Privacy Policy

1. Who we are

StraticSEO (straticseo.com) is operated by Paweł Więcko, a sole proprietor based in Warsaw, Poland ("we"), who is the controller of your personal data. For any privacy matter write to seo@pawelwiecko.pl. Our registration details (tax ID, registered address) are available on request and are stated in the contract with each customer.

2. What data we process

Depending on how you use the service, we process:

• Account data: email address and name; if you sign in with Google, the email and name Google shares for sign-in.
• Project data: your website address, the business description and settings you enter, your site’s pages and public search data about your website and its topics.
• Content we generate for you, and your decisions about it (approvals, edits, rejections).
• Billing data: handled by Stripe — we receive the subscription status and invoice details, never full card numbers.
• Technical data: server logs (IP address, browser, time of request) kept by our hosting provider for security.
• Data from your Google Account, only if you connect it — described in section 3.

3. Data from your Google Account

Connecting a Google Account is optional. You see on Google’s screen exactly which access you grant, and we request only what the features below need:

• Google Search Console (read-only): search performance of the properties you select — queries, clicks, impressions, click-through rate and positions per page. We use it to show your results, find content opportunities and plan articles.
• Google Analytics (read-only): aggregated traffic metrics of the property you select — sessions, engagement and conversions per page. We use it for reports and to decide which pages to work on first.
• Google Business Profile: the business profile you choose to connect — its name, address, phone, website, categories, opening hours and description, its reviews (including the reviewer’s public display name) and replies. We use it to show and audit your profile, keep its reviews in sync and prepare draft replies. We publish a reply to a review only when you, or a member of your team with edit rights, click “Publish” for that specific reply. We never change your profile without such an action.
• Your Google email address, to show which Google Account is connected.

4. How we protect and limit the use of Google data

StraticSEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we use Google user data only to provide the features described in section 3 that you see in StraticSEO. We do not sell it, use it for advertising or pass it to data brokers. We do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models. People at StraticSEO do not read it unless you ask us to for support, it is needed to investigate security or abuse, or the law requires it.

To draft a reply to a review or to write content, we send the text needed for that task (for example the review and your brand’s tone of voice) to our AI provider, Anthropic. It processes that text only to return the draft and, under its commercial terms, does not use it to train its models.

Google access tokens are stored encrypted. Content retrieved from the Google Business Profile API, such as reviews, is kept for no longer than 30 days: it is refreshed while your profile stays connected and deleted when you disconnect the profile or your Google Account. Search Console and Analytics metrics are kept as part of your project’s reports and deleted when you delete the project or your account.

You can disconnect Google at any time in StraticSEO (Integrations) or in your Google Account at https://myaccount.google.com/permissions. Disconnecting stops all access immediately. Google’s policy: https://developers.google.com/terms/api-services-user-data-policy.

5. Why we process data and on what legal basis

Under the GDPR we rely on:

• performance of our contract with you (Art. 6(1)(b)) — providing the service you signed up for;
• our legitimate interests (Art. 6(1)(f)) — keeping the service secure, understanding how the panel is used so we can improve it, and establishing or defending claims;
• legal obligations (Art. 6(1)(c)) — accounting and tax records;
• your consent (Art. 6(1)(a)) — where we ask for it, for example when you connect a Google Account. You can withdraw it at any time; this does not affect processing carried out before.

6. Who processes data on our behalf

We use these service providers, each bound by a data-processing agreement:

• Supabase — database, sign-in and file storage;
• Netlify — hosting of the application;
• Anthropic — AI text generation;
• Google (Gemini) — generating article images from text descriptions; no Google Account data is sent;
• DataForSEO — public search-engine data; we send keywords and domain names;
• Jina AI — fetching public web pages;
• Resend — sending emails;
• Stripe — payments and invoices.

7. Transfers outside the EEA

Some of these providers process data outside the European Economic Area. Such transfers rely on an adequacy decision of the European Commission or on the EU Standard Contractual Clauses.

8. How long we keep data

Account and project data are kept while your account is active and deleted within 30 days after you delete the account, except records we must keep by law (for example invoices, for 5 years). Server logs are kept for a short time for security. Google data is kept as described in section 4.

9. Your rights

You have the right to access your data, correct it, have it erased, restrict its processing, receive it in a portable format and object to processing based on legitimate interests. Write to seo@pawelwiecko.pl. You may also lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

10. Cookies

We use only cookies necessary for the service to work: your sign-in session, your language choice, a short-lived security token used while connecting Google, and cookies that carry an invitation or a pre-signup analysis to your account. We do not use advertising cookies or third-party analytics cookies.

11. Changes to this policy

When this policy changes we update this page and the date at the top. We tell account holders about material changes by email before they take effect.