This policy explains what personal data AutomateSEO collects, why, who we share it with, how long we keep it, and the rights you have over it.
Who we are. Darran Goulding, a sole trader established in the United Kingdom, trading as Digital Visibility and as AutomateSEO, of 235 Peniel Green Road, Llansamlet, Swansea, Wales, SA7 9BA. We are the controller of the personal data described in this policy.
Contact for privacy matters: [email protected]
We are not required to appoint a Data Protection Officer. Privacy questions are handled by our named privacy contact at the address above.
1. Two different roles
It matters which hat we are wearing:
- We are the controller of data about you as our customer — your account, your billing, your use of the platform. That is what this policy covers.
- We are a processor for personal data you put into the platform — for example names and contact details in your business profile, author biographies, spokesperson likenesses, or personal data contained in content you generate or in pages we crawl from your own site. For that data you are the controller and we act on your instructions under our Data Processing Agreement.
2. Data we collect
2.1 You give us
| Data | Examples |
|---|---|
| Account | Email address, name, password hash (or Google sign-in identifier) |
| Business profile | Business name, website, industry, services, locations, target audience, brand voice, contact details |
| Content inputs | Keywords, topic briefs, RSS feed URLs, prompts, uploaded images, author profiles |
| Likeness and voice | Spokesperson photos and voice samples, where you use avatar or video features |
| Connection credentials | API keys, OAuth tokens and webhook secrets for platforms you connect — always encrypted at rest |
| Billing | Name, email, billing address and country. Card details go directly to Stripe; we hold only the last four digits and a token |
| Support | Anything you tell us in an email or support conversation |
2.2 We generate or collect automatically
| Data | Examples |
|---|---|
| Usage | Features used, articles generated, credit transactions, job status and error logs |
| Generated content | Articles, images, audio, video and social posts produced in your account |
| Technical | IP address, browser and device type, timestamps, request paths — in server and edge logs |
| Authentication | Session cookies, login timestamps, sign-up attempt records used for abuse prevention |
| Affiliate attribution | Referral code and click timestamp, if you arrive through an affiliate link |
2.3 We collect from third parties
- Stripe — payment outcome, subscription status, chargeback and refund events.
- Connected Platforms — page names, account identifiers, profile images and performance metrics from platforms you connect (Google Search Console, Facebook, LinkedIn and others).
- Search and SEO data providers — ranking, backlink and competitor data associated with domains you have asked us to track.
We do not buy personal data from data brokers.
3. Why we use it, and our legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Creating and running your account; generating and publishing content you request | Contract — Article 6(1)(b) |
| Taking payment, managing credits and subscriptions | Contract — Article 6(1)(b) |
| Sending service emails (job completion, failures, billing, security, changes to terms) | Contract — Article 6(1)(b) |
| Providing support | Contract — Article 6(1)(b) |
| Keeping the platform secure; preventing fraud, abuse and credit-limit circumvention | Legitimate interests — Article 6(1)(f): protecting our service and our customers |
| Diagnosing faults and improving reliability and quality using aggregated usage data | Legitimate interests — Article 6(1)(f): running and improving a service you have chosen to use |
| Affiliate attribution and commission payment | Legitimate interests — Article 6(1)(f), and contract with the affiliate |
| Marketing emails to existing customers about similar features | Legitimate interests — Article 6(1)(f), with an opt-out in every message |
| Marketing emails to people who are not customers | Consent — Article 6(1)(a) |
| Meeting accounting, tax and other legal obligations | Legal obligation — Article 6(1)(c) |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights. You can object at any time (see section 9).
Special category data. Voice samples and facial images used for avatar or spokesperson video may constitute biometric data when processed to identify or recreate a specific individual. We process this only on your instruction and only to deliver the feature you requested. If the likeness belongs to a real person, you are responsible for obtaining that person's explicit consent before uploading it.
4. AI processing — what happens to your content
Generating an article, image, or video sends your prompt, business profile context and research material to the AI providers listed on our Subprocessors page.
- Your data is not used to train anyone's models. We use commercial API tiers under which customer inputs and outputs are excluded from model training by default.
- Providers may retain inputs briefly for abuse monitoring — typically up to 30 days — before deletion, under their own published terms.
- We do not use your content to train our own models, and we do not use one customer's content to generate another customer's content.
Automated decision-making. The platform makes automated choices about content — topics, structure, wording, which links to insert, when to publish. These decisions concern content, not people, and produce no legal or similarly significant effect on any individual within the meaning of Article 22. No profiling of individuals for decisions about them is carried out.
5. Who we share it with
- Subprocessors — the providers listed on our Subprocessors page, each under a written data processing agreement.
- Connected Platforms — where you have authorised publishing, we send content and credentials to those platforms at your direction.
- Professional advisers — accountants, auditors and lawyers, bound by confidentiality.
- Authorities — where required by law, court order or a valid regulatory request. We will tell you unless legally prohibited.
- A buyer — if we sell or reorganise the business, under confidentiality obligations. We will notify you before your data becomes subject to a different privacy policy.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
We are UK-based. Some subprocessors are in the United States. Where personal data leaves the UK or EEA we rely on:
- the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the IDTA, for UK transfers; and
- the EU Standard Contractual Clauses (2021/914) for EEA transfers; and
- the EU–US Data Privacy Framework where the recipient is certified;
together with a transfer risk assessment, and encryption in transit and at rest.
Our EU-hosted subprocessors — n8n GmbH (Germany) and DataForSEO OÜ (Estonia) — involve no international transfer.
You may request a copy of the safeguards we rely on from [email protected].
7. How long we keep it
| Data | Retention |
|---|---|
| Account and business profile | While your account is open, then deleted within 30 days of account deletion |
| Articles, media and generated content | While your account is open, then deleted within 30 days of account deletion |
| Seed articles from RSS feeds | Automatically deleted after 3 days unless you save them |
| Connection credentials and tokens | Deleted immediately when you disconnect the integration or delete your account |
| Credit transactions and invoices | 6 years from the end of the relevant financial year — required by UK tax and company law |
| Security, abuse and sign-up attempt logs | 12 months |
| Server and edge logs | 30 days |
| Support correspondence | 24 months after the ticket closes |
| Encrypted backups | Purged on a rolling 90-day cycle; deleted records disappear from backups within that window |
| Marketing suppression list (so we do not email you again) | Indefinitely — this is the record of your opt-out |
| Declarations signed on an evidence record, with the signer's name and role | For as long as the business holding the record keeps it, including after the signer's account is closed. See 7.1 |
7.1 Declarations on an evidence record
Some articles carry an evidence record: the sources behind each claim, the checks we ran on them, and the declarations people made about them. A declaration is anything a person signs on that record, for example an attestation that they personally checked a claim, or a withdrawal of an earlier attestation. This applies to everyone who signs, not only to clinical reviewers.
Before anyone signs, they are shown the following, and the signature is not taken until they agree to it:
What you sign here becomes part of the evidence record for this article, and that record belongs to the business whose account it is. Your name, your role, your statement, the basis you give, and any credential recorded against you are kept on it exactly as they are when you sign, for as long as the business keeps the record. Your name cannot be removed from it. You cannot edit or delete what you signed, and closing your own account does not remove it. If you change your mind, you can add a signed withdrawal, which is shown beside your statement and does not replace it. You can do that only while your account is open. The business, or someone it authorises, can also withdraw your statement at any time, whether or not your account is open; the record then names who withdrew it and says it was not you. The business can erase the whole record, and if it does, what you signed is erased with it.
What is kept. The name and professional role the signer recorded about themselves, the statement they wrote, the basis they gave, the date and time, any credential recorded against them at that moment (its type, register number and scope, and whether it had been checked), and the version and wording of the notice above that they agreed to. All of it is kept as it was at the moment of signing. A later change to the signer's profile or credential does not alter it.
Who holds it. The record sits in the account of the business that owns the article, and the business is responsible for it. For that record we act on the business's behalf, as described in section 1 and in our DPA.
How long. For as long as the business keeps the evidence record for that article, including after the article is unpublished. It ends when the business erases the record. Erased content leaves our encrypted backups within 90 days. What remains after an erasure is a record that the erasure happened: who performed it, when, why, and how many items were removed. That record contains nothing anyone signed and no signer's name.
Your name cannot be removed. We do not remove or disguise names on a declaration. A declaration is only worth something because a reader can find out who made it and check their standing, for example against a professional register, and a declaration with the name taken off cannot be checked. Your name stays on the record for as long as the record exists.
Closing an account that signed, holds a credential, or owns a record. At present, if you have signed a declaration, hold a reviewer credential, or own an evidence record, deleting your account from Settings does not complete, because the record cannot lose the people it names. Your connected integrations are disconnected, but your account and its data remain. Until we have built a closure process for these accounts, email [email protected] and we will reply within one month, as the law requires, telling you what can be removed and what must be kept. Declarations you made on a business's evidence record are kept in every case, because they are part of that business's record rather than yours.
Withdrawing. A declaration cannot be edited or deleted, by you, by the business, or by us. If you no longer stand behind it, you can add a signed withdrawal giving your reason. The withdrawal is shown beside the original and does not replace it, because a correction belongs next to what it corrects. You can add one only while your account is open.
Withdrawal by the business. The business that holds the record, or a person it has authorised to do so, can also withdraw your declaration, at any time and whether or not your account is still open. That power exists because once you close your account the business is the only party left who can retract a statement, and a statement nobody can retract is worse than one somebody else retracted openly. So it is always done openly: the withdrawal is signed by the person who made it, carries their name, role and reason, and the record says plainly that it was made by somebody other than the person who signed. It never alters or removes your declaration.
Your rights. You can ask what is held about you, and you can object to it being kept. Because the record exists so that published information can be traced to the people who stood behind it, and because it may be needed to establish or defend legal claims, a request to erase a declaration from a record that still exists will normally be refused, as Article 17(3) of the UK and EU GDPR permits. We pass any such request to the business that holds the record, and tell you we have done so, within 5 business days. You can complain to the Information Commissioner's Office at ico.org.uk.
8. Security
We protect your data with encryption in transit (TLS) and at rest, AES-256-GCM encryption of all third-party credentials, row-level security in the database, role-based access controls, least-privilege service credentials, and rate limiting. Our full Security Statement has the detail, including how we handle incidents.
If a breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell you without undue delay where the risk is high.
9. Your rights
Under UK and EU GDPR you have the right to:
- Access — get a copy of your personal data;
- Rectification — have inaccurate data corrected;
- Erasure — have your data deleted (see Data Deletion and Export);
- Restriction — have processing paused while a dispute is resolved;
- Portability — receive data you gave us in a machine-readable format, or have it sent to another provider;
- Object — object to processing based on legitimate interests, and to direct marketing at any time, absolutely;
- Withdraw consent — where we rely on consent, without affecting past processing;
- Not be subject to solely automated decisions with legal or similarly significant effects.
How to exercise them. Use the self-serve export and delete tools in Settings → Data and Privacy, or email [email protected]. We respond within one month and will not charge you. We may extend by two further months for complex requests, and will tell you if we do. We may ask you to confirm your identity.
Complaints. If you are unhappy with how we have handled your data, please tell us first. You can also complain to the UK Information Commissioner's Office at ico.org.uk (helpline 0303 123 1113), or to the supervisory authority in your EU country of residence.
10. If you are in California
You have the right to know what personal information we collect, to delete it, to correct it, to opt out of sale or sharing, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. The categories we collect and our retention periods are set out in sections 2 and 7. Exercise your rights at [email protected].
11. Cookies
We use a small number of strictly necessary cookies and browser storage keys, and no advertising or third-party analytics trackers. Everything we set is itemised in our Cookie and Local Storage Policy.
12. Children
The Service is for business use and is not directed at children. You must be 18 or over to hold an account. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email [email protected] and we will delete it.
13. Changes to this policy
We will update this page when our practices change and revise the "last updated" date. For changes that materially affect how we use your data, we will give at least 30 days' notice by email or in-app before they take effect.
14. Contact
Darran Goulding, trading as Digital Visibility and as AutomateSEO 235 Peniel Green Road, Llansamlet, Swansea, Wales, SA7 9BA, United Kingdom Sole trader — no company registration number
Privacy contact: [email protected] Security reports: [email protected]