Privacy Policy

SeoWave (“SeoWave”, “we”, “us”) provides AI visibility and SEO audit software for businesses, agencies, and consultants. This Privacy Policy describes how we collect and use personal data when you visit our website, run a free scan, create an account, run scans, or subscribe to a paid plan.

By using SeoWave, you agree to this policy. If you do not agree, please do not use the service.

For the SeoWave application and website, we act as the data controller for account, project, and audit data you submit. You can contact us at support@seowave.app.

If you are an agency or consultant and you upload data about your own clients, you are responsible for that data and SeoWave acts as a processor on your behalf (see section 8). We offer a data processing agreement (DPA) on request.

For payment transactions, Polar Software, Inc. (548 Market St, PMB 61301, San Francisco, CA 94104, United States) acts as Merchant of Record and processes payment-related personal data under its own terms and privacy policy.

We collect information in these categories:

• Account data: name, email address, authentication identifiers (including your Google identifier and email if you sign in with Google), organization membership, and workspace settings.
• Free scan without an account: the URL you enter, the scan result, a hash of your IP address (to limit abuse) and, if you ask for it, the email address where you want to receive the result. We send that message to the address you type without verifying that it is yours; if you receive an email you did not request, ignore it or write to us and we will delete that data.
• Project and scan data: website URLs, brand metadata, competitor domains, crawl results, audit scores, AI prompt runs, recommendations, content drafts, and generated reports.
• WordPress credentials: if you connect your site to publish, we store the site URL, username, and application password you give us. They are stored encrypted, used only by our servers to create or update the posts you ask for, and you can remove the connection at any time.
• Usage and technical data: IP address, browser type, device information, pages viewed, feature usage, and error logs.
• Billing metadata: subscription plan, billing status, Polar customer and order references — not full payment card details.
• Marketing data (only with your consent): Meta pixel cookie identifiers (_fbp, _fbc), IP address, user agent, and SHA-256 hashed email, plus the page and the event (signup, checkout start, purchase).
• Communications: messages you send to support and feedback you voluntarily provide.

We use personal data to:

• Provide, operate, and improve the SeoWave platform and audit pipeline.
• Authenticate users, enforce plan limits, and secure multi-tenant workspaces.
• Run website crawls, SEO audits, and AI visibility checks you request.
• Generate scores, recommendations, content drafts, and reports, and publish drafts to your WordPress site when you ask us to.
• Process subscriptions and communicate about billing, renewals, and service updates.
• Email you the result of a free scan when you request it.
• Measure whether our ads work and understand aggregate usage of the site, only with your consent when browser cookies or identifiers are involved (section 7).
• Monitor reliability, prevent abuse, and comply with legal obligations.
• Send product communications where permitted; you may opt out of non-essential marketing emails.

Where GDPR or UK GDPR applies, we rely on: (a) contract or pre-contractual steps — to deliver the service you signed up for and the scan you request; (b) legitimate interests — to secure, improve, and operate SeoWave, prevent abuse, and record operational events for your account, in a way that does not override your rights; (c) consent — for the Meta pixel and its Conversions API; and (d) legal obligation — where we must retain or disclose data by law.

We use trusted providers to run SeoWave. They process data only on our instructions and under appropriate safeguards, except Meta and Google, which act under their own terms in the cases noted:

• Supabase — authentication, database, and file storage (including PDF reports).
• Vercel — application hosting and delivery, and Vercel Web Analytics (aggregate visit metrics, no cookies).
• Cloudflare — CDN, DNS, and protection against abuse of the domain.
• Trigger.dev — background jobs for long-running audits.
• Upstash — caching, rate limiting, and operational locks.
• OpenRouter — a single gateway to the AI models. It forwards the prompts of visibility checks and content generation (which contain brand names, domains, and excerpts of your public pages) to the model providers that answer them (for example OpenAI, Anthropic, Google, Perplexity, xAI, and DeepSeek) and to the web search service it uses for search-backed answers. Do not enter third-party personal data in brand or instruction fields.
• Resend — transactional email delivery (receives the recipient address and the message content).
• Sentry — error monitoring (may include your IP and technical error data).
• Google — Sign in with Google (OAuth), only if you choose that method.
• Polar — Merchant of Record checkout, subscriptions, invoicing, and tax compliance.
• Meta Platforms — pixel and Conversions API, only with your consent: they receive cookie identifiers, IP address, user agent, SHA-256 hashed email, the page URL, and the event type.

We use essential cookies to keep your session, remember your language and active workspace, and remember your cookie choice. They need no consent because the service cannot work without them.

Only with your prior consent we also use the Meta (Facebook) pixel and its Conversions API to measure whether our ads work, and a first-party first-visit cookie (sw_ft) that remembers which campaign you came from. Without your consent we do not load the pixel, do not write those cookies, and do not send Meta any signup, checkout, or purchase event.

You can accept or reject in the notice shown on your first visit, and rejecting is as easy as accepting. You can change or withdraw your choice at any time with the “Cookie preferences” link in the footer. Withdrawing consent stops sending data from that moment on; it does not affect what was already processed. Data already received by Meta is governed by its own terms.

Cookies and local storage we use:

Shareable links. If you press “Share” on your free scan, we publish a card with the brand, domain, and score at a public URL with a random identifier (/s/…). If you turn on the public link of a report, anyone who has the URL (/r/…) can see its content: brand, scores, mentions, and recommendations. These pages are not indexed, but they have no password: share the links only with people you choose. You can stop sharing a report at any time from the dashboard.

Agencies. If you use SeoWave with data about your agency’s clients (domains, brands, competitors, reports), you decide what data you upload and why; SeoWave processes it only to provide you the service, following your instructions, as a processor. You are responsible for having the legal basis and your clients’ permissions. If you need a data processing agreement (DPA), request it at support@seowave.app.

We keep account and project data while your account is active. These are the specific periods:

• Account or workspace deletion: the workspace stops being available immediately and is kept for 30 days in case you want to restore it. After that it is permanently deleted, with its projects, audits, reports (including stored PDFs), content, publishing connections, and email delivery logs. Your sign-in account is deleted when it was the last workspace you belong to.
• Free scan without an account: the result expires after 3 days. If you do not save it to an account, we delete the record (URL, result, any email you gave, and IP hash) about 30 days after it expires. If you shared the public card, the card remains but the email and IP hash are removed.
• Billing and operational records (payment events, error and audit logs): kept, disconnected from the deleted workspace, for as long as needed for accounting, security, and legal obligations. Polar keeps its billing records as required by applicable law.
• Email suppression list: we keep the address of anyone who unsubscribes or bounces so we do not email them again.
• Backups: deleted data may remain in Supabase backups for a limited period until they are overwritten.
• What third parties keep after deletion: Polar (payment and billing records, as required by law), Meta (events already received, under its own terms and data management tools), Resend, Sentry, and Vercel (delivery, error, and access logs for the periods each provider sets), and the AI model providers reached through OpenRouter (under their own retention policies). SeoWave can request deletion from these providers where possible but does not control their timelines.

SeoWave and its providers may process data in the United States and other countries outside the European Economic Area and your country of residence. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or other valid mechanisms (for example the EU-US Data Privacy Framework where the provider is certified).

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also withdraw consent where processing is consent-based. From the dashboard (Settings) you can export your data and delete your account.

To exercise these rights, email us at support@seowave.app. You may lodge a complaint with your local data protection authority. We respond to verified requests within applicable legal timeframes.

We implement technical and organizational measures including encryption in transit, encryption of publishing credentials, tenant isolation, role-based access, and audit logging. No method of transmission or storage is 100% secure; we continuously work to reduce risk.

SeoWave is a business tool not directed at children under 16. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may be communicated by email or in-product notice where appropriate.