Privacy Policy

1. Introduction

SEO MASTER ("we", "our", "the application") is a SaaS platform developed by Mogacode SARL-AUthat provides SEO analysis, keyword research, competitor monitoring, and Google data integration for website owners and SEO professionals.

This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data, in compliance with the Google API Services User Data Policy, GDPR, and Moroccan Law 09-08.

2. Data Controller

3. Google API Data — Access, Use, Storage & Sharing

3.1 Google Scopes Requested

SEO MASTER requests the following OAuth scopes to provide its core features:

Search Console Read-only access to Google Search Console data (clicks, impressions, position, CTR per page/query, top queries per URL, indexation status). Used only to display your organic performance in your private dashboard and to ground AI-generated SEO recommendations in real query data. We never modify Search Console settings.

Analytics Read-only access to Google Analytics 4 data (sessions, users, bounce rate, average session duration, top landing pages, traffic source per page). Specifically used to:

• Show real traffic metrics on each audited page in your private dashboard.
• Adjust SEO recommendations based on user behavior (e.g. high bounce rate → suggest content improvements; low time-on-page → restructure intro).
• Correlate Search Console clicks with on-site engagement to prioritize quick-win optimizations.

GA4 metrics are cached for at most 24 hours per page, then re-fetched. We never store full reports, do not modify your GA4 configuration, and do not share GA4 data with any third party. The user can disconnect Google access at any time from the Settings page, which immediately deletes all cached GA4 data.

Business Profile Access to Google Business Profile listings the authenticated user already manages, to power our GMB Manager module:

• Read: list locations, reviews, posts, photos, attributes, hours, services — to surface SEO opportunities (missing photos, unanswered reviews, outdated hours).
• Write — only on explicit user click: publish a GBP post, reply to a review with user-approved text, update business attributes/hours/services. Every write is initiated by the user; no automated changes happen in the background.

We never modify ownership, transfer locations, perform writes the user did not initiate, or operate on listings the user does not already manage. GBP data is cached for at most 24 hours and is deleted on user disconnect.

3.2 Data Usage

Google user data accessed via these APIs is used exclusively to:

• Display your website's SEO performance metrics (clicks, impressions, rankings) inside your private dashboard.
• Enrich AI-generated SEO recommendations with real traffic data.
• Show your Google Business Profile metrics and review statistics in the GMB Manager.
• Generate keyword and content strategy reports based on your Search Console queries.

We do not use Google user data to train AI/ML models, for advertising, or for any purpose beyond the features described above.

3.3 Data Sharing

Google user data accessed by SEO MASTER is never shared, sold, or disclosed to any third party. It is used solely to render your personal dashboard. No Google user data is passed to external analytics services, advertising networks, or AI training pipelines.

3.4 Data Storage & Protection

Your Google OAuth tokens (access tokens and refresh tokens) are stored encrypted at rest in our database using AES-256 encryption. Our infrastructure is hosted by Infomaniak (Geneva, Switzerland), certified ISO 27001 and ISO 14001.

• All data is transmitted over HTTPS/TLS 1.3.
• OAuth tokens are stored per-user and isolated by tenant.
• Access to production data is restricted to authorized personnel only.
• Google API data fetched in real-time is not permanently stored — it is fetched on demand and displayed.

3.5 Data Retention & Deletion

Google OAuth tokens are retained as long as your account is active and you have not revoked access. Cached API responses (Search Console metrics, Analytics data) are not persisted beyond your session or dashboard load.

To revoke access and delete your Google data from SEO MASTER:

• Go to your Dashboard → Settings → Integrations and click "Disconnect Google".
• Or visit Google Account Permissions and revoke SEO MASTER's access.
• To permanently delete your account and all associated data, contact us via WhatsApp.

Upon account deletion, all stored OAuth tokens and associated data are permanently erased within 30 days.

4. Other Data We Collect

• Account data: Email, name, business name collected at registration.
• Site data: URLs and SEO analysis results you submit to the platform.
• Usage data: Feature usage logs for billing (SEO Coins system) and service improvement.
• Payment data: Processed securely by Stripe. We do not store card numbers.

5. Your Rights

Under GDPR and Moroccan Law 09-08, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Delete your data (right to be forgotten).
• Revoke Google API access at any time.
• Export your data in a portable format.

To exercise any of these rights, contact us via WhatsApp.

6. Contact

For any privacy-related questions or data deletion requests: