Privacy Policy

1. What this covers

This policy explains what data DataFlowSEO collects when you create an account, use the research workspace, connect an AI client through the MCP server, or connect a Google account (Google Search Console and/or Google Analytics) to a project, and how that data is used, stored, shared, and retained. It applies to app.dataflowseo.com (the dashboard) and dataflowseo.com (the marketing site).

DataFlowSEO currently serves customers in India, and we are working to make it available worldwide. We operate the service from India, so your information is handled by us in line with the laws that apply to us there. If you use DataFlowSEO from another country, the providers listed in Section 3 may process your information in other countries, and we will update this policy, and tell active accounts, as we open to customers worldwide and as local requirements for those customers become clear.

2. Information we collect

2.1 Personal information you give us

When you create an account, you give us your name, email address, and mobile number. Email is used to sign you in, we send a one-time code, there are no passwords, and to contact you about your account; your name personalizes the workspace; your mobile number is used for account-related contact and recovery. If you sign in with Google, Google gives us the same details from your Google account (your name and verified email address) together with your profile picture. We keep the profile picture as a link to the image Google hosts, show it next to your name in the dashboard, and refresh it each time you sign in with Google. DataFlowSEO administrators can see it, with your name and email, when they support your account. If you never sign in with Google, we hold no picture and the dashboard shows your initials. If you connect a Google account to a project (Section 2.4), we also receive your Google email address through Google's own sign-in.

2.2 Non-personal / derivative information

Like most web services, our servers and our hosting/CDN provider automatically log technical information with each request , IP address, browser and device type, referring/exit pages, and access times, for security, abuse prevention, and diagnosing issues. On our marketing site (dataflowseo.com) we also use Google Analytics, which sets cookies and collects similar technical and usage data (pages viewed, approximate location derived from IP, device/browser type) to understand traffic. This is separate from the dashboard at app.dataflowseo.com. We may use aggregated, de-identified versions of this data (which doesn't identify you individually) for product improvement and trend analysis, without further restriction.

2.3 Financial information

DataFlowSEO doesn't collect or store payment card, UPI or bank details on our servers. Optional credit top-ups are paid through our payment processor, Razorpay, which collects and processes your payment details directly under its own privacy policy. We receive only the result of the payment (status, amount, a payment reference and the time), which we keep with your credit balance and top-up history. Credit and prices are always in US dollars; if your payment is processed in your local currency, Razorpay shows the converted amount at checkout, as described in our Terms of Service.

2.4 Google account data (Search Console & Analytics)

If you choose to connect a Google account to a project, we request access, via Google's own OAuth consent screen, to your Google email address and read-only access to Google Search Console (webmasters.readonly) and/or Google Analytics (analytics.readonly), only for the specific property you select.

• Data accessed. From Search Console: search queries, pages, clicks, impressions, and average position. From Analytics: traffic, acquisition, and engagement metrics for the property you link (e.g. users, sessions, events).
• How it's used. Solely to retrieve and display this data inside your own DataFlowSEO project, and, if you explicitly authorize an MCP client, to make that same read-only data available to that client through your project. Every request we make to these APIs is read-only; we never modify, delete, or write to your Search Console or Analytics properties.
• Usage restrictions. This data is never used for advertising, and never used to develop, improve, or train generalized (non-personalized) AI or machine learning models.
• Sharing. Limited to what you explicitly authorize, an MCP client (such as Claude or ChatGPT) you've granted access to that project. We don't share it with other customers or any other third party.
• Protection. Your Google access and refresh tokens are encrypted at rest and transmitted only over encrypted (TLS) connections.
• Retention. We don't store copies of report data returned from Google in our database, it's fetched live on each request. Tokens are retained only while the connection is active; disconnecting removes them immediately (Section 6).
• Compliance. DataFlowSEO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.5 Project, research, and usage data

The domains, keywords, and projects you create, and the research results (keyword, domain, competitor, backlink, ranking, site-audit, content brief, local business and review, brand mention, and AI visibility data) returned for them, plus your credit balance, top-up history, and a record of what research operations were run and when. This includes the sites and keywords you track for rank tracking, the competitor domains you follow, each position check we save, the schedules and alert settings you choose, the businesses you follow in Local SEO (their public Google listing details and review analysis), the brands you follow in Brand monitoring (names and the reports built from public web pages that mention them), the competitor analyses you save, and the content briefs and the drafts you write and score inside them. If you use the Prompt test in AI Visibility, the prompt you type is sent through our data provider to the AI services you choose (ChatGPT, Claude, Gemini or Perplexity) so they can answer it, and the answers are saved to your project. This data is scoped to your account and project, it isn't shared across other customers' projects.

2.6 MCP connection data

When you connect an AI client (such as Claude or ChatGPT) through our MCP server, we store the connection's access token, which project(s) it's scoped to, and a log of the requests it makes, so you can review and revoke access. Resetting or closing your account revokes every connection.

2.7 Session data and cookies

A session cookie on the dashboard (app.dataflowseo.com) keeps you signed in; it's necessary for the product to function and isn't used for advertising or cross-site tracking. On the marketing site (dataflowseo.com) only, Google Analytics sets its own cookies (Section 4). We don't use cookies for cross-site ad tracking or sell any data collected through them. You can control or delete cookies through your browser settings; doing so may sign you out of the dashboard or reduce analytics accuracy on the marketing site, but won't affect your account or project data.

2.8 Children's privacy

DataFlowSEO is intended for business and professional use and is not directed at children. We do not knowingly collect personal information from anyone under the age of 13, and our service is not intended for use by anyone under 18 without the involvement of a parent or guardian.

3. How we use and share information

We use personal information to create and secure your account, authenticate sign-ins, provide technical support, account for credit and billing (including top-up receipts and refund reviews), send administrative notifications (such as sign-in codes or policy updates), send the alerts you ask for (for example an email when a tracked keyword moves), and, if you engage with us for it, respond to feedback or support requests. We may disclose information where we have a good-faith belief that doing so is reasonably necessary to comply with legal process, enforce these terms, or protect the rights, property, or safety of DataFlowSEO, our users, or others.

Named third-party recipients. We share the minimum data needed to fulfill a specific function with:

• Data provider: the third-party provider that sources our raw keyword, domain, competitor, backlink, ranking, local business and review, brand mention, and AI visibility data, and relays Prompt test questions to the AI services you choose. It receives what you ask us to look up, such as a keyword, a domain, a business name and city, or a brand name. DataFlowSEO doesn't generate this data itself.
• Razorpay: our payment processor for optional credit top-ups. It receives the details you enter at checkout and the amount being charged, and tells us whether the payment succeeded.
• Hostinger: our email service provider, used to send sign-in codes, account notifications and the rank alerts you ask for. It only sees the email address and message needed to deliver that email.
• Google APIs: Search Console and Analytics, only for accounts you explicitly connect (Section 2.4).
• Google Analytics: traffic analytics on the marketing site only (Section 4).
• Cloudflare: our hosting/CDN and tunnel provider, which sits in front of our infrastructure for performance and security.
• AI clients you authorize: such as Claude or ChatGPT, connected through our MCP server, and scoped only to the project(s) and data you explicitly grant.

None of these providers receive more than what's needed to fulfill the specific request, and none are permitted to use your data for their own advertising purposes.

Business transitions. If DataFlowSEO is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we'll make reasonable efforts to notify you before your data becomes subject to a different privacy policy.

4. Third-party services we rely on

Google Analytics (marketing site only). dataflowseo.com uses Google Analytics to understand traffic to our marketing pages. Google Analytics sets cookies in your browser and sends usage data (pages viewed, approximate location, device/browser type) to Google. This is separate from, and unrelated to, the Google Search Console/Analytics connection described in Section 2.4, it doesn't touch your account or project data. You can opt out using the Google Analytics Opt-out Browser Add-on, or by blocking cookies in your browser.

5. What we don't do

• We don't sell your data, your project's research data, or your connected Google account's data to third parties.
• We don't use your account, project, or Google account data for advertising, and we don't run third-party ad-tracking scripts on the workspace.
• We don't use Google user data to train or improve generalized (non-personalized) AI or machine learning models.
• We don't share your project data, or data read from your connected Google account, with other customers' accounts or with connected AI clients you haven't explicitly authorized.

6. How long we keep data

Account and project data is kept for as long as your account is active. If you reset your account, we permanently delete all of your projects and everything in them (including tracked sites and their position history, followed businesses and brands, saved reports, content briefs and drafts, and schedules) and revoke every connected AI client, and we keep your sign-in, credit balance and billing history. If you close your account, we delete or anonymize your account and project data within a reasonable period, except where we're required to retain records (for example, billing records) for legal or accounting purposes. If you disconnect a Google account, we delete the stored access and refresh tokens for that connection immediately and stop making any further calls to Google on your behalf.

7. Your rights and controls

Regardless of where you're located, you have the following rights over your personal data, consistent with regulations such as the GDPR and CCPA/CPRA:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate account information (e.g. your name or mobile number).
• Deletion. Request deletion of your account and associated personal data, subject to the retention exceptions in Section 6.
• Objection / restriction. Object to or ask us to limit certain processing, such as disconnecting a Google integration or opting out of marketing-site analytics.
• Portability. Request your project and research data in a portable format.

To exercise any of these rights, contact us using the details in Section 11. Administrative or transactional emails (such as sign-in codes, security notices, or material policy updates) are necessary to operate your account and aren't part of any opt-out. In addition:

• You can review and revoke any connected MCP client's access from your project settings at any time, and you can reset your account (Settings → Account → Danger zone) to permanently delete all your projects and data while keeping your account.
• You can disconnect Google Search Console or Google Analytics at any time from Settings → Integrations in the dashboard, which deletes the stored tokens for that connection.
• You can also revoke DataFlowSEO's access directly from your Google account at Google Account → Security → Third-party apps with account access.

How to delete your account and data

You can delete your account yourself from Settings → Account → Danger zone in the dashboard, which signs you out everywhere and makes your projects and history inaccessible. To have your personal data and stored Google tokens permanently erased, also email us at [email protected] from the account's email address. Billing records may be retained as described in Section 6.

8. Security

We use industry-standard administrative and technical measures to protect your data, including encryption of stored Google access/refresh tokens, encrypted (TLS) connections, scoped access tokens for connected clients, and a credit check before any external request that would fetch new data. No method of storage or transmission is completely secure, and we can't guarantee absolute security.

9. Third-party links

This policy applies solely to information collected by DataFlowSEO. Our site and dashboard may link to third-party sites or services (including Google's own products) whose privacy practices we don't control; we encourage you to review their policies separately.

10. Changes to this policy

We may update this policy as the product changes. If we make a material change, we'll make a reasonable effort to notify active accounts, for example, by email or a prominent notice in the dashboard, before it takes effect. Non-material changes (such as clarifying existing language) may take effect immediately.

11. Contact

Questions about this policy, or requests to access, correct, or delete your data, can be sent to [email protected]. Billing questions can go to [email protected]. You can also use our contact form. DataFlowSEO is the operator of the service. This email address also serves as our grievance contact: we aim to acknowledge privacy complaints within 3 business days and resolve them within 30 days.