Privacy Policy

This Privacy Policy explains what information SEO Macho collects when you use our AI-powered SEO content platform (the “Service”), how we use it, who we share it with, how long we keep it, and the rights and choices you have.

The Service is operated by DevVerx(“we”, “us”, “our”), a company registered in the Islamic Republic of Pakistan, with its registered office at Plaza #19, Main Boulevard, Military Account Society, Lahore, Pakistan. For the purposes of the EU and UK General Data Protection Regulation (GDPR) and similar laws, DevVerx is the data controller of the personal data described in this policy. You can reach us about privacy matters at support@seomacho.com.

Account information. Your name, email address, and a password (stored in hashed form by our authentication provider, Supabase). We never see or store your plain-text password.

Audit and project data. The website URLs you audit or add as projects, crawl results for those pages (titles, headings, meta tags, content statistics, scores), and the reports we generate from them.

Content you create. Keyword plans, research briefs, article drafts, context files (such as brand voice and style guides), and publishing history.

Integration credentials. If you connect third-party services, we store what is needed to use them on your behalf: AI provider API keys, DataForSEO credentials, WordPress connection details, and Google OAuth tokens for Search Console and Analytics. These are used only to provide the features you enable and can be disconnected at any time.

Report delivery email. If you request a PDF report on the audit page, we use the email address you enter solely to deliver that report and to keep a record of the request.

Payment information. Paid plans are sold and processed by Paddle, our authorized reseller and Merchant of Record. Card details go directly to Paddle and never touch our servers; we receive only subscription status and billing metadata.

Usage and technical data. Basic activity records such as when research, writing, or publishing runs happen, together with standard technical information (such as IP address, device and browser type, and log data) used to operate the pipeline, show your history, secure the Service, and enforce plan limits.

We use your information for the purposes below. Where the GDPR or a similar law applies, we rely on the legal bases indicated:

• To provide the Service:crawl and audit sites, run research, generate and optimize content, and publish to your connected destinations. Legal basis: performance of our contract with you.
• To send requested reports and service communications:for example the PDF audit report, delivered via Resend, and essential account or security notices. Legal basis: performance of contract and our legitimate interests.
• To operate accounts, billing, and plan limits. Legal basis: performance of contract and compliance with legal obligations (such as tax and accounting).
• To secure the Service, prevent abuse, and support users. Legal basis: our legitimate interests in running a safe, reliable Service.
• To improve the product using aggregate, de-identified usage patterns. Legal basis: our legitimate interests.
• To comply with the law and respond to lawful requests. Legal basis: compliance with a legal obligation.

Where we rely on consent (for example any optional communications you opt into), you can withdraw it at any time. We do not sell your personal information, and we do not use your content or your connected analytics data for advertising.

If you choose to connect Google Search Console and Google Analytics 4, we request read-only access (the webmasters.readonly and analytics.readonly scopes), together with your basic Google profile (the openid and emailscopes) so we can show you which Google account is connected. We use this data only to show you your own site’s rankings, impressions, and traffic inside the Service and to inform the content recommendations we generate for you. Access is read-only, so we never create, modify, or delete anything in your Google account. We do not share Google user data with third parties except as necessary to provide these features, and we do not use it for advertising.

You can disconnect Google at any time from the Connections page. Disconnecting immediately removes the stored access token together with the connected Search Console and Analytics data from your project.

SEO Macho’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access at any time from the Connections page or from your Google account permissions.

We operate globally and our service providers may be located in countries outside your own, including outside the European Economic Area (EEA), the United Kingdom, and Pakistan (for example in the United States). Where we transfer personal data internationally, we take steps to ensure it remains protected in line with this policy and applicable law, for example by relying on providers that offer appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or an adequacy decision. You may contact us for more information about the safeguards in place.

We use essential cookies to keep you signed in (authentication session cookies) and to remember basic preferences such as your active project. These are strictly necessary for the Service to function. We do not use third-party advertising or cross-site tracking cookies.

We keep personal data only for as long as necessary for the purposes described in this policy. Account and project data is retained while your account is active. You can delete individual projects (which removes their crawls, keywords, articles, and connected credentials) from the dashboard at any time. To delete your entire account and its data, contact us at support@seomacho.com and we will action it within 30 days. We may retain limited information where required for legal, accounting, or fraud-prevention purposes; backup copies are purged on a rolling basis thereafter.

Depending on where you live, you may have some or all of the following rights in relation to your personal data:

• Access: Obtain a copy of the personal data we hold about you;
• Rectification: Correct inaccurate or incomplete data;
• Erasure: Ask us to delete your data (“right to be forgotten”);
• Restriction: Ask us to limit how we process your data;
• Portability: Receive your data in a structured, machine-readable format;
• Objection: Object to processing based on our legitimate interests;
• Withdraw Consent: Where we rely on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email support@seomacho.com. We will respond within the time required by applicable law (generally within 30 days) and will not discriminate against you for exercising your rights. If you are in the EEA or UK and believe we have not handled your data properly, you have the right to lodge a complaint with your local data-protection supervisory authority, although we would welcome the chance to address your concerns first.

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request access to and deletion of that information; and to correct inaccurate information. We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA), and we do not use or disclose sensitive personal information for purposes that would require an opt-out. You will not be discriminated against for exercising your rights. To make a request, contact us at support@seomacho.com.

Data is transmitted over HTTPS and stored with access controls; integration credentials are held server-side and never exposed to other users or to the browser of anyone but you. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard practices. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

The Service is not directed at children and may not be used by anyone under 16 (or the age of digital consent in their jurisdiction). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. We will revise the effective date above and, for material changes, take reasonable steps to notify you. Continuing to use the Service after changes take effect constitutes acceptance of the updated policy.

Privacy questions or requests (access, correction, deletion, portability, or objection)? Contact DevVerx at support@seomacho.com or by post at Plaza #19, Main Boulevard, Military Account Society, Lahore, Pakistan.