Privacy Policy

Welcome to SEO Ladders ("we", "our", "us"). SEO Ladders is an AI visibility and SEO platform built for founders who ship their own content. We help you get cited across AI assistants (ChatGPT, Perplexity, Gemini, Claude) and Google's AI surfaces — and rank on Google — through AI Optimization monitoring, Keyword Research, Competitor Gap, Rank Tracker, Article Writer, Article Optimizer, Content Refresh, SEO Agent, and AutoBlog (scheduled publishing). The same capabilities are available through a REST API, an MCP server (Claude Code, Cursor, Windsurf, Codex), and HMAC-signed webhooks. This Privacy Policy explains how we collect, use, and protect your personal information when you use the platform, website, developer interfaces, and related services.

We collect information to operate and improve our service. This includes:

• Account details (name, email)
• Workspace settings you configure (target site URL, domain rating, brand voice profile, target audiences, locale)
• Saved keywords, competitor lists, rank-tracking history
• Articles you generate or edit (drafts, published versions, revisions)
• Site-audit and optimization reports tied to your workspace
• API keys you create (stored hashed — we never retain the plaintext after creation)
• Webhook signing secrets and delivery logs (status, response codes)
• Connected-platform credentials (WordPress site URL, application password)
• Google Search Console data you connect — read-only search-performance data (queries, clicks, impressions) and your verified site list
• Knowledge Base content you add — pasted notes, URLs you submit, uploaded files (PDF, text, Word), and the text we extract from them
• AI Optimization data — the prompts you track, the AI answers we collect, and the brands/competitors mentioned in them
• Usage information (which tools you use, surface-level quota counters)
• Payment information (processed by Polar — we never store card numbers)

We use your data to deliver the toolkit, run the AI pipelines you trigger, and meter your subscription:

• To run keyword research, competitor gap, and rank tracking against live SERP data
• To generate articles, images, schema, FAQs, and citations on your behalf — using your brand voice and domain rating
• To deliver SEO Agent audits, Article Optimizer scores, and Content Refresh detections
• To measure your AI visibility — running the prompts you track across AI engines and summarizing how they mention you and your competitors
• To suggest prompts and keywords from your connected Google Search Console data
• To ground generated content in the facts you add to your Knowledge Base
• To send product and lifecycle emails (welcome, setup tips, re-engagement) — you can opt out at any time
• To publish articles to your connected CMS (WordPress) or webhook destinations
• To deliver signed webhook events when articles, batches, optimizations, or refreshes complete
• To meter usage against your plan quotas and surface usage in your dashboard
• To process payments and manage your subscription via Polar
• To communicate updates, security notices, and support replies

We share data with service providers strictly to deliver the features you use:

• Supabase / cloud hosting — application data and storage
• DataForSEO — keyword volume, KD, SERP results, rank tracking, and AI Optimization queries routed to AI engines (ChatGPT, Perplexity, Gemini, Claude) and Google's AI surfaces
• Anthropic & OpenAI — article generation, optimization analysis, AI editing, and Knowledge Base embeddings
• FireCrawl — scrapes the web pages and Knowledge Base URLs/files you submit, to extract their text
• Google — when you connect Google Search Console, we access your read-only Search Console data via Google's API
• Image generation providers — AI illustrations for your articles
• Polar — subscription billing and payment processing
• Resend — transactional email (magic links, status notifications)
• WordPress sites you connect — to publish drafts and final articles
• Webhook URLs you configure — to deliver event notifications you've subscribed to

We retain your personal data while your account is active. After cancellation:

• Workspace data (articles, keywords, audits) is retained for 90 days, then permanently deleted unless you reactivate
• Webhook delivery logs are retained for 30 days for debugging and audit
• Anonymized usage metrics may be retained longer for service-level analytics
• Billing records are retained as required by financial reporting regulations

You may request immediate deletion of your data at any time by contacting us — see Contact Us below.

We use industry-standard encryption, access controls, and security measures to protect your data:

• Data in transit: TLS 1.2+ on all endpoints
• API keys: stored as one-way hashes — the original is shown once at creation
• Webhook signing secrets: rotatable on demand via API or dashboard
• Webhook payloads: signed with HMAC-SHA256 over the raw body
• Auth: passwordless (magic-link) with short-lived tokens
• Database: managed Postgres with row-level security policies

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but commit to reasonable industry practice.

Depending on your location, you may have the following rights:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Data portability
• Withdraw consent at any time

SEO Ladders integrates with the following third parties to deliver the toolkit. When you use these features, the respective provider's privacy policy applies to data shared with them:

• WordPress sites you connect — you provide the URL and application password; we use them only to publish articles you trigger
• Webhook URLs you configure — we send signed payloads to the destinations you specify
• DataForSEO — keyword/SERP queries and AI Optimization prompts you initiate are sent to their API (which routes them to the AI engines)
• Anthropic & OpenAI — article generation, editing prompts, and Knowledge Base embeddings are sent to their APIs
• FireCrawl — URLs and files you submit (site scans, Knowledge Base) are sent to their API to extract text
• Google — your Search Console data is accessed via Google's API when you connect it
• Polar — payment events and subscription state
• Resend — transactional and product email delivery

We do not authorize any of these providers to use your content for their own product training.

AI Optimization measures whether AI assistants recommend your brand. When you run a monitor, we send the buyer questions you track (your "prompts") to AI engines — ChatGPT, Perplexity, Gemini, and Claude (via DataForSEO's LLM Responses API) and Google's AI Overviews & AI Mode (via DataForSEO's SERP API) — and store the answers.

• The prompts you track and the AI answers we collect are stored in your workspace
• We store the brand and competitor names surfaced in those answers to compute your visibility, share of voice, and sentiment
• These queries are routed to the AI engines through DataForSEO; we don't send your account identity to them
• We don't control how the underlying AI engines process the queries — their own policies apply

The Knowledge Base lets you add trusted context — pasted notes, URLs, and uploaded files (PDF, text, Word) — that the Article Writer uses to ground generated content in your real facts.

• URLs and uploaded files are fetched and parsed by FireCrawl to extract their text
• The extracted text is split into chunks and converted into embeddings by OpenAI for retrieval
• The content and embeddings are stored in your workspace and used only to generate your content

Uploaded files are stored in cloud storage and processed from a URL. Please add only the brand and product context you want reflected in your content — don't upload secrets or sensitive personal data you wouldn't want stored.

If you connect Google Search Console, SEO Ladders accesses your Google account data through Google's API using the read-only Search Console scope. SEO Ladders' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: your Search Console search-performance data (queries, clicks, impressions) and verified site list — read-only. We never modify your Search Console data.
• Why: to suggest the prompts and keywords worth tracking, grounded in queries you already rank for
• Storage: your Google OAuth tokens are stored securely per workspace and refreshed only as needed to read this data
• Sharing: we do not sell or share your Google data, do not use it for advertising, and do not use it to train models
• Control: disconnect anytime from Prompt Explorer (which deletes your stored tokens), or revoke access from your Google Account settings

Your content stays yours. Specifically:

• We do not train AI models on your articles, keywords, audits, or workspace data
• We do not allow our AI providers (Anthropic, OpenAI, image gen) to retain your prompts or outputs for training — these calls run with training opt-out where supported
• Aggregated, anonymized statistics (e.g., 'X articles generated this month' across all users) may be used for product analytics
• Generated articles, images, and analyses belong to you — see the Terms of Service for content ownership

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Continued use of the service after updates means acceptance of the revised policy.

For privacy concerns or questions, please contact us at: