SEO Heatmap — Privacy Policy

1) Key points (plain English)

• We do not sell or rent your data.
• We do not share your personal data or your account data (including Search Console traffic, pages, URLs, and performance metrics) with third parties for marketing or monetization.
• We use Google Analytics on the public Website only (not inside the App).
• The App connects to Google Search Console via Google OAuth. We store OAuth tokens to keep your connection working.
• If you use AI insights, we use OpenAI as a processor, and page/URL data is anonymized before being sent for processing.
• We apply best efforts to protect the data you provide, but no online service can guarantee absolute security.

2) Information we collect

2.1 Information you provide during signup

When you create an account, we collect:

• Full name
• Email address
• Profile image (avatar), if provided by your authentication provider

2.2 Information we collect when you use the App

To provide the App's functionality, we may collect and process:

• Google OAuth information, including access tokens and refresh tokens (stored by us to maintain the connection)
• Google Search Console property information you connect (e.g., verified site/property identifiers)
• Search Console performance data: clicks per page and period, and, when you open the Keywords view, the search queries Search Console reports for your site with their clicks, impressions and average position per month and per week, to the extent available through Google Search Console

We refer to Search Console performance information and related metrics as "Account Data."

2.3 Information collected on the public Website (getseoheatmap.com)

We use Google Analytics on the public Website to understand how visitors use the site. Google Analytics may collect information such as:

• pages viewed and navigation paths,
• device and browser type,
• approximate location,
• referral sources,
• session duration and interactions.

Google Analytics may use cookies or similar technologies. We do not use Google Analytics inside the App.

2.4 Support communications

If you contact us, we may collect your contact information (e.g., email) and the content of your message.

3) How we use information

We use your information to:

• create and manage your account;
• authenticate you and enable sign-in;
• connect to Google Search Console and provide the App's page-level and keyword-level visualizations;
• store and use OAuth tokens so the App can access Search Console on your behalf without requiring repeated logins;
• operate, maintain, and improve the Service;
• troubleshoot issues, prevent abuse, and protect the security and integrity of the Service;
• analyze Website traffic via Google Analytics (Website only);
• respond to support requests.

We do not use your data to sell advertising audiences, to create third-party marketing profiles, or to monetize your Search Console performance information.

4) AI insights (OpenAI) and anonymization

If you choose to use AI insights features in the App:

• We may send anonymized data to OpenAI for processing.
• Page/URL data is anonymized before it is transmitted (for example, by removing or replacing identifying URL strings so OpenAI does not receive the original page addresses).
• We do not intentionally send your raw, identifiable URLs to OpenAI as part of AI insights.
• OpenAI's processing is used only to generate insights for you and is not used by us for marketing.

4a) AI assistant connectors (MCP)

If you connect SEO Heatmap to an AI assistant (for example Claude, Codex or ChatGPT) through our MCP connector:

• You sign in and approve the connection on our consent screen; nothing is shared until you do.
• The assistant receives the data it asks for on your behalf: your account's email address, the sites you've synced, page URLs and click counts per period. Its provider then processes that data under its own terms and privacy policy.
• The connector is read-only, except that it can ask SEO Heatmap to refresh a site's data from Google Search Console, at most once per site per day.
• You can disconnect an assistant at any time at getseoheatmap.com/mcp-server ("Connected AI apps"), which revokes its access.

4b) The SEO Heatmap Chrome extension

If you install our Chrome extension:

• It does nothing until you click its icon, and then it works only with the page in that tab. It doesn't read other tabs or your browsing history.
• To show that page's title, meta tags, headings, links and structured data, it reads them in your browser, and it may load the page again from that website to read its robots headers. This stays on your device: the extension doesn't send the page's content to us or anyone else.
• If you connect it to your SEO Heatmap account, it sends us the address of that page, so we can show the page's click history from your account.
• We use that address only to answer the request. We don't store it, and we don't use it for anything else.
• You connect it on our consent screen. It keeps its sign-in tokens in your browser's extension storage on that device, and nowhere else.
• "Disconnect" in the extension signs it out and ends its session; removing the extension deletes its stored tokens.

5) Sharing and selling data (personal and account data)

We do not sell, rent, or share your Personal Data or Account Data (including traffic, pages, URLs, search queries, clicks, and related metrics) with third parties for their marketing, advertising, resale, or other monetization purposes.

We may share limited data only in these circumstances:

• Service providers: vendors who help us operate the Service (e.g., hosting, infrastructure, error monitoring, email delivery). They may access data only as necessary to perform services for us and must protect it.
• OpenAI (AI insights processor): only anonymized data necessary to generate AI insights, when you use that feature.
• Legal obligations: if required by law, court order, or valid legal process.
• Protecting rights and safety: to investigate, prevent, or take action regarding suspected fraud, abuse, security incidents, or violations of our Terms.

5.1 Payments (Paddle)

Paddle.com is our reseller and merchant of record. When you buy, Paddle processes your name, email, billing country and address, optional VAT number and payment details under Paddle's own privacy policy. We never see your full card number. We store your Paddle customer and subscription ids, your plan and your subscription status.

5.2 Service emails (Resend)

We use Resend to send account emails (trial and plan notices). Resend receives your email address and the message.

6) Cookies and analytics

6.1 Google Analytics (Website only)

We use Google Analytics on the public Website. Google Analytics may set cookies and collect usage information to generate reports about Website activity.

You can control cookies in your browser settings and may be able to use opt-out tools offered by Google.

6.2 No analytics inside the App

We do not use Google Analytics (or similar advertising analytics) inside the App.

7) Data retention

We retain information only as long as reasonably necessary to:

• provide and maintain the Service;
• keep your account functional;
• comply with legal obligations;
• resolve disputes; and
• enforce our agreements.

OAuth tokens: Because we store OAuth tokens to maintain your connection, we retain them while your account is active and/or until you revoke access or request deletion, subject to legal and operational requirements.

8) Data security (best efforts)

We use best efforts and reasonable administrative, technical, and organizational safeguards designed to protect Personal Data and Account Data. This may include access controls, encryption in transit, and other security measures appropriate to the Service.

However, no method of transmission or storage is completely secure. You acknowledge that we cannot guarantee absolute security and that you use the Service at your own risk.

9) Your choices and rights

9.1 Disconnect Google Search Console

You can revoke the App's access to your Google account at any time from your Google account security settings. After revocation, the App will no longer be able to access your Search Console data.

9.2 Cookies and analytics controls

You can block or delete cookies via your browser settings. You may also be able to use available opt-out mechanisms offered by Google Analytics.

9.3 Account information

You may request access to, correction of, or deletion of your account information by contacting us (see Section 13). Your rights may vary depending on your location.

10) Children's privacy

The Service is not intended for children under 13 (or the minimum age required by your jurisdiction). We do not knowingly collect personal information from children.

11) International users

Your information may be processed in countries other than where you live, depending on where we or our service providers operate. By using the Service, you understand your information may be transferred internationally.

12) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Effective date" above when changes are made. Your continued use of the Service after changes become effective means you accept the updated Privacy Policy.

13) Contact

Questions or requests about this Privacy Policy can be sent to: [email protected]