SEOMadman

Privacy Policy

SEO Madman connects to your Google Search Console and Google Analytics 4 accounts, with your explicit consent, to build SEO growth-memory, attribution, and recommendations for your own websites. We request only read-only access.

Google user data we access

  • Google Search Console (webmasters.readonly): search performance for the properties you connect - queries, pages, clicks, impressions, position.
  • Google Analytics 4 (analytics.readonly): traffic and conversion metrics for the properties you connect.
  • Basic identity (openid, email, profile) to create your account.

We never request write, manage, or delete access to any Google service.

Google API Services Limited Use disclosure

SEO Madman's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use Google user data only to provide and improve the user-facing features you connect it for.
  • We do not sell Google user data, and we do not use it for advertising.
  • We do not use Google user data to train generalized or foundation AI models. Our in-product assistant answers strictly from your own connected data, scoped to your workspace - never pooled across customers or used to train shared models.
  • Human access to Google user data is restricted to what you explicitly authorize, to security and abuse investigations, to comply with law, or with your consent.

Storage, retention, and deletion

OAuth refresh tokens are encrypted in a dedicated secrets vault and are never stored in application tables or logs. Disconnecting an integration revokes the token with Google and deletes the stored secret. You can request account deletion at any time.

Marketing analytics (product analytics on this website)

On our public marketing website only, and only after you accept analytics cookies, we use privacy-respecting product analytics (PostHog) to measure how visitors move from our pages into signup and activation. If you decline, no analytics are loaded and no analytics requests are made. This is entirely separate from, and never mixed with, your connected Search Console or Analytics data, which lives behind per-workspace access controls.

Marketing analytics events record only non-identifying interaction metadata: the page path, referring site (including whether it was an AI assistant), UTM campaign tags, and lifecycle milestones such as starting a connection, connecting Search Console, seeing first value, acting on a recommendation, upgrading a plan, adding a client, and sharing a report. We do not put emails, your website URLs, search queries, or any metric values in these events.

Data residency

Your connected Search Console and Analytics data, and all workspace data, are currently stored and processed in the United States. We do not operate an EU region today. If your organization requires EU data residency, contact us before signing up: we maintain a defined path to home an EU workspace's data in an EU region and will confirm availability and timing for your case. Payment processing is handled by Stripe as an independent processor and is not tied to this residency choice.

Who we are (data controller)

SEO Madman is operated by UpgradIQ. For workspace content you connect and manage, we act as a processor on your behalf; for your account and our marketing website, we act as the controller. You can reach our privacy contact at privacy@seomadman.com.

Legal basis for processing (GDPR Art. 6)

  • Consent - connecting Google Search Console / Analytics, and marketing-site analytics cookies. You may withdraw consent at any time by disconnecting or declining cookies.
  • Contract - providing the service you signed up for (account, workspace, plan).
  • Legitimate interests - securing the service, preventing abuse, and basic operational logging, balanced against your rights.
  • Legal obligation - retaining certain billing and audit records.

Data retention

Account and workspace data are retained while your account is active. On account or workspace deletion we run a confirmed, 30-day grace-period erasure, after which personal data is hard-deleted; append-only billing and audit records are retained only as long as legally required, then purged. OAuth tokens are deleted immediately on disconnect.

Your rights and how to exercise them

Subject to applicable law, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. You can:

  • Access / portability- download a machine-readable copy of your personal data from Settings → Account → “Download my personal data.”
  • Erasure - request account or workspace deletion from Settings → Account.
  • Exercise any other right, or appeal a decision, by emailing privacy@seomadman.com. We respond within the statutory timeframe (generally 30 days; 45 days for CCPA requests, extendable once).

International data transfers

We process data in the United States. Where we receive personal data from the EEA, UK, or Switzerland, transfers are made under the European Commission's Standard Contractual Clauses (and the UK Addendum), together with supplementary measures. Contact us for a copy of the relevant safeguards.

Sub-processors

We use a small set of vetted service providers to run the service (hosting, database, payments, email, error monitoring, and consent-gated marketing analytics). The current list, with each provider's purpose, is published at /legal/subprocessors.

California privacy rights (CCPA/CPRA)

Notice at collection. We collect the categories described above (identifiers such as your email, your profile, connected-property metadata, and usage/interaction data) to provide and secure the service. We retain them per the schedule above.

Your California rights. You have the right to know, access, correct, and delete your personal information, and to be free from discrimination for exercising these rights. Exercise them via the personal-data download and deletion controls above, or by emailing privacy@seomadman.com.

Do Not Sell or Share My Personal Information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of, but you may still contact us to confirm.

Contact

Questions about this policy: privacy@seomadman.com

Effective date: 10 July 2026.