Privacy Policy

What personal data {{company.name}} collects, why we use it, who we share it with, how long we keep it and how you can use your privacy rights.

Last updated Oct 25, 2026

Summary: We collect only what we need to run your account: your name, email, a hashed password, your site settings, your content and usage logs. Keys you give us for other services are encrypted. We do not sell your data or use it to train AI. The AI providers we use work for us, and other tools you connect work with your own accounts, on your instructions. You can see, export, correct or delete your data. This summary helps you read the policy; the full text below is what applies.

This Privacy Policy explains how Andolasoft Inc. ("we", "us", "our"), 2059 Camden Ave, #118, San Jose, CA 95124, USA, handles personal data when you visit https://www.agenticseo.tools or use AgenticSEO (the "Service").

1. Who is responsible for your data

Account and billing data: we are the controller (in India, the "data fiduciary"). We decide why and how this data is used.
Data inside your sites: when you put personal data into the Service (for example data in your Search Console or analytics, names in review notes, or people mentioned in your content), you are the controller and we are your processor. We use that data only on your instructions. Our Data Processing Agreement covers this.

2. Data we collect

2.1 Data you give us

Account: name, email address and password. We store only a bcrypt hash of your password, never the password itself.
Site settings: site URLs, business profile, approved product facts, voice, competitors, CTAs, schedule and QA rules.
Third-party keys and tokens: API keys, service account keys and access tokens you add (for example for your AI provider, Google, DataForSEO, PostHog or X). We encrypt them with AES-256-GCM before we store them.
Content: prompts, keywords, tickets, briefs, drafts, articles, images, social posts, lessons and review notes.
Review links: people who open a review link can leave notes. We store the name they type and their note.
Billing: plan, billing period, invoices and tax details. Our payment provider handles card details. We do not store full card numbers.
Support: messages you send us.

2.2 Data we collect when you use the Service

Session data: a random session token in a cookie, linked to your account (see the Cookie Policy).
Password reset data: a one-time token (stored only as a hash) with its expiry time.
Usage logs: for each job, the AI tokens, searches, lookups and screenshots used, so you can see your AI usage and so we can run and fix the Service.
Technical logs: our hosting provider records IP addresses, browser type, request times and errors to keep the Service secure and working.
Google reCAPTCHA: on sign-up, login, password reset and review pages, Google reCAPTCHA collects device and interaction data to check that you are not a bot.

2.3 Data we get from services you connect

With your connected accounts, the Service pulls data such as Search Console clicks, impressions and queries, analytics and conversion data, keyword data, search results, AI answers and screenshots of web pages. This data is mostly about your websites and is usually aggregated. Where it includes personal data, we process it as your processor.

3. Why we use your data (lawful bases)

Purpose	Data	Lawful basis (GDPR / UK GDPR)
Create and run your account, sign you in, run your agents and jobs	Account, settings, keys, content, session data, usage logs	Contract
Send password reset and service emails	Email, reset token	Contract
Billing, invoices and tax	Billing data	Contract; legal obligation
Stop bots, fraud and abuse; keep the Service secure	reCAPTCHA data, technical logs	Legitimate interests (security)
Fix bugs and improve the Service	Usage and technical logs	Legitimate interests
Answer support requests	Support messages	Contract; legitimate interests
Follow the law and enforce our Terms	Any relevant data	Legal obligation; legitimate interests

We do not use your data or content to train AI models. We do not sell your personal data and we do not share it for cross-context behavioural advertising. We do not send you marketing emails unless you agree to receive them, and you can opt out at any time.

Under the India Digital Personal Data Protection Act, 2023 ("DPDP Act"), we process your personal data on the basis of your consent, which you give when you create an account and accept this policy, and for legitimate uses that the Act allows. You can withdraw consent at any time (see section 9), but then we may not be able to provide the Service.

4. Where we process data

We host the Service with [Hosting provider — set COMPANY_HOSTING]. Our subprocessors may process data in other countries, including the United States. When we transfer personal data from the EU, UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (and the UK Addendum where needed) or another lawful transfer method. Transfers from India follow the DPDP Act and any rules made under it.

Our subprocessors: companies that help us run the Service, such as hosting, reCAPTCHA and email delivery. They are listed on our Subprocessors page and may use the data only to provide their service to us.
Our payment provider: to take payments and handle billing.
Authorities: when the law requires it, or to protect rights, safety and property.
A buyer or successor: if we are part of a merger, acquisition or sale of assets. We will tell you before your data falls under a different privacy policy.

6. Services you connect with your own accounts

When you connect your own accounts, the Service sends data to these services on your instructions and with your credentials. Examples:

AI providers: OpenAI, Anthropic, Google (Gemini), or any OpenAI-compatible API you choose. They receive prompts that can include your business profile, content and briefs.
Google: Search Console, Analytics 4 and Autocomplete.
Data and search tools: DataForSEO, Bing Webmaster Tools, SerpApi, Serper.dev, Brave Search, Microlink, ScreenshotOne.
Analytics: PostHog.
Social: X (through your own X app).
Publishing targets: WordPress, Ghost, Webflow, Shopify, GitHub, or a custom webhook.

These services are not our subprocessors. Your own agreement with each of them, and their privacy policies, govern how they use the data. Check their terms before you connect them. You can disconnect a service at any time by removing its key in Settings.

7. How long we keep data

Data	How long
Account data, site settings, content, keys, usage logs	While your account is active. We delete it when you delete the site or account, as described below.
Session tokens	Until you log out or for up to 30 days
Password reset tokens	Until used or expired
Billing records and invoices	As long as tax and accounting laws require
Technical logs	A short period, set by our hosting provider, unless we need them to look into a security issue
Support messages	As long as needed to answer you, then up to 2 years

When you delete a site, we delete its settings, keys and content from our live database. When your account ends, we keep your content for 30 days so you can ask for a copy, then we delete it. Backups are overwritten on their normal cycle. We keep anonymous, aggregated data that does not identify you.

8. How we protect data

We encrypt stored third-party keys with AES-256-GCM, hash passwords with bcrypt, use HTTPS for data in transit, store session and reset tokens only as hashes, and limit staff access to what each job needs. No system is fully secure. Our Security page gives more detail.

9. Your rights

You can use these rights by emailing support@agenticseo.com. We will reply within one month (GDPR and UK GDPR), 45 days (CCPA/CPRA), or the time the DPDP Act and its rules require. We may need to confirm your identity first. We will not treat you differently because you used your rights.

If your request is about data inside a customer's site (for example, you left a note on a review link), we may pass your request to that customer, who is the controller.

You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office).

9.2 California (CCPA/CPRA)

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing. We do not sell or share personal information, as those terms are defined by the CCPA, and we do not use sensitive personal information to infer characteristics about you. In the last 12 months we collected the categories described in section 2: identifiers (name, email, IP address), commercial information (plan and billing), internet activity (usage and technical logs) and account login data. We disclosed them for business purposes only to the service providers in section 5. You can use an authorized agent to make a request.

9.3 India (DPDP Act 2023)

You have the right to get a summary of the personal data we process and the processing we do, to have it corrected, completed, updated or erased, to withdraw consent, to have a way to raise a grievance, and to nominate another person to use your rights if you die or become unable to. Send grievances to support@agenticseo.com. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.

Privacy Policy

1. Who is responsible for your data

2. Data we collect

2.1 Data you give us

2.2 Data we collect when you use the Service

2.3 Data we get from services you connect

3. Why we use your data (lawful bases)

4. Where we process data

6. Services you connect with your own accounts

7. How long we keep data

8. How we protect data

9. Your rights

9.2 California (CCPA/CPRA)

9.3 India (DPDP Act 2023)

9.4 Other places

10. Cookies

11. Children

12. Changes to this policy

13. Contact