Privacy policy.

• Account data: email, name, hashed password, OAuth identifiers.
• Workspace data: business names, websites, target keywords, AOV and conversion rate inputs.
• Search Console data: queries, pages, clicks, impressions, position, fetched on your behalf.
• Analytics: usage data via Vercel Analytics; error reports via Sentry. With your permission, Google Analytics cookies measure public page visits, scrolls, link clicks (including guide-to-tool navigation) and free-tool actions (start, successful result and successful copy), including whether a labelled example was used. Private account and report pages, form contents, URL queries and fragments are excluded. Change your choice using Cookie preferences on any public page.
• With separate advertising permission, Meta Pixel measures eligible public marketing-page visits. Our server also sends verified new-account and paid-purchase events, payment value and currency, and browser advertising identifiers to Meta. We do not send private page URLs, credentials, uploaded files, form contents or raw contact details. Analytics-only consent does not enable this sharing. Use Cookie preferences to withdraw permission; unsent events are checked again before delivery. Consent expires after 30 days; queued events expire after six days. A minimal hashed event record is retained to prevent duplicate counting.
• Billing: handled by Stripe. We do not store card details.

To provide the Service, generate insights, send transactional and digest emails (if enabled), maintain security, and comply with the law.

We do not sell personal data. We share data with sub-processors as required to operate the Service: Supabase (database and auth), Stripe (billing), Resend (email), Sentry (errors), Vercel (hosting and analytics), OpenAI (insights generation), Serper, DataForSEO and Google (third party SEO data and consented website analytics).

Data may be processed outside Australia by our sub-processors. We rely on standard contractual clauses where applicable.

Access, correction, deletion, portability, and the right to lodge a complaint with the OAIC (Australia) or your local supervisory authority.

We keep account and workspace data for as long as your account is active, plus 30 days after deletion. Aggregated, anonymised analytics may be retained longer.

TLS for all transport. At rest encryption via our hosting provider. RLS policies isolate tenant data. Production access limited to a small group, with audit logging for sensitive actions.

The Service is not directed at children under 16 and we do not knowingly collect their data.

We will notify you of material changes 14 days in advance via email or in app.

Email persianmj@yahoo.com.