Privacy Policy
Last Updated: 7 August 2026
Welcome to QuickSEO (https://quickseo.ai). This privacy policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.
When you sign up, we collect:
- Email address: If you sign in with a one-time code, this is the only account information we collect at sign-up.
- Profile data: If you sign in via Google OAuth, we also collect your full name and profile picture as provided by Google.
Google Search Console Authorization
Connecting Search Console is optional and separate from signing in. If you choose to connect it, we collect:
- Google OAuth tokens: Access and refresh tokens used to connect to Google Search Console on your behalf. We request read-only access. The tokens are stored in our database, reachable only by our backend service, and used only for authorized API access.
Google Search Console Data
We do not store your Search Console metrics. Keywords, search queries, page performance (clicks, impressions, average position, CTR), and device and country breakdowns are fetched live from the Google Search Console API each time you open a dashboard, and discarded once the page is rendered. The only Search Console details we save are the property you select (for example sc-domain:example.com) and your permission level on it.
Two things do leave or outlive the request:
- When you ask us to suggest AI prompts or article topics, we send your top search queries — and, for article topics, your top page URLs — to OpenAI. The suggestions the model returns are stored in your account; the underlying Search Console rows are not.
- If you connect an AI assistant to our MCP server, that assistant receives Search Console data live in response to its own requests (see Section 3).
AI Visibility Tracking Data
When you use AI visibility features, we collect and store:
- Prompts: The search prompts you create to track brand mentions across AI platforms.
- AI responses: Raw responses from AI platforms (ChatGPT, Claude, Gemini, Perplexity) are stored for analysis.
- Visibility scores: Parsed brand mention positions, citation URLs, and sentiment analysis results.
- Competitor data: Competitor brand mentions detected in AI responses.
When you subscribe to a paid plan:
- Stripe customer ID: We map your account to a Stripe customer record.
- Billing address: Collected by Stripe during checkout.
- Subscription status: Plan, billing cycle, and payment status are synced to our database.
We do not store credit card numbers or full payment details — these are handled entirely by Stripe.
Website Content
When you set up AI visibility tracking, we scrape your website's public content using Firecrawl. We store that content on your site record. If you have autopilot content generation switched on for the site, we re-scrape it roughly weekly; otherwise the snapshot taken during setup is kept as it is until you re-analyze the site yourself. It is used to generate AI prompts, article topics, and article drafts, which means excerpts of it are sent to the AI providers listed in Section 3. If your public pages include personal information — staff names, contact details, testimonials — that information is part of what we store and send. We keep it until you delete the site; it does not expire on a timer.
Free AI Visibility Audit
Our free AI visibility audit does not require an account. When you submit it, we store:
- Email address and website URL: So we can run the audit and email you the report.
- IP address and browser user agent: Taken from the submission request and used to rate-limit abuse of the free audit.
- The report: Your brand name, niche, scores, and the full AI responses we generated, kept so your report link keeps working.
We also add your email address to a marketing audience in Resend so we can follow up about the audit. Every marketing email we send carries an unsubscribe link, and a one-click unsubscribe header your email client can act on directly. Unsubscribing stops all marketing email from us immediately. You can also reply to any of our emails, or write to support@quickseo.ai, and we will remove you. Messages about your own account — sign-in codes, billing notices and receipts — are not marketing and are not affected by unsubscribing.
Our other free tools do not require an account and we do not store what you enter into them. Several of them do send your input somewhere else in order to produce a result:
- Text, URLs, and page copy you submit to our AI-powered tools go to OpenAI.
- The image alt-text generator takes an image URL, not a file upload. Our server fetches that URL, then sends the image it downloaded to OpenAI.
- The domain you enter in the Domain Rating checker goes to Ahrefs.
- The hostname you enter in the SSL checker is sent to crt.sh, a public Certificate Transparency log search service, and our server also requests that host directly over HTTP and HTTPS.
- The domain you enter in the DNS lookup tool is resolved by our server through the public DNS system.
Don't paste anything confidential into them.
Usage and Analytics Data
- Datafast: We use Datafast analytics to track page views and events. Datafast uses cookies (visitor ID and session ID) for visitor tracking. If you start a checkout, we pass your Datafast visitor and session IDs to Stripe as metadata so we can attribute the subscription to the visit that led to it — which links that otherwise pseudonymous visitor ID to your customer record. We also report requests from AI and search-engine crawlers to Datafast from our server.
- Vercel Analytics: Performance metrics are collected automatically by our hosting platform.
- Google Tag Manager: Used for conversion and marketing analytics. GTM is the container we configure tracking pixels in, currently including:
- Facebook Pixel (Meta): Used for conversion tracking and retargeting on Facebook and Instagram. Subject to Meta's Privacy Policy.
- Reddit Pixel: Used for conversion tracking and advertising attribution on Reddit. Subject to Reddit's Privacy Policy.
- Google Analytics: Used for website traffic analysis and conversion tracking.
- Our Content Security Policy also permits other marketing and measurement endpoints we may enable through the same container. That list is not exhaustive, but it currently includes Google Ads, Microsoft Advertising (Bing), Microsoft Clarity, and Meta's Conversions API Gateway.
- Email engagement: Resend reports when our emails are delivered, opened, clicked, or bounced, and we store those events against your account.
- The Google Tag Manager container itself loads on every page. In the EU/EEA, UK, Switzerland, and Brazil we set Google Consent Mode to "denied" by default until you accept. Consent Mode is a signal Google's own tags honour — it withholds analytics storage, advertising storage, advertising user data, and ad personalization from them. It is not something we can enforce on non-Google pixels such as Meta's or Reddit's, which are configured inside the GTM container. In those regions, Datafast and Vercel Analytics do not load at all until you accept, and never load if you decline. Everywhere else they load on every page unless you have recorded a refusal through our Cookie preferences control, which we honour wherever you are — see Section 8.
Cookies and Local Storage
- Authentication cookies: Set by Supabase to manage your session.
- Sidebar state cookie: Remembers your dashboard sidebar preference (
sidebar_state, 7-day expiry).
- Datafast cookies: Visitor ID and session ID cookies for analytics.
- GTM/Google Analytics cookies: Only set with your consent in regulated regions.
- Facebook Pixel cookies: Used for ad targeting and conversion measurement. Only set with your consent in regulated regions.
- Reddit Pixel cookies: Used for ad attribution and conversion tracking. Only set with your consent in regulated regions.
- Local storage: UI preferences such as date ranges, chart grouping, and the branded/non-branded filter; your cookie consent choice; which sign-in method you last used; the website URL you type into a "get started" form on our public marketing pages, saved so it survives signing up; and, if you arrived from a completed free AI visibility audit, a copy of that audit's result — the URL, brand name, niche, suggested prompts, and suggested competitors — cached so we can prefill onboarding for you.
reCAPTCHA
We use Google reCAPTCHA v2 (the "I'm not a robot" checkbox) on our sign-in form and blog sign-up form to prevent spam and abuse. reCAPTCHA may collect hardware and software information, such as device data and application data, and send it to Google for analysis. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.
- To provide our services: Fetching Google Search Console data, running AI visibility scans, generating analytics dashboards, and delivering SEO insights.
- To generate content: Producing prompt suggestions, article topics, article drafts, and cover images from your website content and Search Console queries using the AI providers listed below.
- To process payments: Managing subscriptions, billing, and account status via Stripe.
- To send transactional emails: Account notifications, onboarding emails, and service updates via Resend.
- To run the free AI visibility audit: Generating your report, emailing it to you, following up about it, and rate-limiting abuse of the free tool.
- To handle support: Feedback and integration requests you submit in the app are forwarded to our internal Telegram channel together with your email address.
- To improve the product: Usage analytics help us understand feature adoption and performance.
- To prevent abuse: reCAPTCHA and rate limiting protect against spam and unauthorized access.
- To run background jobs: Inngest processes scheduled scans, article generation, and lifecycle emails on your behalf. Job payloads can include your email address and name.
3. Third-Party Services and Data Sharing
We share data with the following third-party services as necessary to operate QuickSEO:
| Service | Data Shared | Purpose |
|---|
| Supabase | Account data, all application data | Database hosting, authentication, file storage |
| Google OAuth / Search Console API | OAuth tokens, the property you select, your search queries | Sign-in, live Search Console retrieval |
| Stripe | User ID, email, billing address, Datafast visitor/session IDs | Payment processing |
| OpenAI | Tracking prompts, your website content, your top Search Console queries and pages, AI responses being scored, and anything you type into our free AI tools | AI visibility tracking (ChatGPT), prompt and topic suggestions, response scoring, public free tools |
| Anthropic | Tracking prompts, your website content, article briefs and sitemap URLs | AI visibility tracking (Claude), article writing (including web search and page fetching on our behalf) |
| Google Generative AI | Tracking prompts, image prompts and article titles | AI visibility tracking (Gemini), article cover images |
| Perplexity | Tracking prompts | AI visibility tracking (Perplexity) |
| Resend | Email address, first name, email content, delivery and engagement events | Transactional and lifecycle emails, free-audit marketing audience |
| Firecrawl | Website URLs you provide and other URLs we look up for you | Website content extraction, screenshots, competitor discovery |
| Ahrefs | The domain you enter in our free Domain Rating checker | Domain Rating lookup |
| crt.sh | The hostname you enter in our free SSL checker | Certificate Transparency lookup |
| Public DNS | The domain you enter in our free DNS lookup tool | Resolving DNS records |
| Telegram | Your user ID, email address, site URL, and message text when you send feedback or request an integration | Internal support notifications |
| WordPress, Ghost, Shopify | Article content, cover images, SEO metadata, the author name set on the site, and the credentials supplied for that site | Publishing articles to a connected CMS — dormant, see below |
| A configured webhook endpoint | Published article content in HTML and Markdown, sent to a configured URL | Custom publishing destination — dormant, see below |
| AI assistants you connect over MCP | Your sites, live Search Console data, prompts, and AI visibility data | Serving our MCP server to a client you authorize |
| Datafast | Usage events, visitor/session cookies, crawler request metadata | Analytics |
| Vercel | Application hosting, request logs, page performance metrics | Hosting and performance analytics |
| Inngest | Job payloads including user ID, email address, name, and site data | Background job scheduling |
| Google Tag Manager | Conversion events (with consent) | Marketing analytics |
| Facebook / Meta Pixel | Page views, conversions (with consent) | Advertising and retargeting |
| Reddit Pixel | Page views, conversions (with consent) | Advertising attribution |
| Google reCAPTCHA | Device/browser signals | Bot and spam prevention |
Automatic publishing to a CMS or a webhook is currently switched off. The connection screens are hidden and no new destination can be set up, so those two rows do not apply to you unless your site connected a destination before we withdrew the feature — those sites still publish, which is why the rows remain. MCP clients receive data only if you authorize one yourself. Where a destination replies to us, we store its response for troubleshooting.
We do not sell your personal data to any third party.
When you use AI visibility tracking, your prompts are sent to third-party AI providers (OpenAI, Anthropic, Google, Perplexity) to generate responses. These providers may process your prompts according to their own privacy policies and data retention practices. We recommend reviewing:
Two different things are sent at two different stages, and they are not the same:
- Writing the prompts (OpenAI only). When you ask us to suggest prompts or article topics, we send OpenAI your brand name, industry context, your scraped website content, your competitor list, and your top Google Search Console queries and page URLs. If your public pages contain personal information, such as staff names or contact details, that information reaches OpenAI at this stage.
- Running a scan (all four providers). When we actually run a tracking prompt, we send the provider the prompt text and nothing else, apart from the target country you have chosen for the site so results reflect that market. Your website content, your competitor list, and your Search Console data are not part of a scan request.
In neither case do we send your own location, IP address, or account details.
5. Data Security
- Storage: All data is stored on secure servers provided by Supabase (PostgreSQL with Row Level Security).
- Encryption: Data is encrypted in transit (TLS) and at rest by our database provider. CMS credentials and webhook signing secrets are additionally encrypted at the application level with AES-256-GCM before they are written to the database. This covers every such secret written since we introduced it; our code still reads an older, unencrypted value if one predates that change.
- Access control: Database queries enforce user-level access controls to prevent unauthorized data access.
- Security headers: We implement Content Security Policy, X-Frame-Options, X-Content-Type-Options, and strict referrer policies.
- API authentication: All authenticated API routes verify user identity and resource ownership before processing requests.
6. Data Retention
- Account data: Retained for as long as your account is active.
- Google Search Console data: Not retained — it is fetched live and discarded after each request. The property identifier and your OAuth tokens stay in our database until we delete them; there is no in-app disconnect button today, and deleting a website does not clear them. You can revoke QuickSEO's access from your Google Account permissions page at any time, which stops any further access. Deleting your account removes the stored tokens.
- AI visibility data: Retained for as long as your account is active to provide historical trend analysis.
- Website content: Stored on your site record and refreshed while the site is active; removed when you delete the site.
- Free audit records: Lead details (email address, URL, IP address, user agent) and the generated report are retained indefinitely. If you delete your QuickSEO account, we also delete any audit records held under that account's email address. Otherwise, email us to have them removed.
- Marketing unsubscribes: If you unsubscribe from marketing email, we keep a record of your email address on a suppression list so that we do not email you again. This one record survives account deletion — without it, a later campaign could reach you again.
- Analytics data: Datafast retains analytics according to their own policies.
- Payment data: Stripe retains billing records according to their data retention policy and applicable financial regulations.
Deleting a website from its settings page deletes that site's data, including its AI visibility history and stored website content. Deleting your whole account, from your account page, deletes your account and every website on it — see Section 7. Some data may be retained in backups for a limited period or as required by law.
7. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data and account.
- Data portability: Receive your data in a structured, machine-readable format.
- Objection: Object to the processing of your personal data under certain circumstances.
- Consent withdrawal: Withdraw your consent to data processing at any time, without affecting the lawfulness of processing based on consent before withdrawal.
- Restrict processing: Request that we limit the processing of your data under certain conditions.
How to Exercise These Rights
Deletion and portability are self-serve. Both live in the Your data card on your account page:
- Delete your account. You type your email address to confirm, and we permanently delete your account and every website on it — your prompts, competitors, AI visibility history, generated articles, Google OAuth tokens, publishing connections and settings — along with any free-audit records held under your email address. It is immediate and we cannot undo it. If you have a subscription that can still be billed, cancel it in the billing portal first: deleting your account does not cancel a Stripe subscription, so we block deletion until billing has stopped. You can delete as soon as you have cancelled, even if paid time is still running.
- Export your data. Downloads a JSON file containing your account details, subscription history, and every website with its prompts, competitors, topics, AI visibility runs, articles and settings. API keys and OAuth tokens are excluded — an export is not a way to read back a secret.
The one thing we keep is the marketing suppression record described in Section 6.
Everything else — access, correction, objection, restriction, or anything the two controls above do not cover — is handled manually: email us at support@quickseo.ai from the address on your account, tell us what you want, and we will action it and confirm when it is done. We aim to respond within 30 days.
You can also delete an individual website from its settings page, which removes that site's data but keeps your account; and you can revoke QuickSEO's access to your Google account from your Google Account permissions page, which stops any further Search Console access.
GDPR (EU/EEA)
If you are in the EU/EEA, you have all the rights listed above under the General Data Protection Regulation. Our cookie consent banner gates analytics and advertising storage in regulated regions — see Section 8 for exactly what it does and does not cover.
CCPA (California)
If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information.
8. Cookie Consent
If your browser's timezone places you in the EU/EEA, UK, Switzerland, or Brazil, we display a cookie consent banner with Accept and Decline buttons. Be aware of exactly what each one does:
- Decline keeps Google Consent Mode set to "denied" for analytics storage, advertising storage, advertising user data, and ad personalization, and stops the Datafast analytics script and Vercel Analytics from loading at all. We record your refusal so the banner does not come back.
- Accept grants Consent Mode and loads Datafast and Vercel Analytics.
- Ignoring the banner stores nothing, so it is treated as a refusal for that visit — nothing is granted and nothing beyond the GTM container loads — but the banner will appear again on your next visit.
- The Google Tag Manager container itself loads on every page regardless of your choice, so that our tags can be detected. Consent Mode governs Google's own tags; non-Google pixels loaded through the container, such as Meta's and Reddit's, are not covered by it and we cannot enforce your choice on them from the container.
- Essential cookies (authentication, session management) are always active as they are necessary for the service to function.
- Outside those regions we do not show the banner and all of the above load on every page, as they always have — unless you record a refusal yourself through Cookie preferences, which we honour wherever you are.
Your choice is stored under cookie-consent in your browser's local storage, as accepted or declined. To change it, use the Cookie preferences control, which reopens the banner. You will find it in the footer of our marketing pages — including the home page, pricing, blog, docs, tools, integrations, comparisons, templates, and the free audit — and, if you are signed in, in the Privacy card on your account page. Some pages carry no footer, including this one; open one of the pages above, or your account page, to reach it. The reopened banner shows what you currently have saved and can be closed without changing it. Switching from Accept to Decline reloads the page so the analytics scripts stop running immediately. Clearing this site's local storage also resets the choice. You can also email us at support@quickseo.ai and we will handle it.
Region detection uses your browser's timezone rather than a geographic IP lookup. It is an approximation: a browser reporting an unreadable timezone is treated as regulated, but a browser reporting, say, a US timezone while physically in the EU will not see the banner. Use the Cookie preferences link if you want to record a choice regardless of where we place you.
9. Children's Privacy
QuickSEO is not intended for use by children under the age of 16. We do not knowingly collect personal data from children.
10. Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Your continued use of QuickSEO after changes are posted constitutes your acceptance of the updated policy.
For any questions, data requests, or privacy concerns, contact us at: