Privacy Policy

1. Information We Collect

Cookies & Similar Technologies

We use first- and third-party cookies, pixels, and local storage to authenticate sessions, remember preferences, analyze traffic, and (where applicable) support advertising. You can block or delete cookies in your browser, but core features may not function correctly.

2. How We Use Information

• Provide the Service — authenticate users, connect third-party APIs, generate AI suggestions, and maintain workflows.
• Improve & Secure — monitor performance, debug errors, test features, and protect against fraud or misuse.
• Personalize — tailor article ideas, schedules, and dashboards to each client domain.
• Communicate — send product updates, transactional notices, and marketing (if you opt in).
• Billing & Compliance — process payments, detect chargebacks, satisfy legal obligations, and enforce our terms.

3. Legal Bases (EEA / UK)

Where the GDPR applies, we rely on:

• Contractual necessity — to deliver the Service you request.
• Legitimate interests — to improve security and user experience.
• Consent — for marketing emails or non-essential cookies.
• Legal obligation — for tax and regulatory requirements.

You may withdraw consent at any time without affecting prior processing.

4. How We Share Information

• Infrastructure providers (AWS, Vercel, GCP) — hosting, storage, networking.
• Payment processor (Stripe) — secure card transactions and invoicing.
• AI model hosts (OpenAI, Anthropic, Google AI) — generate content briefs, drafts, and keyword lists.
• Analytics services (PostHog, GA4) — product analytics and diagnostics.
• Authenticated APIs (GSC, GA) — import domain data at your direction.
• Professional advisers — accounting, legal, auditing under NDA.
• Authorities — where required by law or to protect rights, property, or safety.

We do not sell or rent personal information.

5. Data Retention

We retain account and client-domain data while your subscription is active or as needed to provide the Service. Backups/logs are purged or anonymized on a rolling 90-day schedule. You may request deletion; some records (e.g., invoices) are kept for statutory periods.

6. Security

• TLS 1.2+ encryption in transit; AES-256 at rest.
• Role-based access control and least-privilege IAM.
• Annual penetration tests and continuous vulnerability scanning.
• OAuth 2.0 scopes limited to necessary permissions.

7. International Transfers

Data is stored in the United States. If you access Sage SEO from another country, information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses for EEA/UK data processed by sub-processors outside adequate-protection jurisdictions.

8. Your Rights

You may have the right to:

• Access or download a copy of personal data
• Correct inaccurate information
• Delete certain data ("right to be forgotten")
• Object to or restrict processing
• Port data to another service
• Opt out of marketing communications

Submit requests to privacy@sageseo.ai. We will respond within 30 days or the legally required timeframe.

9. Children

Sage SEO is intended for users 18 years or older. We do not knowingly collect information from children under 13. If you believe a child has provided data, contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy to reflect product or legal changes. Material updates will be announced via email or in-app notice at least 10 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance.