Privacy Policy

1.Who we are

LazySEO is an AI SEO autopilot: it analyses your website, researches keywords, writes articles and can publish them to your CMS. The controller responsible for your personal data is:

We are based in Romania, in the European Union. We have not appointed a Data Protection Officer because we are not required to; for any privacy question, write to support@lazyseo.io.

When you use LazySEO to process personal data contained in your own website content or Search Console property, you remain responsible for that data and we process it on your behalf to provide the Service.

2.Data we collect

Data you give us

• Account data: email address, name, profile picture (if you sign in with Google), and a password — stored only as a one-way hash. If you sign in with Google we also store your Google account ID.
• Project data: the websites you add, your business profile (niche, audience, tone, competitors), content preferences, generated keywords, content plans and articles.
• Integration credentials: the credentials you provide so we can publish on your behalf — e.g. WordPress application passwords, Webflow, Ghost, Shopify, Dev.to or Sanity API tokens, and webhook URLs.
• Billing data: your plan, subscription status and Stripe customer ID. Card details are entered directly into Stripe; we never see or store your full card number.
• Communications: messages you send us by email or live chat, and newsletter sign-ups.

Data collected automatically

• Authentication cookies that keep you signed in (see the Cookie Policy).
• Usage and analytics data: pages viewed, referrer, device and browser type, approximate country, and product events such as “signed up”, “connected Search Console” or “article published”. Some of this is only collected with your consent — see Cookies & analytics.
• Email engagement: whether our emails were delivered, opened or clicked.
• Technical logs: IP address, request times and errors, used to operate and secure the Service.

Data from third parties

• Google: your basic profile when you sign in with Google, and Search Console data when you connect it — described in detail in Google user data.
• Stripe: payment status, invoices and billing country.
• Public web data: we crawl your website and the competitor sites you (or our analysis) identify, and retrieve keyword, search-result and domain-authority data from SEO data providers. This is mostly business information about websites, not personal data.

3.Google user data

What we access

The Search Console scope is read-write because Google only allows sitemap submission under the full webmasters scope. We use the write permission only to submit your site's sitemap so new articles are discovered faster. We do not add or remove users, change settings or delete anything in your Search Console account.

How we use it

• To create and secure your LazySEO account (Google Sign-In).
• To show your search performance in the dashboard, generate insights (e.g. “striking-distance” keywords, declining pages, cannibalisation risks) and track keyword positions over time.
• To plan and write your content: relevant queries and page data from your Search Console property are included in the prompts we send to our AI providers (OpenAI, Anthropic, Google Gemini) solely to generate content for your own website.
• To submit your sitemap to Google on your behalf.

What we never do with Google user data

• We do not sell it or share it with data brokers or information resellers.
• We do not use it for advertising, including retargeting or personalised ads.
• We do not use it to determine creditworthiness or for lending purposes.
• We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models, and our AI providers process it under API terms that do not allow them to train their models on it.
• Humans at LazySEO do not read it, except with your explicit permission (e.g. when you ask support to look at your account), where necessary for security or to comply with the law, or when it has been aggregated and anonymised for internal operations.

Storage, sharing and security

Google OAuth tokens are encrypted at rest with AES-256-GCM. Search Console data is stored in our database on servers in Germany (Falkenstein), accessible only to your account. It is shared only with the service providers needed to run the features above (hosting and AI generation), to comply with the law, or as part of a merger or acquisition with your prior consent where required.

Retention, deletion and revocation

• On first connection we import up to the last 90 days of search data, then sync new data incrementally. We keep it for as long as the property stays connected.
• Disconnect in the app: open your project’s Search Console page and click Disconnect. We revoke our access token with Google and delete the stored Search Console data, insights and position history for that connection.
• Revoke from Google: you can remove LazySEO’s access at any time at myaccount.google.com/permissions. Our sync then stops working; disconnect in the app (or contact us) to have the stored data deleted.
• Deleting your LazySEO account deletes all Google user data we hold, including from backups within 30 days.

4.Purposes & legal bases

We only process personal data where the GDPR gives us a legal basis (Art. 6(1) GDPR):

Where we rely on legitimate interest, we have balanced it against your rights; you can object at any time (see Your rights). Where we rely on consent, you can withdraw it at any time without affecting processing that already happened.

5.AI processing

LazySEO uses large language models and image models to research and write your content. To do so, we send our AI providers the information needed for each task — for example your website’s pages, your business profile, target keywords, competitor pages and, if connected, Search Console queries. We avoid sending account details such as your email or password.

We use these providers through their business APIs, under terms that prohibit them from using our inputs and outputs to train their models. Content is generated for you and your website only; we do not use your data to train models of our own.

6.Backlink exchange

Projects take part in the LazySEO backlink exchange by default. When it is on, an article we write for you may include one natural, relevant link to a page on another participating customer’s website, and other customers’ articles may link to yours. To match sites, we use your website URL, niche/categories, domain rating and the URLs and titles of articles you have published. This information is already public on your website; we do not share your account details with other customers.

You can opt out for any project at any time by writing to support@lazyseo.io (and, where shown, in your project’s settings). Opting out stops new exchange links from being added; links already published stay where they are unless you remove them. See also section “Backlink exchange” in our Terms of Service.

7.Service providers

We share personal data only with service providers (processors) who help us run LazySEO, under data processing agreements that require them to protect it and use it only on our instructions:

Our web crawler (Crawl4AI) and search index (Qdrant) are self-hosted on our own servers, so no third party receives that data. We also integrate with the services you connect (Google, your CMS); they receive data because you instructed us to use them, and their own privacy policies apply.

We do not sell personal data. We may disclose data if required by law or a valid order of a public authority, or to a successor if our business is sold or merged — in which case this policy continues to apply and we will tell you in advance.

8.International transfers

We host our core infrastructure in the EU. Some providers are located in, or may access data from, countries outside the European Economic Area — mainly the United States. When that happens we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (for certified providers) or on the Commission’s Standard Contractual Clauses (Art. 46 GDPR), together with additional safeguards where appropriate. You can ask us for a copy of the relevant safeguards at support@lazyseo.io.

9.Cookies & analytics

We use strictly necessary cookies to keep you signed in, cookieless Vercel Analytics for aggregated statistics, and — only if you agree — analytics cookies (VisitTrack, Google Analytics) and Crisp live chat.

• VisitTrack measures visits and conversions. With your consent it sets a persistent visitor ID, links your activity to your account after you sign in (user ID, email, name, sign-in method, plan) and passes the visitor ID to Stripe at checkout so we can attribute revenue to marketing channels.
• Google Analytics (when enabled) measures website usage. We do not use it for advertising.
• Crisp powers live chat. When you are signed in, we pass your email, name, avatar and user ID so we can help you faster.

Details, durations and how to change your choices are in our Cookie Policy. You can change your choices any time via “Cookie settings” in the footer.

10.How long we keep data

11.Security

• All traffic is encrypted in transit with TLS.
• Passwords are hashed; Google OAuth tokens are encrypted at rest with AES-256-GCM.
• Session cookies are httpOnly and SameSite, and access tokens expire after 15 minutes.
• Access to production systems is limited to the people who need it to run the Service.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and inform you without undue delay, as required by Art. 33–34 GDPR.

12.Your rights

Under Articles 15–22 GDPR you have the right to:

• Access the personal data we hold about you and get a copy (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data (“right to be forgotten”) (Art. 17);
• Restrict processing in certain cases (Art. 18);
• Data portability — receive data you gave us in a machine-readable format (Art. 20);
• Object to processing based on legitimate interest, and at any time to direct marketing (Art. 21);
• Not be subject to decisions based solely on automated processing with legal or similarly significant effects (Art. 22);
• Withdraw consent at any time (Art. 7(3)).

How to exercise them

• Update your profile and email preferences, disconnect integrations and delete projects in the dashboard.
• Delete your account in Settings → Account, or by emailing support@lazyseo.io from your account email.
• Unsubscribe from any email using the link at the bottom of it.
• Change cookie choices via “Cookie settings” in the footer.
• For anything else, email support@lazyseo.io. We reply within one month (extendable by two months for complex requests, in which case we’ll tell you). We may ask you to confirm your identity. Exercising your rights is free.

13.Complaints

We’d appreciate the chance to fix any concern first — write to support@lazyseo.io. You also have the right to lodge a complaint with the Romanian data protection authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania — www.dataprotection.ro — or with the supervisory authority in the EU country where you live or work.

14.Children

LazySEO is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

15.Automated decision-making

We use automation and AI to generate content, choose keywords and schedule publishing for your website. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you, and we do not profile you for such purposes.

16.Changes to this policy

We may update this policy as the Service or the law changes. The “Last updated” date at the top shows the latest version. If a change is material, we will notify account holders by email or in the app before it takes effect.

17.Contact us

Questions, requests or concerns about privacy: support@lazyseo.io. We aim to reply within 30 days, as required by the GDPR.