1 — Who we are
loopSEO (loopseo.org) is the data controller for the personal data in our platform, and you can reach us at [email protected]. For the data we process on your behalf — your sites' articles and their Search Console metrics — you are the controller and we are the processor (see the GDPR page for what that means in practice).
2 — What we collect
Account data
Name, email address and company (if you give one) when you register — so we can run your subscription, authenticate you and send service communications.
Site configuration and credentials
The WordPress sites you connect (URL, admin username, application password) and the keys for the services you attach (OpenRouter, Searlo, Spider.cloud, Kie.ai, Google Search Console, Cloudflare R2). Application passwords and API keys are encrypted at rest and used only to execute the loop you configure.
Service data
The clusters you approve, the articles the tool generates, the page metrics pulled from your Search Console property, and the rewrite log with its verdicts. This is what makes scoring, monitoring and the Win Rates report possible.
Technical data
Sign-in sessions, error and audit logs (what ran, when, with what outcome). We keep them for security and troubleshooting, not to profile you.
Billing data
Payments are processed by Lemon Squeezy as Merchant of Record. We receive your subscription status and invoices — never your full card details.
3 — What we don't collect, and never do
- No advertising: no ad networks, no cross-site trackers, no profiling for marketing.
- No sale or rental of personal data, to anyone, ever.
- We don't read the parts of your WordPress that loopSEO doesn't manage; the tool only touches the pages it creates or rewrites and the metrics of the property you connect.
4 — Why we use data, and on what basis
- To provide the service you subscribed to (contract) — run the loop, publish, score, rewrite, show dashboards.
- To keep it safe and working (legitimate interests) — authentication, fraud and abuse prevention, bug fixes, support.
- To meet legal obligations — invoices and tax records, lawful requests.
5 — Your published content
Generated articles and images are written to your own WordPress and your own Cloudflare bucket. Copies retained in loopSEO are the working data the loop needs (history, versions for auto-revert, experiment logs). If you delete a page in WordPress, Sync Deleted removes it from our list too.
6 — Cookies
We use the minimum: a session cookie to keep you signed in, plus the customer-portal cookies set by our payment provider during checkout. No analytics cookies, no advertising cookies, no consent-banner theatre because there's nothing to consent to.
7 — Who processes data with us
Only what the service needs, each under its own terms and privacy policy:
- Our hosting provider — runs the loopSEO application.
- Lemon Squeezy — payments and invoicing, as Merchant of Record.
- OpenRouter — routes text generation to AI models, using your key.
- Searlo — live Google results data, using your key.
- Spider.cloud — reads competitor pages for analysis, using your key.
- Kie.ai — generates article images, using your key.
- Google — Search Console API, reading metrics of the property you connected, on your instruction.
- Cloudflare — stores and serves article images on your bucket and domain, on your instruction.
That last pair matters: the most personal-adjacent data of all — your articles and their metrics — lives in accounts you own. We may update this list as providers change; this page is the current, dated record.
8 — Transfers outside the EEA
Some providers above process data outside the European Economic Area (several are US-based). Where that happens we rely on the EU Standard Contractual Clauses or an adequacy decision, and the data is encrypted in transit. Details per provider are available on request.
9 — How long we keep data
- Service data: while your account is active. Delete the account and we erase it within 30 days (backup copies die with the next backup cycle).
- Invoices and billing records: as long as tax law requires (typically 10 years).
- Security logs: short retention, only what security genuinely needs.
10 — Security
TLS everywhere in transit; credentials and API keys encrypted at rest; access limited to what operations actually require; logged, audited actions. No system is perfectly secure — if you find a weakness, tell us at [email protected] and we'll take it from there, in good faith.
11 — Your rights
You can ask for a copy of your data, have it corrected, deleted, restricted or ported, and object to certain uses. Write to [email protected] from your account email: we answer within 30 days, and it costs nothing. If you're unhappy with the outcome, you can complain to your data protection authority.
12 — Children
loopSEO is a business tool and is not directed to anyone under 16. We don't knowingly collect their data; if one slips through, we delete it on notice.
13 — Changes
Material changes to this policy get a notice in-app or by email; the date at the top always reflects the current version.
14 — Contact
[email protected] — the fastest way to reach us on anything privacy-related.