Privacy Policy

Who we are

GuruSEO is an automated SEO service operated from Florida, United States. When this policy says “we” or “us”, it means GuruSEO. You can reach a person at support@guruseo.ai about anything on this page, including a request to see or delete your data.

The short version

• We connect to your Google Search Console and Google Analytics in read-only mode, to see where you rank and whether that turns into visitors.
• We never read your Gmail, your Drive, your contacts, or anything outside those two products.
• We do not sell your data, and we do not use it to train advertising or AI models.
• You can disconnect us from your Google account in two clicks, any time, and ask us to delete everything we hold.

What we collect

Account details

You sign in with Google. From that we receive your name and email address, and nothing else about your Google account. We use them to create your account and to email you your reports.

Business details you give us

During signup you may tell us your business or personal name, a contact name, phone number, address, what you do, and the area you serve. This is used to do the SEO work and to tailor what the agent writes. You choose what to enter.

Billing

Payments are handled by Stripe. We never see or store your full card number — Stripe does that. We keep a Stripe customer reference, your plan, and your subscription status so we know whether your account is active.

Your website and its connection

We store your site’s address and what platform it runs on. To publish changes for you, you connect your site (for example by installing our WordPress plugin, or pasting a scoped access key for another platform). Any such key is encrypted before it is stored and is only ever used to make the edits you have approved. We never ask for, and you should never give us, your website administrator password.

Google Search Console and Google Analytics data

When you connect Google, we request these scopes and no others:

• Search Console (read-only) — webmasters.readonly. We read your search rankings, impressions, clicks, and which of your pages Google has indexed.
• Analytics (read-only) — analytics.readonly. We read your visitor numbers and how people arrive at your site.

Both are read-only. We cannot change, add to, or delete anything in your Search Console or Analytics. We store the resulting figures so the agent can work overnight and compare this week to last, and we store the Google access and refresh tokens — encrypted — so you do not have to reconnect every day.

Limited Use — how we handle Google user data

GuruSEO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Search Console and Analytics data only to provide and improve the SEO features you signed up for.
• We do not transfer this data to others except as needed to provide the service (see subprocessors below), for security, or to comply with the law.
• We do not use this data for advertising, and we do not sell it.
• We do not let humans read your Google data except with your explicit consent (for example, when you ask support for help), where required for security, or to comply with the law.
• We do not use your Google data to train generalised AI or machine-learning models.

What we make with your data

The agent produces reports, a record of the changes it made, and drafts for you to approve. These are stored on your account so you can see the history and so each change can be rechecked and, if needed, reversed.

Where it is stored, and how it is protected

• Access keys and Google tokens are encrypted with AES-256-GCM before they are written to the database. The key that decrypts them is held separately from the data.
• Every account’s data is isolated by row-level security, so one customer cannot read another’s — enforced by the database, not just the app.
• Traffic is encrypted in transit (HTTPS).

Who we share it with

We do not sell your data. We use a small number of subprocessors to run the service, each of which only receives what it needs:

• Supabase — our database and sign-in. Stores your account, business details, encrypted tokens, and the agent’s work.
• Vercel — hosting. Serves the website and runs the application.
• Stripe — payments. Handles your card and billing.
• Google — the source of your Search Console and Analytics data, under your connection.

How long we keep it

We keep your data while your account is open. If you close your account or ask us to delete it, we remove your personal data and revoke stored tokens within 30 days, except where we must keep limited billing records to meet legal and tax obligations.

Your choices and rights

• Disconnect Google. You can revoke our access from your Google Account permissions page at any time. You can also disconnect from inside your GuruSEO dashboard.
• See or delete your data. Email support@guruseo.ai and we will send you a copy, or delete it.
• Depending on where you live, you may have additional rights to access, correct, export, or object to the use of your data. Contact us and we will honour them.

Cookies

We use only the cookies needed to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies.

Children

GuruSEO is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

If we change how we handle data, we will update this page and its date, and — for material changes — tell you by email. Continuing to use the service after a change means you accept the updated policy.

Contact

Questions, requests, or complaints: support@guruseo.ai. See also our Terms of Service.