Last updated September 7, 2026.
Operator and contact
SEOPlan.com is the controller responsible for personal information used to operate the website, administer accounts and provide its services.
SEOPlan.com uses personal information to operate this website, administer accounts and provide SEO audit, reporting and analysis services. For privacy enquiries, support or deletion requests, email contact@seoplan.com. This notice covers optional Google connections and AI analysis as well as account and website use.
Information we process and why
We receive information from you, authorized workspace members, public pages submitted for audit, connected Google properties and service providers. It can include account names, email addresses, company details, verification records, workspace membership, website addresses, audit findings, research keywords, saved reports, tasks, monitoring settings, Google property identifiers and performance information, subscription identifiers, payment status, usage, support messages, and device and network information.
We process information to provide requested services and administer accounts under our contract with you; to meet applicable legal obligations; and for our legitimate interests in protecting the service, preventing abuse and resolving problems. Optional AI evidence transfers require your affirmative agreement. Where consent is the legal basis, you may withdraw it without affecting earlier lawful processing.
Registration information is needed to create and protect your account. Google connection and AI analysis are optional; declining them does not prevent use of unrelated features. Do not submit passwords, private network addresses, confidential material or unnecessary personal information. URLs and search queries can contain personal information.
Hosting and technical logs
Our Namecheap hosting service is US-based. Web-server logs can include IP addresses, timestamps, requested URLs, response codes, referrers and browser information. Relevant technical records support reliability, fault investigation and abuse prevention. Infrastructure logs are separate from application records. We do not promise a 30-day deletion period for hosting logs.
Audits and market research
Audits request public webpages and record technical findings. Private report access uses account permissions or private access mechanisms. Protect private links and downloads. Assigning an eligible report to a verified account associates it with that account. Market research sends the relevant domain, keyword or topic and selected market to DataForSEO; results are estimates, not guarantees.
Optional Google Search Console and Analytics connection
With your authorization, SEOPlan requests read-only Search Console and Analytics access. Property names and identifiers let you select appropriate properties. Information for selected properties may include queries, page URLs, clicks, impressions, click-through rates, positions, aggregate sessions, users, landing pages and key events.
We use this information for dashboard reports, comparisons, priority signals, configured monitoring, task measurement and requested analysis. Scheduled features may refresh it while your connection is active. These permissions do not let SEOPlan edit or delete your Google property data. We do not collect your Google password. Stored access and refresh tokens are encrypted in the application database.
Google evidence is used for these disclosed user-facing features, not sold or used for targeted advertising. Human access for support requires affirmative permission to view the specific Google data, unless an applicable policy exception permits access, such as a necessary security investigation or compliance with law. These restrictions also apply to derived Google evidence.
SEOPlan’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Optional AI SEO Analyst
Before a fresh analysis, you must agree to send the selected website’s evidence to OpenAI. This can include audit findings and matching Google metrics, queries, pages and derived signals. Limited request context includes the website, plan, audit reference and a pseudonymous safety identifier. Account contact details, billing details and Google credentials are not included in the analysis evidence. URLs and queries may nevertheless contain personal information.
You can decline and use other tools. Viewing a saved result or reusing unchanged evidence does not send a fresh request. After a successful request, we retain a minimal latest-consent record identifying the disclosure version, website, requesting user and time.
We request that the API response not be stored as retrievable application state. This is not zero data retention. OpenAI documents separate abuse-monitoring retention, normally up to 30 days, with exceptions including legal requirements. API data sharing for model improvement is disabled in our configuration. See OpenAI’s data controls. AI recommendations can be inaccurate and require human review. Scores and advice do not make legal or similarly significant decisions about individuals.
Recipients, billing and sharing
Authorized workspace members can access information according to their roles. Owners should manage invitations and access carefully. Shared progress links expose their selected snapshot until expiry or revocation; downloaded copies cannot be recalled. Customer API access is workspace-restricted; issued API secrets are stored as cryptographic authentication records rather than retrievable full secrets.
Providers support hosting and backups (Namecheap), security and abuse prevention (Cloudflare), connected Google services, optional analysis (OpenAI), market research (DataForSEO) and transactional email. Stripe handles payment information; SEOPlan receives subscription and payment-status information but not full card details. Information may also be disclosed where legally required or necessary to establish or defend legal claims. Provider responsibilities depend on their services and applicable terms.
Transactional email
Website emails are configured through GoSMTP using Namecheap SMTP with TLS. Recipient addresses, message content and delivery metadata are processed to send account, verification, billing, reporting and support messages. Local email logging has a one-month retention setting; attachment logging is disabled. This does not determine how long recipients, mailboxes or hosting backups keep delivered messages.
International processing
Our hosting is US-based and other providers may also process information outside the European Economic Area. Location alone is not a transfer safeguard. Where required, transfers need an applicable adequacy decision, Standard Contractual Clauses or another lawful mechanism.
Namecheap publishes a Data Processing Addendum for covered services, including applicable Standard Contractual Clauses. Cloudflare publishes processing and transfer terms, and DataForSEO’s terms incorporate its processing agreement where applicable. These documents do not mean all providers have identical arrangements. Email contact@seoplan.com for information about applicable safeguards or to request a copy.
Retention and backups
- Private audit reports normally expire after 30 days.
- Google evidence history, Google signal alerts and saved AI results have a 180-day scheduled-cleanup threshold. AI cleanup runs in batches; newer results may replace older ones sooner.
- Application contact submissions are scheduled for deletion after 730 days; this does not automatically delete delivered correspondence.
- Google caches generally have validity periods of 15 minutes to six hours. Expiry does not guarantee immediate physical removal.
- Progress shares expire within a maximum of 30 days. Revocation does not remove downloaded copies.
- Market reports and user-created tasks are not covered by the Google/AI 180-day purge. The seven-day market-report reuse window is not a deletion deadline; these records require separate deletion handling.
Account, membership and service records support the active account. Closure and deletion requests are assessed against remaining service purposes, accounting obligations, actual disputes or security investigations and relevant legal claim periods. Records are not exempt from deletion simply because they fall outside an automated cleanup job.
Backups may contain earlier copies after live records are deleted. Namecheap describes backup availability for up to six months; this is not a guarantee of permanent erasure on that date. We do not promise immediate deletion of backup copies. Retention is not guaranteed after hosting cancellation, and backups may be removed without notice.
Disconnecting Google and requesting deletion
Disconnecting Google removes stored credentials and property selections and attempts to revoke authorization. It does not delete historical evidence or undo requests already sent. You can also revoke access through your Google Account. Revoking an authorization used across workspaces may require reconnection elsewhere.
For evidence or account deletion, email contact@seoplan.com with the account and scope concerned. Proportionate identity and workspace-ownership checks may be necessary. Do not send passwords.
The evidence-erasure process removes the Google connection, saved Google/AI evidence, all workspace tasks, alerts, workflow results and progress shares. It is not complete account deletion: audit and market reports, membership, billing and security records need separate handling. We assess retained records and explain applicable grounds for retention. Caches, backups and copies delivered to others may not disappear immediately.
Cookies and website analytics
Cookies and browser storage support authentication, private report access, security and preferences. CookieAdmin manages consent preferences; its consent cookie is configured for 365 days. This is separate from server-side consent records, whose automatic cleanup is not currently enabled. Cloudflare Turnstile may process device and network signals for abuse prevention. Blocking essential storage can prevent sign-in or private report access.
Separately from customer Google reporting connections, we use Google Analytics to understand use of our public website based on your consent. Our consent-controlled loader loads the Analytics tag after you accept analytics cookies, individually or through Accept All. Site Kit’s automatic tracking-code insertion is disabled. Declining analytics does not prevent use of the service.
Analytics can process page views, page addresses and titles, pseudonymous cookie identifiers, browser and device information and interactions. The optional _ga cookie distinguishes visitors and _ga_VVFKED6DPR maintains session state. Google’s documented default cookie lifetime is up to two years; browser limits and settings can shorten it. Cookie lifetime is not the retention period for data already sent to Google. See Google’s cookie information.
Reopen cookie preferences, turn Analytics off and save to withdraw consent. The loader disables collection and reloads the page to stop the running Analytics script. Withdrawal does not recall previously sent information. Account and private-report pages are excluded from this public-site loader. Google dashboard authorization is separate from website-analytics consent and does not grant advertising consent.
Security, your rights and policy changes
We use access controls, HTTPS, input validation, rate limiting and other technical protections. Token encryption does not mean every report or backup is encrypted at rest. No internet service can guarantee absolute security. The service is intended for business use and is not directed to children.
Subject to applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests and withdraw consent. Contact contact@seoplan.com. Requests are handled within applicable legal time limits; permitted extensions will be explained. You may complain to the Lithuanian State Data Protection Inspectorate or another competent supervisory authority.
We may update this policy to reflect changes in services, data practices or legal requirements. The latest version and date appear here. For material changes, we provide appropriate notice and obtain consent where required. New uses of Google data require updated disclosures and authorization where required.