Skip to content
Get in touch

This document is being finalised. Contact support with any question.

SEO-AI Privacy Policy

1. Who we are

SEO-AI is an add-on to the DrawSync website platform. It is operated by PineSeed Pty Ltd, Queensland, Australia ("PineSeed", "we", "us").

This policy explains how we handle personal information in SEO-AI. It follows the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). For customers in the European Union and the United Kingdom, section 12 adds the rights that the GDPR gives you.

The website you used to reach SEO-AI may have its own privacy policy for its own services. This policy covers SEO-AI only.

Contact: the Contact support button in SEO-AI.

2. What we collect

Identity. You sign in with your member account on the website. SEO-AI receives your member id, email address and display name.

Workspace and team data. Workspaces, their owners, team members and roles.

Your work. Projects (including your site address and settings), keywords, briefs, articles and every version of them, voice profiles and the writing samples you paste or link, and author and reviewer profiles.

Experience vault. Customer stories, quotes and photos you add. We remove EXIF data from photos and convert them to WebP. Other uploaded photos are handled the same way.

Connections. Your WordPress site address, username and application password. Your Google Search Console and Microsoft Bing tokens. We store the passwords and tokens encrypted. We also keep the search performance data those services return.

Site Submission Autopilot. Submission projects with your business name, address, phone number and categories, and the results of listings.

Billing. You pay through the checkout of the site you signed up on. The site's payment processor (Stripe) holds your payment details. SEO-AI keeps your plan status, checkout session ids and a ledger of credits. We never see or keep card numbers.

Usage and security. Usage and cost records, and a security and billing audit log that includes IP addresses.

Free tools. The inputs and results of free tool runs, and a one-way hash of the visitor's IP address. We cannot turn the hash back into the address.

Server logs. The hosting environment keeps server logs.

Third-party people. If you enter information about someone else, such as a client's business details, you must have the right to give it to us.

3. Why we use it

We use personal information to:

  • provide the service you asked for;
  • bill you and manage credits;
  • prevent abuse of the free trial (one free trial per person, checked by IP address, email domain and card);
  • keep the service secure;
  • give support;
  • improve quality, using aggregated metrics that do not identify you.

We do not sell personal information. We do not use data from Google for advertising.

4. Who we share it with

We share information only with the providers needed to run SEO-AI. They are called sub-processors. The full list, with their purpose, the data they receive, their country and when they are used, is in SUB-PROCESSORS.md. In short:

  • AI providers, run through the website's AI service, write and check articles.
  • DataForSEO supplies search data.
  • The site's checkout takes payments through its payment processor, Stripe.
  • Google and Microsoft provide Search Console, Site Verification, Knowledge Graph and Bing Webmaster access.
  • Plagiarism and AI detector services are used only if the site switches them on.
  • Twilio is used only for phone verification during directory submissions.
  • Listing vendors are used only when you submit to them.
  • Our hosting provider stores the data.
  • The DrawSync platform, also operated by PineSeed, handles email delivery and member accounts.

We may also disclose information where the law requires it, to protect people or the service, or to a buyer of the business under a confidentiality duty.

5. Sending information overseas (APP 8)

Some of our providers are outside Australia. Information may be sent to the United States, Lithuania, Israel, Canada, the United Kingdom, Germany and our hosting provider, depending on which features you use. SUB-PROCESSORS.md shows the country for each provider.

Before we send personal information overseas, we take steps that are reasonable in the circumstances to make sure the provider handles it consistently with the APPs. This is usually done through a contract. Please tell us through the Contact support button in SEO-AI if you have a concern.

6. How long we keep it

We keep each type of information only as long as we need it. The short version:

  • research cache: 30 days;
  • finished background jobs: 14 days;
  • Article API request log and delivered events: 90 days;
  • free tool runs: 90 days;
  • checkout session ids: with the workspace;
  • usage and cost records: 24 months;
  • billing and security audit log: 7 years, because of tax record rules;
  • workspaces and everything in them: until the owner deletes the workspace, then deleted at once.

The full schedule, including how each group is removed, is in DATA-RETENTION.md.

7. Security

We protect information with measures that suit the risk. These include encryption of WordPress application passwords and of Google and Microsoft tokens, access controls on workspaces based on roles, an audit log of security and billing events, and a hosting environment that we control. No system is completely secure. If a breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

8. Google user data and Limited Use

SEO-AI connects to Google Search Console and Google Site Verification when you choose to connect them. We use these scopes:

  • Search Console (webmasters), read and manage;
  • Site Verification.

We use the data only to show your search performance, track your rankings, verify your site, and run the features you asked for. We do not use it for advertising, we do not sell it, and we do not let people read it except as needed for support, security, legal reasons, or with your consent.

SEO-AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google in your project settings at any time, and you can also remove access in your Google account. When you disconnect, we delete the stored token.

9. Access and correction (APP 12 and 13)

You can ask for a copy of the personal information we hold about you, and you can ask us to correct it. Use the Contact support button in SEO-AI. We may need to confirm who you are. We will reply within 30 days. If we refuse a request, we will tell you why in writing.

You can see and change much of your information yourself in your workspace.

10. Complaints

If you think we have breached the APPs, tell us first through the Contact support button in SEO-AI. We will acknowledge your complaint and respond within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

11. Automated decisions

The free trial abuse check can refuse a free trial automatically. It looks at your IP address, your email domain, the site's robot check and how many free articles the site has given out that day. A refusal does not close your account. You can ask a person to review the decision by using the Contact support button in SEO-AI.

12. Customers in the EU and UK (GDPR)

If the GDPR or the UK GDPR applies to you, PineSeed is the controller for account, billing and security data. For the content you put into SEO-AI, PineSeed acts as your processor, and our data processing agreement applies. Ask for it through the Contact support button in SEO-AI. The template is in DPA-TEMPLATE.md.

Our lawful bases are:

  • Contract: to provide the service and bill you.
  • Legitimate interests: to keep the service secure, prevent trial abuse, give support and improve quality using aggregated metrics.
  • Legal obligation: to keep tax and billing records, and to respond to lawful requests.

You have the right to access your data, to have it corrected, to have it erased, to receive it in a portable form, and to object to processing based on legitimate interests. Use the Contact support button in SEO-AI to use these rights. You can also complain to your local data protection authority.

Where we send data outside the EU or UK, we use standard contractual clauses or another lawful transfer mechanism.

13. Erasing a member

A site administrator can use the erase tool for a member. It removes the workspaces that member solely owns and their personal data. It keeps de-identified billing records that the law requires us to keep.

14. Cookies

SEO-AI itself sets no advertising or analytics cookies and stores nothing in your browser for tracking. It counts steps such as a pricing page view or a finished article on its own server, without cookies. The website runs its own cookies, tags and any consent banner, not SEO-AI. Please read the website's cookie notice for details.

15. Changes

We may update this policy. For a material change, we will give 30 days' notice by email to workspace owners and by a notice in the product. The date at the top shows when it was last changed.

16. Contact

PineSeed Pty Ltd