Privacy Policy.

This policy explains what ConceptSEO ("we", "us", "our") collects from Customers and visitors at seo.concept211.com, why we collect it, how we store it, who else handles it on our behalf, and the rights you have over it. We try to write it plainly. Capitalized terms not defined here have the meaning given in our Terms of Service.

1. Who we are

ConceptSEO is operated from Orlando, Florida, USA. We are the data controller for personal information we collect from Customers and visitors to seo.concept211.com. For data we process on a Customer's behalf about their end-users (e.g., analytics data we ingest from Google Analytics into the dashboard), the Customer is the controller and we are a processor / service provider acting on the Customer's instructions.

2. What we collect

From visitors

• IP address, user-agent, and the pages you visit on our site, for security, abuse prevention, and aggregate analytics.
• If you submit our free-audit form: the domain you entered, the email address you entered, the time of submission, and the IP it came from.
• If you submit our contact form: the message contents, your name, your email address, and the IP.

From Customers

• Name, email address, and a hashed password (Argon2id) for your account login.
• The domain(s) you subscribe.
• Billing identifiers issued by Stripe (Customer ID, Subscription ID). We do not see or store your credit-card number, CVV, or full billing address — those go directly to Stripe.
• Timestamp, IP address, and policy version of your acceptance of these Terms and this Policy.
• Access Credentials and configuration data you enter into the dashboard (see Section 3).
• Usage data: which dashboard pages you view, which features you use, when. Used for product improvement and abuse detection.

3. Access Credentials & how we protect them

To perform the Service, Customers commonly provide us with Access Credentials such as: OAuth tokens for Google Analytics / Search Console / Business Profile / Ads, SFTP or SSH credentials for their web host, CMS administrator logins, DNS provider logins, IndexNow keys, Cloudflare API tokens, and similar.

3.1 Where they live

Credentials are stored in our application database, encrypted at rest using AES-256-GCM with keys controlled by us and rotated on a documented schedule. The database itself sits on dedicated infrastructure at our hosting provider (GoDaddy, Orlando, FL) behind a hardened firewall.

3.2 Who can decrypt them

Only the production application process and authorized ConceptSEO personnel performing the Service can decrypt Access Credentials. We do not log credential values, do not include them in error reports, and do not share them with any subprocessor not strictly necessary to perform the work the credential was given for.

3.3 OAuth preferred over passwords

Where the upstream provider supports it (Google products in particular), we use OAuth tokens rather than passwords. OAuth tokens can be revoked by you at any time without changing your password, and they are scoped to the specific permissions the Service needs.

3.4 Your right to revoke

You may revoke any credential at any time by changing the underlying password, removing our user from the property, or rotating the API key on the provider side. We recommend rotating any credential after canceling the Service — see Terms section 4.5.

4. How we use information

• To provide the Service to the Customer who provided it.
• To process payments and prevent fraud (via Stripe).
• To send transactional emails (account confirmation, set-password link, billing receipts, branded reports, onboarding requests, security alerts).
• To detect and prevent abuse, security incidents, and violations of our Terms.
• To comply with legal obligations (tax, accounting, law-enforcement requests where legally required).
• To improve the Service based on aggregated, anonymized usage analytics.

We do not sell personal information. We do not share personal information with third parties for their independent marketing purposes.

5. Google API user data

When you connect a Google account, we request only the scopes needed to run the service you subscribed to. Google Analytics 4 and Search Console are read-only, as is Google Ads if you opt in. We request write access in two places: the limited scope needed to submit URLs for indexing, and, where you opt in to Business Profile management, the scope needed to publish Business Profile posts and draft review replies for your approval. Business Profile access stays read-only if you do not opt in.

ConceptSEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the SEO features the Customer subscribed to. We do not use Google user data to train, fine-tune, or evaluate any machine-learning model. We do not sell or share Google user data with advertisers, data brokers, or other third parties. You can revoke Google access at any time from your dashboard's Account Settings page or from myaccount.google.com/permissions.

6. AI providers & your content

The Service sends data to AI providers (currently Anthropic and OpenAI) so they can generate analyses, recommendations, and content drafts. Data sent includes the Customer's URLs, page content fetched from the Customer's own public website, analytics data the Customer authorized us to access, and the prompts we construct to instruct the model.

Both providers have committed in their enterprise terms that they do not use the data we send to train their models and retain it only for the period necessary to process the request and comply with their security/abuse policies. We do not send credit-card numbers, Access Credentials, or other secret values to AI providers.

7. Subprocessors

We use the following subprocessors to deliver the Service. Each is bound by their own privacy commitments and processes data only as needed to perform the function described.

We will update this list as our subprocessors change. Material additions will be announced by email to active Customers at least thirty (30) days before they take effect, with a chance to object by terminating the subscription.

8. Data retention

• Account data (name, email, hashed password): retained while the account is active and for 90 days after the last subscription ends, then deleted.
• Access Credentials: purged from active systems within 30 days of subscription termination; encrypted backups overwritten within an additional 60 days. See Terms section 4.5.
• Audit / analytics / report data: retained for the life of the subscription plus 12 months for reference and dispute resolution, then deleted unless you have requested ongoing access.
• Billing records: retained for 7 years as required by US tax / accounting law.
• Web-server logs & security logs: 90 days.
• Audit-request emails & reports from non-subscribers: 24 months, then deleted.

9. Security practices

• All web traffic is served over HTTPS (TLS 1.2+); HTTP requests are 301-redirected to HTTPS.
• Passwords are hashed with Argon2id (Laravel default) — never stored in plaintext.
• Access Credentials and other secrets are encrypted at rest with AES-256-GCM using application-level keys.
• Webhook payloads (Stripe) are verified by HMAC-SHA256 signature before processing.
• Set-password links are signed (Laravel's signed-URL HMAC) and expire after 7 days.
• The application uses Laravel's Eloquent ORM (parameterized queries) to eliminate the SQL-injection class of bug.
• Blade templates auto-escape output by default to prevent XSS.
• CSRF protection is enforced on all state-changing routes except verified webhooks.
• Production secrets live only in the server's environment file, never in source control.
• Administrative access to production infrastructure requires SSH key authentication.

No security program is perfect. Despite our controls, no system is immune to compromise. We commit to continuous improvement and to honest, timely notification if something goes wrong.

10. Data-breach notification

If we confirm a security incident involving unauthorized access to your personal information or Access Credentials, we will: (a) notify affected Customers by email within seventy-two (72) hours of confirmation; (b) describe what we know, what we don't know, and what steps you should take (almost always: rotate credentials immediately); (c) cooperate with applicable regulators as legally required. We will not delay notification to investigate root cause beyond what is operationally necessary.

11. Cookies & analytics

We use a small number of first-party cookies for: (a) session authentication on the dashboard; (b) CSRF protection; (c) the form-submission timestamp used to detect bot traffic. We do not use third-party advertising cookies. We do not run third-party analytics scripts (Google Analytics, Mixpanel, Segment, etc.) on our marketing site or dashboard.

12. Your rights (US, EU, UK, California)

Depending on where you reside, you may have the right to: (a) access the personal information we hold about you; (b) correct inaccuracies; (c) request deletion; (d) request export in a portable format; (e) object to or restrict certain processing; (f) opt out of "sale" or "sharing" of personal information (we do neither). To exercise any of these rights, email seo@concept211.com. We will respond within 30 days, or sooner where law requires. We will not charge a fee or retaliate against you for exercising your rights.

If you are an EU/UK resident, our lawful bases for processing are: contract (to provide the Service you subscribed to), legitimate interests (to keep the Service secure and improve it), and consent (for optional features). You may lodge a complaint with your local supervisory authority, though we hope you'll contact us first.

13. International data transfers

Our infrastructure is in the United States. If you access the Service from outside the US, you understand that your information will be transferred to, stored, and processed in the US. Where required (e.g., for EU/UK residents), we rely on the EU Standard Contractual Clauses or equivalent transfer mechanisms with our subprocessors.

14. Children's data

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have, please contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email at least 30 days before they take effect. The effective date and version at the top of this page indicate the current revision.

16. Contact

Email seo@concept211.com with any privacy question, data-subject request, or breach concern. We will respond promptly.

ConceptSEO · Orlando, Florida, USA