SEO Engico Ops

Effective: 5 May 2026

Privacy Policy

This Privacy Policy explains how SEO Engico Ltd (“SEO Engico”, “we”, “our”) collects, uses, stores, and shares information when you use the Agency Ops Portal (the “Service”) at ops.seoengico.com, portal.seoengico.com, or any other domain we operate.

We are the data controller for personal data processed through the Service for our own administrative and reporting purposes. When we process personal data on behalf of a client (for example, contact details of their staff added to the portal, or analytics data retrieved from a client's connected Google account), we act as a data processor on that client's instructions.

This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Google API Services User Data Policy, including the Limited Use requirements.

1. Who we are

SEO Engico Ltd is a private limited company in the United Kingdom. Our trading address and registered details are available on request by emailing privacy@seoengico.com. We have not appointed a Data Protection Officer because we are not required to under UK GDPR Article 37, but the named contact for all data protection matters is the email address above.

2. Information we collect

2.1 Account information

When you are invited or sign up as a user (whether internal staff or a client), we collect your name, email address, role within your organisation, password hash, and authentication metadata such as last login time and password reset tokens.

2.2 Operational data

While you use the Service, we store the records you create or that are created on your behalf. This includes link-building requirements, placements, SEO deliverables, monthly cycles, internal notes, approvals, file uploads, chat messages, performance reports, report commentary drafted with the assistance of AI, and screenshots you upload.

2.3 Google account data (OAuth)

When a user clicks “Connect Google” to link a client's analytics or search performance data, we initiate Google's OAuth 2.0 flow and request the following scopes:

  • openid, https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile — used solely to identify the connected Google account so we can display it back to you in the connection card and prevent us from mixing up which credentials belong to which client.
  • https://www.googleapis.com/auth/analytics.readonly — used solely to list the Google Analytics 4 properties the connected account can see and to read aggregated traffic, event, and conversion metrics needed to populate monthly client reports. We do not modify any GA4 configuration, audiences, or settings.
  • https://www.googleapis.com/auth/webmasters.readonly — used solely to list the Search Console sites the connected account can access and to read aggregated search performance data (clicks, impressions, top queries) needed to populate monthly client reports. We do not modify any Search Console property, sitemap, or setting.

On a successful connection, Google issues us a refresh token tied to the connected account. We store this refresh token, encrypted with AES-256-GCM, alongside the connecting account's email and display name. We also cache short-lived access tokens in our database while they are valid.

2.4 Limited Use of Google user data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

  • We use Google user data only to provide and improve the report-generation features of the Agency Ops Portal that the authenticated user is actively using.
  • We do not transfer Google user data to third parties except as necessary to provide and improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets where the recipient is bound by equivalent commitments.
  • We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
  • We do not allow humans to read Google user data except: (i) with the connecting account holder's explicit consent for specific data; (ii) where necessary for security purposes such as investigating abuse; (iii) to comply with applicable law; or (iv) where the data is aggregated and used for internal operations in line with the Limited Use rules.

2.5 Files and screenshots

Any files you upload (for example, performance-report screenshots) are stored in Cloudflare R2 object storage. Internal staff with access to the relevant client record can view or replace them.

2.6 Email correspondence

Transactional emails sent by the Service (for example, monthly report deliveries) are sent through Resend. Their delivery logs and the email content are retained by Resend in line with their own data-processing terms.

2.7 AI-generated content

When you click “Draft commentary with AI”, we send the report's metric values, top keyword list, and placement summary for the relevant client to Anthropic's Claude API to generate suggested commentary. We do not send Google OAuth tokens, contact email addresses, file contents, chat history, or unrelated client data. Anthropic does not use API inputs or outputs to train its models in line with its commercial terms.

2.8 Cookies and similar technologies

We set a small number of strictly necessary cookies for sign-in, session management, and CSRF protection. We do not set advertising, analytics, or cross-site tracking cookies on the Service. Because all cookies we set are strictly necessary for the Service to work, no consent banner is required under PECR.

3. Why we use your information and the legal basis

  • To operate your account and the Service. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)) where you or your organisation has signed up for the Service, or legitimate interests (Article 6(1)(f)) where the user is a member of staff at a contracted client.
  • To pull analytics and search-performance data via the Google APIs you have connected.Legal basis: performance of a contract; consent (Article 6(1)(a)) where the connecting user has explicitly granted permission via Google's OAuth screen.
  • To send transactional emails such as monthly reports, login links, and approval reminders. Legal basis: performance of a contract; legitimate interests in delivering the Service.
  • To improve, debug, and secure the Service. Legal basis: legitimate interests in maintaining a reliable platform. We do not use Google user data for product improvement beyond producing the report you requested.
  • To meet legal, regulatory, and tax obligations. Legal basis: legal obligation (Article 6(1)(c)).

4. How long we keep your information

  • Account records are retained while your account is active and for up to 24 months after closure unless we need to keep them longer for legal reasons.
  • Operational records (link placements, deliverables, chat messages, approvals, performance reports) are retained for as long as the client account is active and up to 36 months after the end of the engagement, after which they are deleted or anonymised.
  • Google OAuth refresh tokensare kept only while the connection is active. When you click “Disconnect”, we revoke the refresh token at Google and delete the encrypted token from our database immediately.
  • Email logs in Resend are retained per their policies, typically for 30 days.
  • Backups of the production database are retained for up to 30 days, after which they are overwritten.

5. Who we share your information with

We share personal data with the following categories of recipient:

  • Render (our application hosting provider, region eu-central / Frankfurt where applicable).
  • Turso (managed LibSQL database).
  • Cloudflare (R2 object storage and DNS).
  • Resend (transactional email delivery).
  • Anthropic (AI model used for drafting report commentary on demand).
  • Google LLC (when you connect a Google account, we interact with Google APIs on your behalf).
  • Professional advisers (legal, accounting, audit) where strictly necessary and under confidentiality.
  • Authorities where required by law, regulation, or court order.

Each of the above is bound by a data-processing agreement or equivalent contractual safeguards. We do not sell personal data and we do not share it for advertising purposes.

6. International transfers

Some of the providers listed above are based outside the United Kingdom or European Economic Area (notably the United States). Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an applicable adequacy decision (for example, the UK Extension to the EU-US Data Privacy Framework). We carry out transfer risk assessments where these are required.

7. Security

We protect personal data with industry-standard measures, including:

  • TLS 1.2+ for all network traffic in transit.
  • AES-256-GCM encryption for stored Google OAuth refresh tokens.
  • Bcrypt password hashing with per-user salt for any locally-stored passwords.
  • Role-based access control inside the portal so users can only see the records appropriate to their role.
  • Provider-side encryption at rest on Turso, Cloudflare R2, and Render.
  • Audited code changes via GitHub pull requests.

No system is perfectly secure. If you suspect a breach, please email security@seoengico.com immediately.

8. Your rights under UK GDPR

You have the following rights:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — ask us to delete your personal data where we no longer have a lawful basis to keep it.
  • Restriction — limit how we use your data while a dispute is resolved.
  • Portability — receive your data in a portable format or have us send it to another controller where technically feasible.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent— where we rely on consent (for example, the Google OAuth connection), you can withdraw it at any time by clicking “Disconnect” in the portal or by revoking access at myaccount.google.com/permissions. Withdrawing consent does not affect processing carried out before the withdrawal.

To exercise any of these rights, email privacy@seoengico.com. We will respond within one calendar month. We may ask you to verify your identity before we act on a request.

9. Account or data deletion

You can request closure of your account and deletion of associated data at any time by emailing privacy@seoengico.com from the address registered on the account. We will confirm receipt, complete deletion within 30 days, and notify our sub-processors where applicable. Some records may be retained for legal, regulatory, or audit reasons as set out in section 4.

10. Children

The Service is a business-to-business product. It is not directed at children under 18 and we do not knowingly collect personal data from them.

11. Complaints

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

12. Changes to this policy

We may update this policy from time to time. The “Effective” date at the top reflects the latest version. Material changes will be communicated by email to the address registered on your account or by a prominent notice in the Service before the change takes effect.

13. Contact

Questions, complaints, deletion requests, or any other data protection matter: privacy@seoengico.com.