Your Privacy, Our Priority

Account Information: When you create an account, we collect your name, email address, and a hashed password. We never store plaintext passwords.

Usage Data: We log which tools you use (URL Analyzer, Site Audit, Meta Inspector, Keyword Research, Backlink Checker, SERP Visualizer), the URLs you submit for analysis, timestamps, and your IP address for rate limiting and abuse prevention.

Payment Information: If you subscribe to a paid plan, payment is processed entirely by Stripe. We never see or store your credit card number, CVV, or full card details. We only receive a subscription ID and plan status from Stripe.

Cookies: We use essential session cookies to keep you logged in and analytics cookies to understand feature usage. No third-party advertising cookies are used.

We use your data to: (a) provide and improve our SEO analysis services, (b) enforce usage limits and prevent abuse, (c) send transactional emails (account verification, password resets, billing receipts), and (d) understand how our tools are used so we can make them better.

We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising. We do not share URLs you analyze with anyone.

Your data is stored in a PostgreSQL database hosted on secure, encrypted infrastructure. All connections use TLS/SSL encryption. Passwords are hashed using industry-standard bcrypt with salt.

We implement security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security) across our application. Access to production databases is restricted to authorized personnel only.

Analysis results are cached for 30 minutes to improve performance and are not stored permanently. Tool usage logs are retained for 90 days for rate limiting purposes, then automatically purged.

Account data is retained as long as your account is active. If you delete your account, all associated data is permanently removed within 30 days.

We use the following third-party services: Stripe for payment processing, Mailgun for transactional emails, and IPinfo for IP-based geolocation (used for anonymous rate limiting only). Each of these services has their own privacy policy governing how they handle your data.

You have the right to: (a) access the personal data we hold about you, (b) request correction of inaccurate data, (c) request deletion of your account and associated data, (d) export your data in a machine-readable format, and (e) withdraw consent for non-essential data processing at any time.

To exercise any of these rights, contact us at contact@flatseo.com or use our contact form.

FlatSEO is not directed to children under 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete that information.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the bottom. We encourage you to review this page periodically. Continued use of FlatSEO after changes constitutes acceptance of the updated policy.