Privacy Policy

_Last updated: 2026-08-24._

This Privacy Policy explains how Pavel Valynets PR, preduzetnik (sole proprietor), Beograd, Serbia ("UPGeoSEO", "we") handles personal data. We act as a controller for the data you give us to run your account, and as a processor (a "service provider" under US state laws) for the data we handle on your behalf to operate the Service for your sites.

1. Data we collect

• Account data (controller): your name, email, and login credentials; billing identifiers from our

payment provider (we do not store full card numbers). This is the account and billing data described in this section; we do not collect more account data than is listed here.

• Site & content data (processor): the content of the site(s) you connect, the brand information you

provide, and the content the Service generates and publishes for you.

• Connected analytics (processor): when you connect Google Search Console / Google Analytics, we

read the metrics needed to plan and measure content. See the Google disclosure in §6.

• Usage data: logs and technical data needed to run and secure the Service.

2. Why we use it (legal bases)

To provide the Service (contract), to secure and improve it (legitimate interests), to bill you (contract), and to comply with law. We send you service and transactional emails (for example, account, security, and billing notices) as part of providing the Service. We only send marketing or promotional emails where you have opted in, and you can withdraw that consent or unsubscribe at any time.

3. Sub-processors

We use a small number of third parties to run the Service. They process data only to provide their service to us, under contractual data-protection obligations (EU Standard Contractual Clauses / UK IDTA where applicable):

• Creem (creem.io) — payment processing and merchant of record for subscriptions (billing and

payment data; card details are handled by Creem's own payment providers, not by us).

• Resend — transactional email delivery (recipient address and message content).
• Anthropic (Claude) and Google (Gemini) — AI text generation for content drafting and audit

analysis (content prompts and generated text; no end-user personal data is intentionally sent).

We will notify you of any intended change to this list before a new sub-processor begins processing.

4. Sharing

We do not sell your personal data. We share it only with our sub-processors, as required by law, or in a business transfer. Our payment provider (creem.io, merchant of record) processes your payment data as an independent controller for that purpose.

5. International transfers

Where data is transferred out of the EEA/UK, we rely on appropriate safeguards (EU Standard Contractual Clauses / UK IDTA where applicable, or an adequacy decision where one applies) with each recipient.

6. Google user data (Limited Use)

If you connect Google Search Console or Google Analytics, UPGeoSEO's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use these scopes only to provide and improve the features you enabled, we do not sell this data, and we do not use it for advertising. We request two scopes: https://www.googleapis.com/auth/webmasters (to read your Search Console performance data and to submit your sitemap to Google on your behalf) and https://www.googleapis.com/auth/analytics.readonly (read-only, to read your Google Analytics data).

The Search Console scope is the only one that can write. We use it for exactly one action — submitting or re-submitting your sitemap, which is what tells Google to re-crawl your pages after we publish or change them. We never modify or remove anything else in your Search Console property, we never touch your Google account beyond these two scopes, and we access this data only while you keep the connection enabled.

7. Retention

We keep personal data only as long as needed for the purposes above and to meet legal obligations, unless a longer period is legally required:

• Account data — kept while your account is active and deleted within 30 days after you delete your

account (or after we close it).

• Generated content and connected-site data — kept while your account is active; deleted with the

account.

• Free audit results — kept for 30 days, then deleted automatically.
• Server logs and technical/usage data — kept for approximately 30 days.
• Billing records — kept as long as required for tax, accounting, and legal obligations.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or object to the processing of your personal data, and to withdraw consent. To exercise them, contact us at [email protected]. For data we process on a customer's behalf, we will refer your request to that customer.

9. Cookies

See our Cookie Policy.

10. Changes and contact

We may update this Policy; material changes will be notified by email and/or an in-app notice at least 14 days before they take effect. Contact: [email protected] · Pavel Valynets PR, preduzetnik (sole proprietor), Beograd, Serbia.