Privacy Policy

Version 2.0 — last updated 2 August 2026. This version describes the data UtilitySEO began permanently retaining on 2 August 2026. The previous version was dated March 2026.

UtilitySEO Ltd ("we", "us", "our") explains here how we collect, use, store and protect your personal data when you use utilityseo.com and app.utilityseo.com (together, the "Services"). This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Data Controller: UtilitySEO Ltd Company number: 17055142 Registered address: 4 Frances Street, Cheadle, SK8 2AE ICO registration: C1885551 Contact, including data protection requests: support@utilityseo.com

2. What data we collect

2.1 Account and identity data

Full name
Email address
Password, stored as a one-way bcrypt hash. We never store your plain text password
Account creation date and time
Subscription tier

2.2 Payment and billing data

Stripe Customer ID, a reference token
Last four digits of your payment card, provided by Stripe for your reference
Card fingerprint, a non-reversible hash used for fraud prevention
Billing address, if provided at checkout
Transaction history and subscription status

We never receive or store full card numbers, CVV codes or complete payment card details. All payment processing is handled by Stripe, Inc.

2.3 Usage and technical data

IP address, logged at account creation and on each login
Browser type and version, and operating system
URLs you have analysed
Daily scan usage counts
Login timestamps and error logs

2.4 Search performance data from Google Search Console

If you connect a Google Search Console property, we read and store your search performance data: search queries, landing pages, clicks, impressions and average position.

We store this as a weekly series and keep it indefinitely while your account is open, including after Google's own 16-month window has deleted it from Search Console. Section 7 explains why.

We access this through Google's OAuth flow. You choose which properties to connect, and you can disconnect at any time from your account settings or by revoking access in your Google account.

2.5 Website audit and crawl data

When we crawl a website you have added, we store the following for each page, for each crawl, indefinitely while your account is open:

URL, title tag, meta description and first heading
Word count
Canonical URL and robots directives
HTTP status code
Click depth and internal link count

This is content published on a website rather than personal data in most cases. It can contain personal data where a page includes it, for example an author name on an article.

2.6 AI brand tracking data

If you use AI brand tracking, we store the brand names, competitor names and keywords you configure, and the responses we receive from AI assistants. Please read section 5 before entering anything into these fields.

2.7 Free scans, when you do not have an account

You can run a scan on utilityseo.com without signing up. When you do, we store a record containing:

The URL you scanned, and the scan results
Your email address, only if you chose to enter one
Your IP address and browser user agent

The URL and results are stored even when no email is given, so we have a record of what was scanned. We rely on legitimate interests: operating and protecting a free, unauthenticated tool, and following up on business enquiries. If you gave a business email we may contact you about UtilitySEO. You can object at any time by emailing support@utilityseo.com, and we will stop and delete the record.

Retention for these records is set out in section 7.

2.8 Cookies

See our Cookie Policy.

3. How we use your data

3.1 Lawful bases

Contract performance: creating and managing your account, processing your subscription, and delivering the Services, including storing and displaying your search performance and audit data.
Legitimate interests: detecting and preventing fraud, abuse and misuse, including repeat redemption of promotional codes; maintaining the security of our systems; enforcing our Terms; and producing anonymised and aggregated statistics as described in section 4. We have considered the impact on you and consider these interests not to be overridden by your rights.
Legal obligation: complying with applicable law and maintaining financial records.
Consent: sending marketing communications where you have opted in, and placing non-essential cookies.

3.2 Purposes

Providing, operating and improving the Services
Showing you how your search performance and technical health change over time
Processing your subscription and managing billing
Sending transactional email
Detecting fraud and abuse
Responding to support queries
Complying with our legal obligations

4. Anonymised and aggregated data

We may create anonymised and aggregated statistics from the data in the platform, for example typical search volumes for a keyword, or how often a type of technical issue occurs across websites in general, and use them to operate and improve our services.

Where we publish benchmarks or research externally, we derive them only from website crawl data and from our own keyword data. We do not use the search performance data retrieved from your connected Google Search Console account in anything we publish. Aggregates derived from Search Console data are used internally only.

Anonymised and aggregated data never identifies you, your business or your website, and cannot be reversed to do so. We do not sell your identifiable data, your website's search performance, or your rankings to anyone.

5. Where you use AI brand tracking

This feature works by asking public AI assistants, ChatGPT, Claude, Gemini and Perplexity, questions about your industry, and recording whether your business is mentioned in the answers. To do this we send those services the brand names, competitor names and keywords you have configured.

Do not enter confidential information into these fields, as it will be sent to those providers and handled under their terms.

6. Where keyword search volumes come from

Keyword search volume figures shown in the platform come from our own Google Ads account, not from any customer's data. No customer's search performance data is used to produce the volume figures shown to any other customer.

7. How long we keep your data

We keep the search performance data and website audit data associated with your account for as long as your account is open, and we do not delete it on a rolling schedule. This is deliberate: Google Search Console only makes the last 16 months of your search data available, so we keep our own record in order to show you trends over a longer period than Google itself will.

If you close your account, we delete your personal data and the data we collected from your connected accounts within 30 days, except for the following.

What we keep	How long	Why
Invoices and payment records	6 years from the end of the accounting period they relate to	HMRC record-keeping, and the 6-year limitation period for contract claims
Your email address, in deactivated form	Until you ask us to remove it	See below
Card fingerprint	3 years from cancellation	Fraud prevention
IP address logs	12 months from collection	Security and fraud prevention
Server and error logs	90 days	Operating the Services
Marketing consent records	Until consent is withdrawn, plus 3 years	Evidence of consent
Free-scan records: IP address and user agent	Cleared 12 months after the scan	Abuse prevention on a free, unauthenticated tool
Free-scan records: the rest of the record	Deleted 24 months after the scan	Following up on business enquiries

About your email address. When you close your account we deactivate it rather than erasing the record, and we retain your email address so that the same address cannot be used to claim introductory offers and promotional codes repeatedly. We rely on legitimate interests for this. It means that if you close your account and later sign up again with the same address, we will recognise it. You can ask us to erase the address entirely by emailing support@utilityseo.com, and we will do so unless we are required to keep it for one of the other reasons above.

Free-scan records are pruned automatically on a schedule, not on request only: the IP address and user agent are cleared after 12 months, and the whole record is deleted after 24 months.

You can ask us to delete your data at any time by emailing support@utilityseo.com. We will confirm once it is done.

We do not sell your personal data. We share it with the following processors, who act on our instructions under Data Processing Agreements. This list is accurate as at August 2026.

Processor	What they receive	Purpose
Google LLC (Search Console, Analytics, Ads APIs)	OAuth tokens; reads data from your connected properties	Retrieving your search performance data
Anthropic PBC (Claude)	Page content, keywords, brand and competitor names	AI analysis and brand tracking
OpenAI, L.L.C.	Page content, keywords, brand and competitor names	AI analysis and brand tracking
Google LLC (Gemini)	Page content, keywords, brand and competitor names	AI analysis and brand tracking
Perplexity AI, Inc.	Brand and competitor names, keywords	AI brand tracking
Stripe, Inc.	Name, email, billing details	Payment processing. Card details never reach us
Resend, Inc.	Name, email	Sending transactional email
Railway Corporation	All application data	Hosting and database
Vercel, Inc.	Interface hosting and delivery	Hosting the website and app interface
LinkedIn Ireland / Microsoft	Pseudonymous browsing identifiers, only where you accepted cookies	Measuring LinkedIn ad performance and building retargeting audiences
Resend (Ireland, EU region)	Your email address and the scan report you requested	Sending the scan report and, only where you opted in, follow-up emails
Amazon Web Services (S3)	Encrypted database backups	Backup storage

9. International transfers

Several of the processors above are established outside the UK and the EEA, principally in the United States. Where personal data is transferred outside the UK, we rely on one or more of the following safeguards:

The UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it
The International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the ICO, where the recipient is not certified
An adequacy decision, where the destination country is covered by one

You can ask us which safeguard applies to a particular processor by emailing support@utilityseo.com.

Access: request a copy of the personal data we hold about you
Rectification: ask us to correct inaccurate or incomplete data
Erasure: ask us to delete your personal data in certain circumstances
Restriction: ask us to restrict processing while a complaint is resolved
Portability: request your data in a structured, machine-readable format
Object: object to processing based on legitimate interests, including direct marketing and the aggregation described in section 4
Automated decision-making: we do not make solely automated decisions producing legal or similarly significant effects

Email support@utilityseo.com to exercise any of these. We respond within one calendar month. You may also complain to the ICO at ico.org.uk or on 0303 123 1113.

11. Data security

HTTPS encryption for all data in transit
Passwords stored using bcrypt hashing
Database encryption at rest, and encrypted backups
Token-based authentication
Access controls limiting staff access to personal data
Regular security reviews

If a personal data breach poses a risk to individuals, we will notify the ICO within 72 hours of becoming aware, and affected individuals without undue delay where required.