1 — Who we are, and the two roles
loopSEO (loopseo.org) is operated by loopSEO. The controller and contact for account and billing data is loopSEO, reachable at [email protected].
- We are the controller for: your account data, sign-in sessions, security logs, and billing records.
- You are the controller, we are the processor for: the articles the tool writes, the clusters, the metrics read from the Search Console property you connected, and the rewrite history — data that belongs to your business and is processed strictly on your instructions.
2 — The processing, at a glance
- Account data (name, email, company) — to run your subscription and authenticate you.
- Site configuration (WordPress URL, username, application password; the API keys you attach) — to execute the loop. Encrypted at rest.
- Service data (clusters, generated articles, GSC metrics, rewrite log) — to score, monitor and improve your pages, and to let auto-revert undo harmful changes.
- Technical logs — security and troubleshooting.
- Billing data — handled by Lemon Squeezy as Merchant of Record; we retain subscription status and invoices, never full payment instruments.
3 — Legal bases
- Art. 6(1)(b) — performance of the contract: everything the loop does, because you subscribed to it.
- Art. 6(1)(f) — legitimate interests: keeping accounts and the platform secure, preventing abuse, product diagnostics. We keep the balancing honest: narrow logs, short retention.
- Art. 6(1)(c) — legal obligations: invoices and tax retention.
4 — Subprocessors
These are the providers that touch personal data in the course of the service, each engaged under Article 28 terms and listed with its job. This list is the current, dated record; additions are notified before they take effect.
- Our hosting provider — application hosting.
- Lemon Squeezy — payments, invoicing, Merchant of Record.
- OpenRouter — AI model routing for text generation (your key).
- Searlo — live SERP data (your key).
- Spider.cloud — competitor page reading (your key).
- Kie.ai — image generation (your key).
- Google — Search Console API, on your instruction, for the property you connected.
- Cloudflare — image storage and CDN on your own bucket and domain, on your instruction.
Two of these — Google and Cloudflare — act on your accounts: you accepted their terms directly, and the data in them is yours to move or delete at any time.
5 — Transfers outside the EEA
Some processors above are established outside the EEA (several in the United States). Transfers rely on the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) or an adequacy decision, with data encrypted in transit. Per-provider transfer documentation is available on request.
6 — Security measures
TLS in transit; credentials and API keys encrypted at rest; least-privilege access for operations; audit logging of privileged actions; regular backups. We review these measures as the service grows — appropriate to the risk, as Article 32 expects.
7 — Your rights (Articles 15–22)
Access, rectification, erasure, restriction, portability and objection — write to [email protected] from your account email. We answer within one month (extendable for complex requests, with notice). Where our answer isn't enough, you can lodge a complaint with the supervisory authority of your country of residence.
8 — Data Processing Agreement
Because you are the controller of your site data, we offer a standard DPA covering processor obligations, subprocessors, assistance with data-subject requests, and audit cooperation. Ask for it at [email protected] — it's annexed to these pages, not hidden behind an upsell.
9 — Personal data breaches
If a breach affects your data we notify you without undue delay — within 72 hours where the authority must be informed — with what happened, what data, and what we're doing about it. No burying, no fine print.
10 — Retention
Service data: for the life of the account, erased within 30 days of deletion (backups age out on their next cycle). Invoices: as long as tax law requires. Security logs: short-lived, only what security genuinely needs. Full details in the Privacy Policy, §9.