell workspace owners by e-mail and in the app at least 30 days before it applies.