Privacy policy

XCL SEO ("we", "us") is the data controller for the personal information described in this policy.

Registered office: [address]. Company number: [number]. If you have a question about this policy or how we handle your information, email [privacy@xclseo.co.uk].

We collect only what we need for a stated purpose.

• Enquiry details. Your name, email address, telephone number, company, website and the content of your message, when you contact us.
• Newsletter details. Your email address and, optionally, your name.
• Account details. For platform users: name, email address, organisation, and the websites you add.
• Website analysis data. The public content of pages you ask us to analyse, and — where you connect them — data from Google Search Console and Google Analytics for properties you control.
• Technical data. IP address, browser and device information, and pages visited. Analytics that is not strictly necessary runs only with your consent.

• Enquiries that do not become clients: [24] months.
• Client records: for the duration of the relationship and [6] years afterwards for tax and legal purposes.
• Newsletter subscriptions: until you unsubscribe.
• Analysis and crawl data: [12] months, or until you delete the site from your account.
• Server logs: [90] days.

We do not sell personal information. We share it with service providers who process it on our behalf under a written contract:

• Hosting and infrastructure: [provider].
• Transactional email: [provider].
• Payments: [provider].
• Analytics: Google Analytics, subject to your consent.

Where you connect Google Search Console or Google Analytics, we access only the properties you authorise, and only for the purpose of producing your reports.

Some product features use AI models to draft or analyse content. Where that happens we tell you in the interface, we remove personal data from prompts where it is not necessary, and no output is published without a person approving it.

We do not use client data to train shared models unless a written agreement expressly permits it.

Under UK data protection law you have the right to access your information, correct it, delete it, restrict or object to how we use it, and to data portability. Where we rely on consent, you can withdraw it at any time.

To exercise any of these, email [privacy@xclseo.co.uk]. We will respond within one month.

If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk.

We protect information with encryption in transit, encryption of stored credentials, role-based access controls, audit logging of privileged changes and regular dependency scanning. No system is perfectly secure, and we will notify you and the regulator where required if a breach affects your information.