Privacy Policy
Last updated 9 August 2026
Who we are
SEO Agent is operated by Forest AS, a company registered in Norway. We are the data controller for the personal data described here. For any privacy question, or to exercise the rights below, contact us via our contact page.
What we collect
- Account data — your name, email address, organisation name and password (stored only as a hash). If you sign in with Google we receive your email, name and profile picture from Google.
- Billing data — your company name, billing address and VAT or organisation number. Card details are entered on Stripe's own checkout and are never seen or stored by us.
- Content you point us at — the websites you add, the pages we crawl from them, the brand voice trained from those pages, and the content generated for you.
- Usage data — actions taken in the app, credits consumed, and technical logs including IP address, needed to operate the service, prevent abuse and diagnose faults.
- Analytics — only if you accept analytics cookies. See our cookie policy.
Why we process it, and on what basis
We process account, billing and content data to perform our contract with you — you cannot have an account or receive the service without it. We process technical logs and abuse-prevention data under our legitimate interest in keeping the service secure and working. Analytics is processed only with your consent, which you can withdraw at any time. We keep invoices and related records where we are legally obliged to under Norwegian accounting law.
We do not sell personal data, and we do not use your content to train our own models.
Who we share it with
We use the following sub-processors. Content you ask us to analyse or generate is sent to the AI providers listed below for that purpose only.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI | Content generation and analysis | USA |
| Anthropic | Content generation and analysis | USA |
| DataForSEO | Live Google search results and People-Also-Ask data | EU |
| Stripe | Payments, subscriptions and invoicing | USA / Ireland |
| Render | Application hosting and database | EU (Frankfurt) |
| Vercel | Website hosting and delivery | Global CDN |
| Sentry | Error monitoring | USA |
| Resend | Transactional email (verification, password reset) | USA |
| Google Analytics | Website usage statistics — only with your consent | USA |
| Ad conversion measurement (Insight Tag) — only with your consent | USA / Ireland |
Where a provider is outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
How long we keep it
Account and content data are kept for as long as your account exists. Delete your account and we remove your personal data and content, except records we must retain for accounting purposes (invoices are kept for five years under Norwegian law) and anonymised or aggregated data that no longer identifies you.
Your rights
Under GDPR you can request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting what happened before.
Contact us and we will respond within one month. If you believe we have handled your data improperly you can complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.
Changes
If we change this policy materially we will update the date above and, where the change affects you significantly, tell you in the app or by email.