1. Who We Are
CopilotSEO ("we," "us," or "our") is operated as a personal brand based in Ontario, Canada. We operate the website at copilotseo.io and the CopilotSEO SEO analytics and content platform (collectively, the "Service").
By using the Service, you agree to the practices described in this policy.
2. Information We Collect
2.1 Information You Provide Directly
- Account information: Your name and email address when you sign in via Google OAuth.
- Communications: Messages and support requests you send to us.
- Payment information: Billing details collected and processed by Stripe. We do not store your card numbers — Stripe handles all payment data securely.
2.2 Information Collected Automatically
- Usage data: Pages visited, features used, session duration, and error logs.
- Technical data: Browser type, operating system, IP address, approximate location (country/city level), and time zone.
- Session cookies: Used to keep you logged in and protect against CSRF attacks.
2.3 Information from Third Parties
- Google OAuth: Your Google account name, email address, and profile photo — used only for authentication.
- Google Search Console data: Clicks, impressions, CTR, average position, keyword and page data — accessed only via your explicit OAuth authorization, used solely to provide the Service to you.
- Google Business Profile data: When you connect your Google Business Profile, we access your business listing details, reviews, posts, photos, and performance metrics — only via your explicit OAuth authorization and only for locations you authorize, used solely to provide the Service to you. See Section 4.1 for details.
- Shopify: When you connect a Shopify store, we receive your store domain and an OAuth access token, and access your store's blog content — used only to read and publish the blog posts you create through the Service. We do not access your customers' data, orders, products, or payment information.
3. How We Use Your Information
We use your personal information to:
- Provide, operate, and maintain the Service
- Authenticate your account and keep it secure
- Display and analyze your Google Search Console data within your dashboard
- Generate AI-powered SEO insights, keyword recommendations, and content plans
- Send transactional emails (receipts, billing confirmations, account notices)
- Respond to your support requests
- Detect and prevent fraud, abuse, or security incidents
- Comply with legal obligations
We do not sell your personal information. We do not use your data for advertising.
4. Google API Services
Our use of information received from Google APIs strictly adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We only request the minimum Google Search Console and Google Business Profile permissions necessary to provide the Service.
- We do not share your Google data with third parties except as described in this policy.
- We do not use your Google data for advertising.
- We do not use your Google data to train AI or machine learning models beyond what is necessary to provide the Service directly to you.
- You may revoke our access at any time via your Google Account permissions page.
4.1 Google Business Profile
If you connect your Google Business Profile to CopilotSEO, you authorize us, via Google OAuth, to access and manage your business listing on your behalf. Specifically:
- What we access: Your business listing details (name, address, phone, hours, categories, attributes, description), reviews and review replies, posts, photos, and Business Profile performance metrics — only for the locations you explicitly authorize.
- How we use it: To display your listing's health and local ranking insights, help you respond to reviews, publish posts and updates, and optimize your profile — solely to provide the Service to you.
- Permissions: We request the
https://www.googleapis.com/auth/business.manage scope, the minimum needed for these features. - Reviews: We never create, solicit, or post fake or incentivized reviews. Any review replies are published only at your direction.
- Revocation and deletion: You may disconnect your Google Business Profile at any time from within the Service or via your Google Account permissions page. On disconnection or account deletion, we delete the stored OAuth token and associated Business Profile data.
5. Shopify Integration
If you connect a Shopify store to CopilotSEO, the following applies:
- Permissions: We request only the read_content and write_content permissions, which allow us to read and publish blog articles and pages on your store. We do not request or access your customers' personal information, orders, products, or payment data.
- What we store: Your store's domain and an access token granted via Shopify OAuth, so we can publish content on your behalf. The access token is encrypted at rest.
- How we use it: Solely to publish the blog content you create through the Service to your store.
- Compliance and deletion: We honor Shopify's mandatory compliance webhooks. When you uninstall the app, or when Shopify sends a shop-redaction request, we delete your store connection and access token. Because we do not collect or store your customers' personal data, customer-data and customer-redaction requests return no stored personal data.
6. Sharing Your Information
We do not sell or rent your personal information. We share data only in the following limited circumstances:
- Service providers: Trusted third-party vendors (cloud hosting, payment processing, email delivery) bound by data processing agreements. Key providers include: Supabase (database), Netlify (hosting), Stripe (payments), Anthropic (AI content generation), and Google (Gemini, AI image generation).
- Legal requirements: When required by law, court order, or governmental authority.
- Business transfers: In a merger or acquisition, with at least 30 days advance notice to affected users.
- With your consent: For any other purpose with your explicit consent.
7. Legal Bases for Processing (GDPR / UK GDPR)
If you are located in the EU or UK, we process your personal data under the following legal bases:
- Contract (Article 6(1)(b)): Processing necessary to perform our contract with you.
- Legal obligation (Article 6(1)(c)): Processing required to comply with applicable law.
- Legitimate interests (Article 6(1)(f)): Fraud prevention, security, and Service improvement using aggregated data.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.
8. International Data Transfers
CopilotSEO is based in Ontario, Canada. Canada is recognized by the European Commission as providing adequate data protection. For transfers to other countries via service providers, we rely on Standard Contractual Clauses (SCCs) where applicable.
9. Data Retention
| Data Type | Retention Period |
|---|
| Account information (name, email) | Until account deletion + 30 days |
| Google Search Console data | Until account deletion + 30 days |
| Google Business Profile connection (OAuth token, listing data) | Until you disconnect or account deletion |
| Shopify store connection (domain, access token) | Until you disconnect, uninstall, or account deletion |
| Usage logs | 12 months (rolling) |
| Billing and payment records | 7 years (Canadian tax law) |
| Support correspondence | 3 years from last interaction |
10. Your Privacy Rights
All users: You may request access to, correction of, or deletion of your personal information. Contact us at support@copilotseo.io.
EU / UK residents (GDPR / UK GDPR): You may lodge a complaint with your local Data Protection Authority. EU: edpb.europa.eu. UK: ico.org.uk.
California residents (CCPA / CPRA): You have the right to know, delete, correct, and opt out of sale of personal information. We do not sell your personal information. Contact us at support@copilotseo.io with subject line "California Privacy Request."
Australian residents: You may complain to the Office of the Australian Information Commissioner (OAIC).
11. Security
We implement HTTPS/TLS encryption for all data in transit, encryption of sensitive data at rest, role-based access controls, and regular security reviews. In the event of a data breach posing risk to your rights, we will notify affected users and applicable authorities as required by law.
12. Children's Privacy
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such data, contact us at support@copilotseo.io and we will delete it promptly.
13. Cookies
We use only strictly necessary cookies required to operate the Service (session authentication, CSRF protection, and login state). We do not use advertising cookies, analytics cookies, or third-party tracking cookies. For full details, see our Cookie Policy.
14. Changes to This Policy
For material changes, we will update the "Last updated" date and send an email notification to your registered address. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.