Privacy Policy

Version 2.3, last updated 25 October 2026. This version adds a section on Google user data (section 2.12): what we access when you sign in with Google or connect Search Console, Google Analytics or Google Ads, how we use it, and our commitment to the Google API Services User Data Policy. The previous version, 2.2, was dated 8 October 2026 and is kept here for reference.

UtilitySEO Ltd ("we", "us", "our") explains here how we collect, use, store and protect your personal data when you use utilityseo.com and app.utilityseo.com (together, the "Services"). This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Data Controller: UtilitySEO Ltd Company number: 17055142 Registered address: 4 Frances Street, Cheadle, SK8 2AE ICO registration: ZC099913 Contact, including data protection requests: support@utilityseo.com

2. What data we collect

2.1 Account and identity data

Full name
Email address
Password, stored as a one-way bcrypt hash. We never store your plain text password
Account creation date and time
Subscription tier

2.2 Payment and billing data

Stripe Customer ID, a reference token
Last four digits of your payment card, provided by Stripe for your reference
Card fingerprint, a non-reversible hash used for fraud prevention
Billing address, if provided at checkout
Transaction history and subscription status

We never receive or store full card numbers, CVV codes or complete payment card details. All payment processing is handled by Stripe, Inc.

2.3 Usage and technical data

IP address, logged at account creation, on each login, on free-scan leads and on the record of which version of our Terms and this policy you agreed to. IP addresses are kept for 12 months
Browser type and version, and operating system
URLs you have analysed
Daily scan usage counts
Login timestamps and error logs

2.4 Search performance data from Google Search Console

If you connect a Google Search Console property, we read and store your search performance data: search queries, landing pages, clicks, impressions and average position.

We store this as a weekly series and keep it indefinitely while your account is open, including after Google's own 16-month window has deleted it from Search Console. Section 7 explains why.

We access this through Google's OAuth flow. You choose which properties to connect, and you can disconnect at any time from your account settings or by revoking access in your Google account.

2.5 Website audit and crawl data

When we crawl a website you have added, we store the following for each page, for each crawl, indefinitely while your account is open:

URL, title tag, meta description and first heading
Word count
Canonical URL and robots directives
HTTP status code
Click depth and internal link count

This is content published on a website rather than personal data in most cases. It can contain personal data where a page includes it, for example an author name on an article.

2.6 AI visibility tracking

What we collect: if you use AI visibility tracking (also called AI brand tracking), we send industry questions to AI services (OpenAI, Google, Anthropic, Perplexity and xAI) to see which businesses they name, and we store the answers and the sources they cite, together with the brand names, competitor names and keywords you configure. No personal data is sent to these services by this feature. Please read section 5 before entering anything into these fields.

Why: to show you whether, and how, AI assistants mention your business and your competitors.

Lawful basis: contract performance.

How long: for the life of the project the tracking belongs to. When you delete the project, or close your account, the questions, answers and sources are deleted with it.

2.7 Free scans, when you do not have an account

You can run a scan on utilityseo.com without signing up. When you do, we store a record containing:

The URL you scanned, and the scan results
Your email address, only if you chose to enter one
Your IP address and browser user agent

The URL and results are stored even when no email is given, so we have a record of what was scanned. We rely on legitimate interests: operating and protecting a free, unauthenticated tool, and following up on business enquiries. If you gave a business email we may contact you about UtilitySEO. You can object at any time by emailing support@utilityseo.com, and we will stop and delete the record.

Retention for these records is set out in section 7.

2.8 Cookies and analytics

Google Analytics only runs after you accept it, either on the cookie banner on our website or with the optional analytics box when you sign up. You can change your choice at any time in Settings in the app, or from the cookie banner link on the website. Lawful basis: consent. See our Cookie Policy for the full list of cookies.

2.9 Team hub and partner programme

What we collect:

Team members and affiliates: name, email address, payout email address, LinkedIn profile URL, referral and partner codes, the sign-ups referred through your codes (shown to you as first name and last initial only) and your earnings and payouts.
Prospects our team contacts: name, company, LinkedIn profile URL, contact notes and any opt-out.

Why: to run the team and partner programme, attribute referrals, calculate and pay commission, and keep a record of who we have contacted and who has asked not to be contacted.

Lawful basis: contract performance for team members and affiliates. Legitimate interests for prospects: introducing UtilitySEO to businesses it may help. A prospect can opt out at any time by replying or emailing support@utilityseo.com, and is then never contacted again (we keep only the opt-out, so that it is respected).

How long: while the relationship lasts, plus 6 years for payment and commission records (HMRC record-keeping).

2.10 Visitor tracking on customers' websites

When a customer adds our tracking tag to their own website, we process their visitors' pseudonymous visitor ID, the pages they view and the referring page, on the customer's behalf, as their processor. The customer is the controller of that data and is responsible for telling their visitors and, where needed, asking for their consent. Our Terms include a data processing section that covers this. This data is kept for 13 months, then deleted.

2.11 Account emails

We send emails you need to use the Services: sign-in codes, receipts, scan results, alerts and weekly reports. Lawful basis: contract performance. Marketing emails are separate and only sent if you opted in; you can opt out of them at any time without affecting account emails.

2.12 Google user data

This section covers the data we receive when you sign in with Google or connect a Google account to UtilitySEO.

What we access. Only what you choose to connect:

Google sign-in: your name, email address and profile picture, to create your account and sign you in.
Google Search Console: search performance data for the properties you connect: search queries, pages, clicks, impressions and average position.
Google Analytics 4: reports for the properties you connect, such as sessions, traffic sources, landing pages and conversions.
Google Ads: data from the accounts you connect, such as campaigns, spend and performance, and search volumes from Google's Keyword Planner. We use this access to read data; we do not create or change your campaigns.

How we use it. Only to show you your own reports, rankings and recommendations inside UtilitySEO. We do not use Google user data for any other purpose.

What we never do with it. We do not sell Google user data. We do not use it for advertising, including retargeting or personalised ads. We do not use it to train AI models, ours or anyone else's. We do not let people read it, except with your permission (for example when you ask our support team to look at your account), for security reasons, or where the law requires it.

How we store and protect it. Google user data is stored securely, encrypted in transit, and only the systems and people who need it to run the service for you can reach it. Section 11 describes our wider security measures.

How to delete it. You can disconnect a Google account at any time in your UtilitySEO account settings or from your Google account's security settings. You can also ask us to delete your Google user data by emailing support@utilityseo.com, and closing your account deletes it as set out in section 7.

UtilitySEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use your data

3.1 Lawful bases

Contract performance: creating and managing your account, processing your subscription, and delivering the Services, including storing and displaying your search performance and audit data, AI visibility tracking, account emails, and running the team and partner programme for team members and affiliates.
Legitimate interests: detecting and preventing fraud, abuse and misuse, including repeat redemption of promotional codes; maintaining the security of our systems; enforcing our Terms; producing anonymised and aggregated statistics as described in section 4; and contacting prospects for the team and partner programme (section 2.9). We have considered the impact on you and consider these interests not to be overridden by your rights.
Legal obligation: complying with applicable law and maintaining financial records.
Consent: sending marketing communications where you have opted in, placing non-essential cookies, and running Google Analytics (section 2.8).

3.2 Purposes

Providing, operating and improving the Services
Showing you how your search performance and technical health change over time
Processing your subscription and managing billing
Sending transactional email
Detecting fraud and abuse
Responding to support queries
Complying with our legal obligations

3.3 Support and debugging

When you report a problem, or our monitoring detects one in your account, an authorised member of our team may access your account, including the data from any Google services you have connected, to reproduce and fix it. Access is limited to that purpose, time-limited, and logged with the staff member's identity and the time. Lawful basis: our legitimate interest in providing and maintaining the service you asked for (UK GDPR Article 6(1)(f)); for a problem you reported, also performance of our contract with you (Article 6(1)(b)). You can ask us not to access your account this way, in which case we may not be able to resolve the problem.

4. Anonymised and aggregated data

We may create anonymised and aggregated statistics from the data in the platform, for example typical search volumes for a keyword, or how often a type of technical issue occurs across websites in general, and use them to operate and improve our services.

Where we publish benchmarks or research externally, we derive them only from website crawl data and from our own keyword data. We do not use the search performance data retrieved from your connected Google Search Console account in anything we publish. Aggregates derived from Search Console data are used internally only.

Anonymised and aggregated data never identifies you, your business or your website, and cannot be reversed to do so. We do not sell your identifiable data, your website's search performance, or your rankings to anyone.

5. Where you use AI brand tracking

This feature works by asking public AI assistants, ChatGPT, Claude, Gemini, Perplexity and Grok, questions about your industry, and recording whether your business is mentioned in the answers. To do this we send those services the brand names, competitor names and keywords you have configured.

Do not enter confidential information into these fields, as it will be sent to those providers and handled under their terms.

6. Where keyword search volumes come from

Keyword search volume figures shown in the platform come from our own Google Ads account, not from any customer's data. No customer's search performance data is used to produce the volume figures shown to any other customer.

7. How long we keep your data

We keep the search performance data and website audit data associated with your account for as long as your account is open, and we do not delete it on a rolling schedule. This is deliberate: Google Search Console only makes the last 16 months of your search data available, so we keep our own record in order to show you trends over a longer period than Google itself will.

If you close your account, we delete your personal data and the data we collected from your connected accounts within 30 days, except for the following.

What we keep	How long	Why
Invoices and payment records	6 years from the end of the accounting period they relate to	HMRC record-keeping, and the 6-year limitation period for contract claims
Your email address, in deactivated form	Until you ask us to remove it	See below
Card fingerprint	3 years from cancellation	Fraud prevention
IP addresses, including on free-scan leads and agreement records	12 months from collection	Security, fraud prevention and evidence of agreement
AI visibility questions, answers and sources	Life of the project; deleted with it	Delivering AI visibility tracking
Team hub and partner programme records	While the relationship lasts, plus 6 years for payment records	Running the programme; HMRC record-keeping
Prospect contact records	Until no longer needed; an opt-out is kept so it is respected	Legitimate interests; honouring opt-outs
Visitor tracking data (processed for customers)	13 months	Provided to the customer as their processor
Server and error logs	90 days	Operating the Services
Marketing consent records	Until consent is withdrawn, plus 3 years	Evidence of consent
Free-scan records: IP address and user agent	Cleared 12 months after the scan	Abuse prevention on a free, unauthenticated tool
Free-scan records: the rest of the record	Deleted 24 months after the scan	Following up on business enquiries

About your email address. When you close your account we deactivate it rather than erasing the record, and we retain your email address so that the same address cannot be used to claim introductory offers and promotional codes repeatedly. We rely on legitimate interests for this. It means that if you close your account and later sign up again with the same address, we will recognise it. You can ask us to erase the address entirely by emailing support@utilityseo.com, and we will do so unless we are required to keep it for one of the other reasons above.

Free-scan records are pruned automatically on a schedule, not on request only: the IP address and user agent are cleared after 12 months, and the whole record is deleted after 24 months.

You can ask us to delete your data at any time by emailing support@utilityseo.com. We will confirm once it is done.

We do not sell your personal data. We share it with the following processors, who act on our instructions under Data Processing Agreements. This list is accurate as at October 2026.

Processor	What they receive	Purpose
Google LLC (Search Console, Analytics, Ads APIs)	OAuth tokens; reads data from your connected properties	Retrieving your search performance data
Anthropic PBC (Claude)	Page content, keywords, brand and competitor names	AI analysis and brand tracking
OpenAI, L.L.C.	Page content, keywords, brand and competitor names	AI analysis and brand tracking
Google LLC (Gemini)	Page content, keywords, brand and competitor names	AI analysis and brand tracking
Perplexity AI, Inc.	Brand and competitor names, keywords	AI brand tracking
xAI Corp. (Grok)	Industry questions, brand and competitor names	AI visibility tracking
Stripe, Inc.	Name, email, billing details	Payment processing. Card details never reach us
Resend, Inc.	Name, email	Sending transactional email
Railway Corporation	All application data	Hosting and database
Vercel, Inc.	Interface hosting and delivery	Hosting the website and app interface
LinkedIn Ireland / Microsoft	Pseudonymous browsing identifiers, only where you accepted cookies	Measuring LinkedIn ad performance and building retargeting audiences
Resend (Ireland, EU region)	Your email address and the scan report you requested	Sending the scan report and, only where you opted in, follow-up emails
Amazon Web Services (S3)	Encrypted database backups	Backup storage

9. International transfers

Several of the processors above are established outside the UK and the EEA, principally in the United States. Where personal data is transferred outside the UK, we rely on one or more of the following safeguards:

The UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it
The International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the ICO, where the recipient is not certified
An adequacy decision, where the destination country is covered by one

You can ask us which safeguard applies to a particular processor by emailing support@utilityseo.com.

Access: request a copy of the personal data we hold about you
Rectification: ask us to correct inaccurate or incomplete data
Erasure: ask us to delete your personal data in certain circumstances
Restriction: ask us to restrict processing while a complaint is resolved
Portability: request your data in a structured, machine-readable format
Object: object to processing based on legitimate interests, including direct marketing and the aggregation described in section 4
Automated decision-making: we do not make solely automated decisions producing legal or similarly significant effects

Email support@utilityseo.com to exercise any of these. We respond within one calendar month. You may also complain to the ICO at ico.org.uk or on 0303 123 1113.

11. Data security

HTTPS encryption for all data in transit
Passwords stored using bcrypt hashing
Database encryption at rest, and encrypted backups
Token-based authentication
Access controls limiting staff access to personal data
Regular security reviews

If a personal data breach poses a risk to individuals, we will notify the ICO within 72 hours of becoming aware, and affected individuals without undue delay where required.