Privacy Policy
KeptSEO (keptseo.com and app.keptseo.com) is operated by Clearpath Digital LLC ("KeptSEO", "we", "us"). This policy explains what data we collect, how we use it, and your choices. Contact: chris@clearpathdigital.io.
Google user data we access
- Sign in with Google (scopes
openid,email,profile): your Google account ID, email address, name and profile picture, used to create and identify your KeptSEO account. - Google Search Console, read-only (
https://www.googleapis.com/auth/webmasters.readonly): the list of Search Console properties you can access and your permission level, and search performance data for those properties (queries, pages, countries, devices, search appearance, dates, clicks, impressions, CTR and position). We never modify your Search Console properties. - Planned sources, requested only if and when you choose to connect them: Google Analytics, read-only (
https://www.googleapis.com/auth/analytics.readonly), to show traffic reports for your properties; and Google Business Profile (https://www.googleapis.com/auth/business.manage), used only to read your locations and their performance insights and reviews. We do not create, edit or delete Business Profile content.
How we use Google user data
We use Google user data only to provide and improve the user-facing features of KeptSEO that you ask for: signing you in, listing the properties you can access, importing and storing your data, and showing it to you (and to teammates you authorize) in dashboards, comparisons and exports. We do not use it for any other purpose.
- We do not sell Google user data or any other personal data.
- We do not use Google user data for advertising, including serving, targeting or retargeting ads, and we do not transfer it to ad platforms or data brokers.
- We do not use Google user data to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.
- Humans do not read your Google user data unless you give us explicit permission for a specific case (for example, a support request), it is necessary for security purposes such as investigating abuse, it is required by law, or the data is aggregated and anonymized for internal operations.
KeptSEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other data we collect
- Account and workspace data: organization name, members and roles, saved views and filters, settings.
- Billing data (paid plans): handled by our payment processor; we store the customer and subscription identifiers, not your card number.
- Technical data: session cookies needed to keep you signed in, and basic request logs (IP address, user agent, timestamps) used for security and debugging. We do not use advertising or cross-site tracking cookies.
Storage and security
Data is stored and processed on Cloudflare's platform: account data in Cloudflare D1, per-property performance data in Cloudflare Durable Objects, and archived performance data in Cloudflare R2. OAuth refresh tokens are encrypted with AES-256-GCM before they are stored, are never sent to your browser, and are never written to logs. Data is encrypted in transit (TLS) and at rest. Access to a property's data is re-checked against the permissions Google reports for your connected account, and access is revoked when Google no longer grants it.
Sharing
We share data only with service providers that help us run KeptSEO (Cloudflare for hosting and storage, our payment processor for billing, our email provider for account email), under contracts that limit their use to providing services to us; when required by law; or as part of a merger or acquisition, in which case this policy continues to apply. Data from a property is visible to members of your KeptSEO organization who you give access to.
Retention and deletion
- Revoking access. You can revoke KeptSEO's access at any time at myaccount.google.com/permissions; imports stop as soon as Google rejects the token. You can also disconnect Google in the app at Settings, Connections: this revokes the token at Google and deletes our stored (encrypted) copy immediately. If you prefer, email us and we will delete the stored token within 7 days.
- Removing a property from your organization removes your access to it; when no organization references a property for 30 days, its stored performance data is permanently purged.
- Account deletion: email chris@clearpathdigital.io from your account email (or use Settings, Account, Delete account in the app, which disconnects Google and deletes your account straight away) and we will delete your account, tokens and associated data within 30 days, except where we must keep limited records (such as invoices) by law. Backups expire on their normal schedule.
- Otherwise we keep imported data for as long as your account is active, since long-term history is the purpose of the service.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to or restrict its processing. Email us to exercise these rights; we respond within 30 days. You may also complain to your local data protection authority.
Children
KeptSEO is a business tool and is not directed to children under 16. We do not knowingly collect their data.
Changes
We will post changes to this policy here with a new effective date and, for material changes, notify account holders by email before they take effect.
Contact
KeptSEO (operated by Clearpath Digital LLC), chris@clearpathdigital.io.