Privacy Policy

Last updated: September 6, 2026

CommitSEO ("we", "us") provides an automated search-engine-optimization service that reads data about your website from Google and other providers, proposes changes, and - with your permission - applies and can reverse those changes. This policy explains what we collect, why, and how you can control it.

1. What we collect

• Account data: your email address and the domains you connect.
• Google Search Console data: search queries, clicks, impressions, and page performance for domains you explicitly connect via Google's consent screen.
• Google Analytics data: sessions, conversions, and revenue attribution, only for properties you connect.
• Website content: pages we crawl on domains you connect (titles, meta tags, headings, links, page speed data), and copies of pages taken before and after any change we make, so changes can be reverted.
• Change history: a record of every modification our system proposes or applies to your site, including who or what approved it and when.

2. Google user data - Limited Use disclosure

CommitSEO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request the minimum scopes needed for each feature:

• webmasters.readonly - to read Search Console performance data for your audit.
• analytics.readonly - to read conversion and revenue data, only if you connect Google Analytics.

We do not use Google user data to serve ads, and we do not sell it. We do not allow humans to read this data except when needed to debug an issue at your request, and never for any other purpose.

3. Why we collect it

To run a technical and content audit of your site, to identify issues that are measurably costing you search traffic, to propose and - where you've authorized it - apply fixes, and to verify whether a fix helped or should be reverted.

4. What we don't do

We don't sell your data. We don't share Search Console or Analytics data with third parties for their own purposes. We don't apply changes to your site without the level of authorization you've configured (see your dashboard's autonomy setting).

5. Sub-processors

We use a small number of infrastructure providers to run the service:

• Hetzner Online GmbH - hosts our servers and database (EU).
• Cloudflare, Inc. - DNS, our landing page, and (only if you opt into the Edge module) content delivery for your site.
• Anthropic, PBC - processes page content to draft suggested titles, descriptions, and structured data. Content is sent for this specific purpose only.

6. Data retention

We keep change history and crawl data for as long as your account is active, so you can inspect and revert past changes. If you close your account, we delete your site data within 30 days, except records we're required to keep for legal or accounting reasons.

7. Security

Access tokens for your connected Google accounts are encrypted at rest using envelope encryption and are never exposed to the parts of our system that draft content suggestions. All traffic to and from our servers is encrypted in transit (TLS).

8. Your rights

If you're in the EU/EEA, you have the right to access, correct, export, or delete your personal data under the GDPR. You can revoke our access to your Google account at any time from your Google account permissions, which immediately stops any further data access.

9. Contact

Questions about this policy or your data: hello@commitseo.com.

---

This document is a working draft prepared for the product's initial launch. Have it reviewed by a lawyer before onboarding paying customers or clients outside Poland.