Privacy Policy

Effective Date: [DATE OF PUBLICATION]

Last Updated: [DATE OF PUBLICATION]

SEO Reports (“we”, “us”, “our”) is a software service operated by Digital Turtle, a sole proprietorship of Tom Altman based in Solon, Iowa, that helps marketing agencies and their clients monitor search engine optimization (SEO) and generative engine optimization (GEO/AEO) performance. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

If you have questions, contact us at reports@seo-reports.net.

1. Who This Policy Applies To

This policy covers individuals and organizations that use our service, including:

• Agency administrators who create a tenant account to manage their clients
• Agency team members invited to a tenant account
• End customers of agencies whose websites we analyze
• Visitors to seo-reports.net

2. Information We Collect

2.1 Information You Provide

When you create an account or use our service, we collect:

• Name and email address
• Tenant (agency) name and optional branding assets (logo, colors)
• Client records you enter (client name, website domain, industry, notes)
• Competitor records you enter or confirm
• Payment information if you subscribe to a paid plan (processed by our payment provider; we do not store full card numbers)

2.2 Information From Google Services (OAuth)

If you connect your Google Search Console or Google Analytics accounts, we request read-only access using these scopes:

• https://www.googleapis.com/auth/webmasters.readonly (Search Console data)
• https://www.googleapis.com/auth/analytics.readonly (Analytics data)

Using these scopes, we access and store:

• The list of properties you have access to
• Aggregated query, page, and performance metrics (impressions, clicks, position, CTR, sessions, users, conversions)
• Property metadata (site URL, view ID)

We do not request or access any other Google data. We do not modify any data in your Google accounts. You can revoke our access at any time from your Google Account security settings.

2.3 Information We Generate About You

As part of delivering the service we create:

• Audit reports derived from crawling the public-facing pages of the websites you add as clients
• Competitor suggestions generated by querying third-party AI services (see Section 4)
• Reports that aggregate data from Google services with our audit data
• Usage logs (login times, feature usage, error events) for operational and security purposes

2.4 Information We Collect Automatically

When you visit seo-reports.net we collect standard server logs: IP address, browser type, referring URL, pages visited. We use this for security, analytics, and service improvement.

3. How We Use Your Information

We use the information we collect to:

• Operate and maintain the service
• Authenticate you and protect your account
• Generate audit reports, competitor suggestions, and monthly summaries
• Send transactional and service emails (account verification, reports, notifications) to the email address you provide
• Respond to support requests
• Detect and prevent fraud or abuse
• Meet legal and regulatory obligations

We do not sell your personal information. We do not use your data to train AI models. We do not share your data with advertisers.

4. Third-Party Subprocessors

We share the minimum data required to operate the service with the following subprocessors:

Subprocessor	Purpose	Data Shared	Location
Nexcess	Web and application hosting	All application data at rest	United States
Anthropic	AI-generated competitor suggestions and AEO citation checks (Claude API)	Company name, domain, industry notes of clients you add	United States
Google	Source of Search Console and Analytics data	OAuth tokens and read-only API requests	Global
Gomailify	Transactional email delivery	Email address, name, message content	United States
Digital Turtle (self-hosted infrastructure)	Audit processing and data storage	All application data	United States

Anthropic does not retain API inputs or use them to train models, per their standard API terms.

If we add a new subprocessor, we will update this page.

5. Data Retention

• Active accounts: we retain your account and the data you enter for as long as your account is active.
• Cancelled accounts: within 30 days of cancellation we purge your tenant data from our primary database. Backup copies are overwritten within 90 days.
• Google Search Console and Analytics pulls: we retain the most recent 12 months of aggregated metric data. Older data is deleted.
• AI-generated competitor suggestions: cached for 30 days per client, then regenerated.
• Server logs: retained for 90 days then deleted.
• Audit reports and monthly reports: retained as long as the associated account is active.

6. Your Rights and Choices

You can:

• Access the data we have about you by logging in to your account dashboard.
• Correct your account information from your account page.
• Delete your account and associated data by emailing reports@seo-reports.net. We will fulfill the request within 30 days.
• Revoke Google OAuth access at any time from your Google Account security settings (this stops us from pulling new data; existing pulled data is removed on account deletion).
• Export your data by emailing reports@seo-reports.net. We will provide a machine-readable export within 30 days.

If you are a resident of the EU, UK, California, or another jurisdiction with additional privacy rights, contact us at reports@seo-reports.net to exercise those rights.

7. Security

We protect your data with industry-standard measures including encryption in transit (TLS), encrypted API tokens at rest, role-based access controls, and activity logging. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and relevant authorities as required by applicable law.

8. Children’s Privacy

SEO Reports is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, contact us at reports@seo-reports.net and we will delete it.

9. International Data Transfers

Our infrastructure is located in the United States. If you access the service from outside the United States, your information will be transferred to and processed in the United States.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you by email to the address associated with your account and update the “Last Updated” date above.

11. Contact

Questions, complaints, or requests regarding this policy should be sent to:

Email: reports@seo-reports.net

Mailing Address: Digital Turtle, 2349 Jordan Creek Road NE, Solon, IA 52333

Implementation Notes (remove before publishing)

Still open:

1. Effective / last-updated date — fill in on publish day.
2. Confirm Nexcess datacenter location is US (they are, but worth one check).
3. Confirm Gomailify data residency (Israeli-owned, US-hosted per their site — verify).
4. Optional legal review before Google OAuth CASA submission. Draft is built from first principles and standard patterns, not a substitute for real legal review.