Privacy Policy
Last updated 27 October 2026
Who we are
SEO Agent is operated by Forest AS, a company registered in Norway. We are the data controller for the personal data described here. For any privacy question, or to exercise the rights below, contact us via our contact page.
What we collect
- Account data: your name, email address, organisation name and password (stored only as a hash). If you sign in with Google we receive your email, name and profile picture from Google.
- Billing data: your company name, billing address and VAT or organisation number. Card details are entered on Stripe's own checkout and are never seen or stored by us.
- Content you point us at: the websites you add, the pages we crawl from them, the brand voice trained from those pages, and the content generated for you.
- Usage data: actions taken in the app, credits consumed, and technical logs including IP address, needed to operate the service, prevent abuse and diagnose faults.
- SEO advisor data: if you buy the SEO advisor package: the goals you give us, the crawl of your site, your conversations with the advisor (text, and transcripts of voice calls; we don't store the audio), and, only if you connect it, data from your Google Search Console and Google Analytics. See Google Search Console and Google Analytics data below.
- Analytics: only if you accept analytics cookies. See our cookie policy.
Why we process it, and on what basis
We process account, billing and content data to perform our contract with you: you cannot have an account or receive the service without it. We process technical logs and abuse-prevention data under our legitimate interest in keeping the service secure and working. Analytics is processed only with your consent, which you can withdraw at any time. We keep invoices and related records where we are legally obliged to under Norwegian accounting law.
We do not sell personal data, and we do not use your content to train our own models.
Google Search Console and Google Analytics data
Connecting Google is optional and only offered on an SEO advisor order. If you connect it, you sign in with Google and grant us read-only access to Search Console (webmasters.readonly) and Google Analytics (analytics.readonly). You then choose one Search Console property and one GA4 property, and we read only those:
- Search Console: clicks, impressions, average position and search queries for your pages, for the last 90 days and the 90 days before.
- Google Analytics: sessions, engaged sessions and key events per landing page for the same periods.
- Your Google email address, so you can see which account is connected.
We use this data only to provide the SEO advisor to you: to rank the findings in your report by real traffic, and so the advisor can answer your questions about your site. To write the report and the advisor's answers, the relevant figures are sent to OpenAI for that purpose only. We never sell this data, never use it for advertising, never use it to train AI models, and never share it with anyone else. Nobody at SEO Agent reads it except to deliver or support your order.
SEO Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The access token is stored encrypted (see How we protect your data). You can disconnect at any time on your order's Goals & data tab: we then revoke our access with Google and delete the Search Console and Analytics data we fetched. Figures already used in a report you have received stay in that report. You can also remove our access in your Google account at any time.
How we protect your data
- Encryption in transit: every connection to seoagent.no and our API uses HTTPS (TLS), enforced with HSTS. Our servers talk to Google, our database and our other providers over TLS as well.
- Encryption at rest: our database is hosted by Render in Frankfurt (EU) and is encrypted at rest with AES-256, including its backups.
- Google access tokens: encrypted a second time inside the database (Fernet: AES-128 with an HMAC-SHA256 signature) with a key kept in our server configuration, not in the database. They are only decrypted on our server, at the moment we fetch your data.
- Passwords: stored only as bcrypt hashes; we cannot read them.
- Access control: every request is checked against your account, so your orders, reports and Google data are only visible to you. Inside SEO Agent only authorised admin accounts can see an order, and only to deliver or support it.
- Data minimisation: Google access is read-only, limited to the one property you choose and the fields listed above, and removed when you disconnect.
- Payments: card details go straight to Stripe and never reach our servers.
- Incidents: if a personal data breach happens, we notify Datatilsynet and the people affected as the GDPR requires.
Who we share it with
We use the following sub-processors. Content you ask us to analyse or generate is sent to the AI providers listed below for that purpose only.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI | Content generation and analysis, and the SEO advisor's text and voice conversations | USA |
| Anthropic | Content generation and analysis | USA |
| DataForSEO | Live Google search results, People-Also-Ask, AI-answer mentions and competitor keyword data | EU |
| Ahrefs | Backlink, authority and search data about the websites you ask us to analyse | Singapore |
| Stripe | Payments, subscriptions and invoicing | USA / Ireland |
| Render | Application hosting and database | EU (Frankfurt) |
| Vercel | Website hosting and delivery | Global CDN |
| Sentry | Error monitoring | USA |
| Resend | Transactional email (verification, password reset) | USA |
| Google Analytics | Website usage statistics, only with your consent | USA |
| Ad conversion measurement (Insight Tag), only with your consent | USA / Ireland |
Where a provider is outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
How long we keep it
Account and content data are kept for as long as your account exists. Delete your account and we remove your personal data and content, except records we must retain for accounting purposes (invoices are kept for five years under Norwegian law) and anonymised or aggregated data that no longer identifies you.
Your rights
Under GDPR you can request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting what happened before.
Contact us and we will respond within one month. If you believe we have handled your data improperly you can complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.
Changes
If we change this policy materially we will update the date above and, where the change affects you significantly, tell you in the app or by email.