Privacy Policy

Last updated: 2 November 2026

SeoGeo (“we”, “our”, “the service”) at seogeo.ae is provided by Software Stem, a Nexus Labs company, Dubai, United Arab Emirates. It is an invitation-only platform for search engine optimization (SEO) and generative engine optimization (GEO). This policy explains exactly what data we access, how we use it, who we share it with, how we protect it, and how long we keep it — with specific detail for data we receive from Google APIs.

1. Google user data we access

We only access Google data after you choose to connect a Google service and approve Google’s consent screen. For each service:

Google Search Console (webmasters.readonly, read-only): the list of your verified sites and their search performance data — search queries, clicks, impressions, click-through rate, and average position.
Google Analytics 4 (analytics.readonly, read-only): the list of your GA4 properties and aggregated traffic reports for the property you select — for example sessions, users, page views, and top pages and traffic sources — plus aggregated event counts used to count leads (taps on WhatsApp, phone and email links, form submissions and your key events, including a 30-minute real-time check when you test tracking) and your property’s web data stream measurement ID, so the tracking snippet sends events to the right property.
Google Business Profile (business.manage): your business accounts and locations, business information (name, category, address, phone, website, description), and the posts you create through SeoGeo.
Blogger (blogger): your list of blogs, so we can publish the posts you approve to the blog you choose.
Basic profile (userinfo.email, userinfo.profile): your Google account email, name, and profile picture, used only to show which account is connected.
OAuth tokens: the access and refresh tokens Google issues when you connect, so the service can keep working without asking you to sign in every time.

We only access the Google services you connect. Features you do not use are never authorized.

2. How we use Google user data

To show your Search Console and Analytics reports inside your SeoGeo dashboard.
To display your Business Profile information and publish or update posts on your Business Profile when you ask us to.
To publish blog posts you have reviewed and approved to your Blogger blog.

Google user data is used only to provide these user-facing features you requested. We do not use it for advertising, targeted ads, credit or lending decisions, or profiling, and we do not sell it.

3. AI features and Google user data

SeoGeo uses an AI provider (the OpenAI API) to write drafts and suggestions. Most AI features use only public website content and text you type into SeoGeo. A few features send a small, specific piece of Google data, and only when you click the button for that feature:

Suggested titles and descriptions and refresh briefs (Analytics and Blog pages): the page address and up to 10 of its Search Console search queries, with their impressions and average position.
AI review reply drafts (Business Profile page): the text and star rating of the one review you are replying to, the reviewer's display name, and your business name and category.

This data is sent only to produce the draft you asked for, which is shown to you and never published without your approval. OpenAI does not use data sent through its API to train its models. We do not use Google user data to develop, improve, or train any AI or machine-learning models, and we do not send Google Analytics data to any AI provider.

4. Sharing and transfer of Google user data

No sale or advertising use: we do not sell, rent, or license Google user data, and we do not share it with advertisers, data brokers, or information resellers.
Google: to provide the features, our server sends requests to Google’s own APIs using the permissions you granted.
Hosting provider: our application and its data are stored on a server rented from our hosting provider (Contabo). The provider stores the data on our behalf and does not use it for its own purposes.
Legal requirements: we may disclose data if required by law, regulation, or valid legal process, or to protect the safety of our users or the service.
AI provider (OpenAI): only the limited data listed in section 3, only when you click that feature, and only to produce the draft you requested.
Email provider (Resend): your weekly summary email, which includes your Search Console totals and top pages, is delivered through Resend to the address you choose.
People you share a report with: if you create a report share link, the report it shows (including Search Console figures) can be viewed by anyone with the link until it expires.
We do not transfer Google user data to any other third party.

5. How we protect data

All traffic between your browser, our server, and Google is encrypted with HTTPS/TLS.
The whole application is behind a login, and accounts are issued only by the administrator, so no one outside the invited users can reach any connected data.
OAuth tokens are stored on our server only, are never shown in the browser, and are kept separately for each account.
Server access is restricted to the administrator.

6. Data retention and deletion

OAuth tokens are kept while a Google service is connected. When you click Disconnect for Analytics or Business Profile in SeoGeo, we delete the stored tokens for that service immediately.
Reports from Search Console and Analytics are fetched when you view them and are not stored long-term.
Business Profile information and posts you create in SeoGeo are kept in your project until you delete them or ask us to delete your account.
Deleting everything: you can revoke SeoGeo’s access at any time in your Google Account permissions. To delete your SeoGeo account and all data we hold about you, email us at the address below; we will delete it within 30 days and confirm by email.

7. Limited Use disclosure

SeoGeo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Other data we collect

Account details: your email address and a hashed password, created by the administrator so you can sign in.
Websites you analyze: URLs you enter for SEO audits; we fetch those public pages to analyze them.
Microsoft Bing (optional): if you connect Bing Webmaster Tools, we store the OAuth tokens needed to submit the URLs you choose.
Publishing connections (optional): if you connect a blog platform (for example WordPress, Ghost or Tumblr), we store the login it needs, such as a WordPress Application Password or an API key, on our server so we can publish the posts you approve. Disconnecting removes it.
Website access for fixes and publishing: when you use Fix Report & Apply or publish a page to your server, the SFTP/SSH password or GitHub token you enter is used for that request only and is not saved. We keep a record of which files were changed (file names and the server name, not passwords) and backup copies of the original files, so the change can be rolled back.
Change log and settings: the changes you mark as done or apply through SeoGeo, and your weekly email settings, so we can measure results and send your summary.
Email delivery: weekly summaries are sent through our email provider (Resend), which receives your email address and the summary content to deliver it.
Shared report links: if you create a share link for a results report, anyone who has the link can view that report until the link expires.
AI Search tracking (optional): if you set up AI Search tracking, we store your business name, website, area, the questions you choose and competitor names, and we send those questions to AI answer engines (OpenAI, and Perplexity or Google Gemini where enabled) to record whether your business is mentioned. We keep the answers and cited links so you can see changes over time. No Google user data is sent for this.
Leads (optional): enquiry counts (WhatsApp, phone, email and form) come from your own Google Analytics as aggregated counts only; we never see who the visitors are. The optional tracking snippet you can add to your website (by hand or through the SeoGeo Connector WordPress plugin) sends click and form-submit events to your Google Analytics, never to us, and never sends form contents or visitors’ contact details. If you enter an average value per enquiry, we store that figure with your account.
Tracked keywords: the keywords you choose to track, stored with your account; their positions come from your Search Console data when you view them.
Public website data: to check page speed, domain age and authority, we send the website address (not your account data) to public services such as Google PageSpeed Insights, domain registration (RDAP) lookups, the Internet Archive and Open PageRank.

If you connect a Facebook Page or an Instagram professional account on the Social page, SeoGeo uses Meta's official login and asks only for permission to publish posts and read basic engagement on them (for example pages_manage_posts, pages_read_engagement, pages_show_list, instagram_basic, instagram_content_publish, or with Instagram login instagram_business_basic and instagram_business_content_publish).

What we store: the Page and Instagram account names and IDs you choose, the access tokens needed to publish (encrypted on our server), the posts and images you create or approve, and like, comment and share counts for those posts.
What we never access: ads, ad accounts, billing, Business portfolio settings, people or partners, and private messages. SeoGeo does not request these permissions and its code cannot call those parts of Meta's API.
Images: images you upload or create for posts are stored on our server at hard-to-guess addresses so Meta can fetch them when a post is published.
AI drafts: to draft captions we send your brand settings (name, website, business type, tone, hashtags) and topics to OpenAI. No Meta user data is sent.
Removing access and deleting data: click Remove on the Social page, or remove SeoGeo in your Facebook settings (Settings and privacy, then Business integrations) or Instagram settings (Apps and websites). When Meta tells us you removed the app or asked for deletion, we delete the stored connection and tokens for that account. To delete everything else (posts, images), email hello@softwarestem.com and we will do it within 30 days.

10. Changes to this policy

We may update this policy. The “Last updated” date above changes when we do, and material changes to how we handle Google user data will be shown in the app before they take effect.

Contact
For privacy questions or data deletion requests, email Software Stem at hello@softwarestem.com.