Privacy Policy

1. About This Policy

SEOforGPT is operated by Pi3 Labs, LLC, a limited liability company organized under the laws of Delaware, United States ("SEOforGPT", "we", "us" or "our"). This Policy explains how we process personal data when you visit seoforgpt.io, use our AI visibility and content platform (the "Service"), connect another service or MCP client, or contact us.

We are the controller for account, billing, website, support and business-operation data. Where a business customer submits personal data for us to process solely on its behalf, we act as its processor, or as a subprocessor where an agency acts for its client. Business customers can request a Data Processing Agreement at hey@seoforgpt.io.

Contact: hey@seoforgpt.io.

2. Data We Process

We receive data from you, your use of the Service, services you connect and public sources you ask us to analyze.

3. Why We Process Data

The bases below apply where we act as controller. Processing on a customer's behalf follows their lawful instructions.

Account, billing and connection data is required to provide the relevant Service. Other data is optional, but some features may not work without it. If we rely on your consent, you may withdraw it at any time without affecting earlier processing.

App activity and recordings

While you are signed in, we use PostHog to collect page visits, clicks, feature events and masked session recordings to investigate errors and improve the Service. Activity is linked to your account ID, email and subscription information. Inputs and page text are masked in recordings. Signed-in monitoring is enabled independently of public website cookie preferences. When you sign out, website analytics follow your cookie choices again. Advertising remains subject to your separate marketing choice. By using our services, you agree to our Terms; this does not waive your privacy rights or replace consent where applicable law requires it. The retention, transfer and rights information below also applies. Contact hey@seoforgpt.io to exercise your rights.

4. Cookies

We use cookies and browser storage for sign-in, security and preferences. For signed-in users, Sentry receives limited error reports and a short, filtered action history to troubleshoot the Service, based on our legitimate interests in reliability and security. Signed-in PostHog monitoring is described above. With your consent, PostHog and Sentry provide public website analytics, performance monitoring and masked session replay, and Reddit measures advertising visits and conversions using identifiers that may include your email and account ID. Optional public website tracking remains off until you opt in.

Accept all, reject optional tracking or choose categories. We remember your choice in this browser for 180 days. Change or withdraw consent at any time through Privacy settings in the footer or this Cookie Policy. Changes reload the page. Withdrawal stops future optional collection without affecting earlier lawful processing. Global Privacy Control disables advertising. Choices are specific to each browser.

5. Retention

We retain personal data only as long as needed for the purposes above:

• Account and customer content: while needed to provide the Service, with Content deleted within 30 days after termination as provided in our Terms, except legally required retention;
• Financial records: for the period required by applicable tax, accounting and legal obligations;
• Support communications: as needed to resolve the request, maintain relevant service history and handle legal claims;
• Raw crawler and AI-referral events: 90 days; account-level aggregates may remain for the account lifetime;
• MCP and OAuth operational logs: up to 7 days;
• Connected-service authorization: until revoked, disconnected or no longer needed;
• Backups: subject to the infrastructure provider's backup lifecycle; deletion from active systems does not immediately remove every backup copy. Contact us for the applicable backup period;
• Cookie preferences: 180 days on this browser, unless you change or clear them sooner.

Hosted MCP refresh authorization lasts up to 30 days unless renewed. Expiry does not itself delete connection metadata, which remains protected until connection, account or operational cleanup.

Retention may be extended where necessary for legal obligations, security, fraud prevention or legal claims. Provider retention varies by service, terms and configuration. Retention in a connected chat client is controlled by your relationship with that provider.

6. MCP and Connected Services

When you connect Claude or another MCP client, the client sends user-approved tool inputs to SEOforGPT and receives tool results. The client provider separately processes the surrounding conversation under your relationship with that provider.

We do not intentionally retain a separate copy of the surrounding chat. Tool calls may access or change ordinary SEOforGPT account records, which follow the customer-content retention period above.

We use protected authorization information only to provide the connection you request. Operational logs contain limited diagnostic data and do not intentionally include raw credentials or full tool payloads. Disconnecting a service stops future access but does not automatically delete content already stored in your SEOforGPT account or at a destination you selected.

7. Recipients

We do not sell customer lists or license customer content to data brokers. Advertising disclosures can qualify as a "sale" or "sharing" under some privacy laws even without payment. Reddit advertising disclosures are subject to your marketing choice and Global Privacy Control. A provider receives data as needed for the relevant service, feature or consented purpose.

We may also disclose information to professional advisers, transaction parties or authorities where legally necessary. Some recipients act as our processors; others process data under your relationship with them or at your direction. Their own terms and privacy notices may apply.

8. International Transfers

Our primary Supabase database is in EU West. Other processing, including hosting and AI services, may take place outside the European Economic Area. Restricted transfers require an applicable legal mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact hey@seoforgpt.io for information about the safeguards for your data and how to obtain a copy.

9. Security

We use appropriate technical and organisational safeguards designed to protect personal data. No service can guarantee absolute security.

10. Your Privacy Rights

Subject to conditions and limitations under the GDPR, you have the right to:

1. Access your personal data;
2. Rectify inaccurate or incomplete data;
3. Erase data ("right to be forgotten");
4. Restrict processing;
5. Object to processing based on legitimate interests or direct marketing;
6. Data portability (receive data in machine‑readable format);
7. Withdraw consent at any time;
8. Lodge a complaint with your competent data protection authority.

To exercise your rights, email hey@seoforgpt.io.

We may need proportionate information to verify your identity and authority. For GDPR requests, we respond without undue delay and ordinarily within one month; where a lawful extension is necessary, we explain it within that first month. If we process data for a business customer, we may refer your request to that customer and assist it in responding. You may complain to the competent supervisory authority, including in the country of your habitual residence, workplace or the alleged infringement.

Depending on where you live and which laws apply to our activities, US state privacy laws may provide rights to access, correct, delete or obtain a copy of personal data, opt out of sale, sharing or targeted advertising, and appeal a denied request. You or an authorized agent can contact hey@seoforgpt.io; for an appeal, identify the decision you want reviewed. We will explain applicable verification, deadlines and any refusal. We do not discriminate against you for exercising applicable privacy rights. You can disable advertising through Privacy settings regardless of whether a particular state law applies to us. We honor Global Privacy Control for advertising; the older Do Not Track browser signal does not change our settings.

You can unsubscribe from promotional emails using the unsubscribe instructions in those messages or by contacting us. Necessary account, billing and service messages may continue. Email choices are separate from browser tracking choices.

11. Other Information

The Service is not directed to children under 16. We do not use personal data for decisions producing legal or similarly significant effects based solely on automated processing.

We may update this Policy by posting a revised version here. For material changes, we will provide additional notice where appropriate. Questions and privacy requests may be sent to hey@seoforgpt.io.