Privacy
Policy

We have not appointed a Data Protection Officer as our processing activities do not meet the threshold requiring a mandatory DPO under GDPR.

For any privacy questions or data rights requests, please contact privacy@seoptim.ai.

If you require a Data Processing Addendum (DPA), contact privacy@seoptim.ai.

Data You Provide

• Identity and contact data: full name, email address
• Business data: business name(s), business address(es)
• Service input data: website URLs and related metadata you submit

Data Collected Automatically

• Technical/log data: IP address, device and browser information, timestamps, authentication/session identifiers, and security/audit logs

Image Metadata (EXIF)

We do not process EXIF metadata. Where present, EXIF is cleared/removed as part of our handling of images.

Contract Necessity (Article 6(1)(b))

• Create and administer accounts; authenticate users; provide access to the Service
• Provide the core Service functions (processing submitted images and URLs to produce optimisation outputs)
• Provide support by email and respond to service requests

Legitimate Interests (Article 6(1)(f))

• Maintain Service security (RBAC, access logging, audit trails), prevent fraud/abuse, and investigate incidents
• Ensure Service reliability and diagnose errors (error tracking and monitoring)
• Business operations (internal reporting, improving the Service based on aggregate usage patterns)

Consent (Article 6(1)(a))

Marketing communications (opt-in only). You can withdraw consent at any time via unsubscribe links or by emailing privacy@seoptim.ai.

Legal Obligation (Article 6(1)(c))

Retain invoices and accounting records where required by law (see Section 9).

We do not sell personal data. We share personal data only as needed to run the Service.

Sub-processors / Service Providers

Coarse Product and Campaign Analytics

We use self-hosted Umami to report aggregate server-side event counts. This helps authorised product operators compare coarse product outcomes and approved campaign entry and checkout stages.

We intentionally supply only the event name, bounded product categories, approved campaign source, campaign medium, campaign name and optional content variant, plus fixed, neutral protocol metadata required to deliver the event. The same fixed aggregate identity is used for every event.

We do not intentionally supply an account identity, email address, browser identity, visitor or inbound IP address or user agent, device identity, request or session identity, HMAC-derived identity, payment or Stripe identity, raw URL, query string, referrer, or arbitrary campaign value. Instead, our server supplies one fixed loopback IP substitute and one fixed synthetic protocol user agent, identical for every event. We do not use analytics cookies, analytics local storage, individual profiles, cross-device identity, session replay, visitor journeys, or detailed attribution for this launch measurement.

These counts are not unique visitors or sessions. They cannot show complete or returning-customer journeys, and an outcome may remain unattributed when the visitor does not continue directly from an approved campaign action.

Sub-processor Changes

Where we process Customer Personal Data on your behalf, our DPA contains the current sub-processor schedule and change-notification terms. Request the DPA at privacy@seoptim.ai.

Legal and Compliance

We may disclose personal data if required by applicable law, regulation, court order, or to protect our rights and users, acting proportionately.

Our primary application hosting and object storage are located in Germany or elsewhere in the EU, and transactional email is configured for AWS region eu-west-2. However, some suppliers, their affiliates, support personnel, payment operations, and CDN or security infrastructure may process or access personal data from other countries.

Where personal data is transferred from the United Kingdom or EEA to a country that is not covered by an applicable adequacy regulation or decision, we use an appropriate safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or the EU Standard Contractual Clauses. We assess relevant transfer risks and apply supplementary safeguards where appropriate.

Information about applicable safeguards may be requested at privacy@seoptim.ai.

We use strictly necessary cookies for authentication, security, and maintaining your logged-in session.

Launch analytics is sent by our server. It does not load provider analytics code in your browser and does not create an analytics cookie or analytics local-storage identifier. We do not use advertising cookies.

Any future browser-based or individual analytics would be a separate, reviewed project with appropriate privacy and consent controls; it would not be silently mixed into this aggregate launch dataset.

Deletion may be delayed where required to comply with legal obligations or to establish, exercise, or defend legal claims.

We implement appropriate technical and organisational measures:

• TLS encryption in transit
• Encryption at rest
• Field-level encryption for PII
• Role-Based Access Control (RBAC) and least-privilege access
• Access logging and internal security audits
• Encrypted backups and recovery procedures

We use AI (Mistral inference with ZDR enabled) to generate image optimisation recommendations.

• These outputs are recommendations only and do not produce legal or similarly significant effects about individuals
• We do not perform solely automated decision-making that has legal or similarly significant effects under Article 22 UK/EU GDPR

Depending on your location and applicable law (UK GDPR / EU GDPR), you may have the right to:

To exercise rights, email privacy@seoptim.ai. We may need to verify your identity and authority (for business accounts).

We would appreciate the opportunity to address concerns first—please contact privacy@seoptim.ai.

If we become aware of a personal data breach, we will assess it and:

• Notify the relevant supervisory authority within 72 hours where required
• Notify affected users without undue delay where the breach is likely to result in a high risk to individuals' rights and freedoms

Security incident reports: security@seoptim.ai

We may update this Policy from time to time. We will post the updated version on the Service and, where appropriate, notify account administrators by email. The "Effective date" above will show when changes apply.