Privacy Policy

Role SEO is a product operated by Role Creative Ltd, a company registered in England and Wales. When this policy says “we”, “us” or “Role SEO”, it means Role Creative Ltd acting as data controller for personal data processed through the app and this website.

• Registered address: 13 Hope Street, Liverpool L1 9BQ, United Kingdom
• Phone: +44 151 345 3839
• Email: support@rolewithus.com

We collect only what we need to run the service:

• Account data: name, email address, and password hash. Google account details if you sign in with Google.
• Workspace data: the organisation name, project names, keywords, domains, and any content you save inside Role SEO.
• Integration data: OAuth tokens for Google Search Console and Google Analytics (encrypted at rest), and metadata about the properties you connect. We never see your Google password.
• Google Search Console and Google Analytics data: if you connect these integrations, we read your search performance (clicks, impressions, CTR, average position, top pages, top queries, URL inspection results) and analytics reports for the properties you authorise. Access is read-only and scoped to the specific properties you pick. We do not modify anything in your Google account, and we do not touch other Google services.
• Billing data: subscription status, credit balance, invoices, and the billing address you give our payment processor. We do not store card numbers.
• Usage data: IP address, browser, device, pages viewed, features used, and error diagnostics, collected to keep the service secure and to fix bugs.
• Support correspondence: anything you send us by email so we can help you.

Under UK GDPR we rely on the following lawful bases:

• Contract (Article 6(1)(b)): to give you the service you’ve signed up for, take payment, and provide support.
• Legitimate interests (Article 6(1)(f)): to keep the service secure, prevent abuse, understand aggregate usage, and improve the product. We’ve balanced this against your interests and rights.
• Consent (Article 6(1)(a)): for optional cookies and any marketing email you actively opt into. You can withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): to keep accounting records and respond to lawful requests.

We use a small number of trusted service providers to run Role SEO. Each acts as a data processor under our instructions:

• Cloudflare — hosting, DNS, and DDoS protection.
• DataForSEO — SEO data provider for keyword, SERP, and backlink lookups triggered by your usage.
• OpenRouter — routing layer for the ROS in-app AI agent. Your project data may be sent to the model provider for the length of a chat request only; nothing is retained for training.
• Loops — sends transactional emails (email verification, password reset, team invitations).
• Autumn and Stripe — subscription billing and payment processing. Card details go directly to Stripe and are never stored by us.
• PostHog — product analytics to understand how features are used, with sensitive input fields masked.
• Google — only when you connect Search Console or Analytics. Google acts as an independent controller for your data on their side; Role SEO only reads what you authorise.

We do not sell personal data and do not share it for third-party advertising.

When you connect Google Search Console or Google Analytics, Role SEO receives data from Google APIs. Our use of that data complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve user-facing features that are visible inside Role SEO (for example, showing your Search Console clicks and impressions in GSC Insights, or surfacing top pages in Rank Tracking).
• We do not transfer Google user data to third parties except where necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your notice.
• We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
• We do not allow humans to read Google user data, except (a) with your explicit consent for specific data, (b) when necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised such that it cannot be linked back to any individual user or account.
• We do not use Google user data to develop, improve, or train generalised or non-personalised artificial-intelligence or machine-learning models. The in-app ROS agent may reference your connected Google data during a single chat request to answer your question; the model provider does not retain that data or use it for training.

You can revoke Role SEO's access to your Google account at any time from myaccount.google.com/permissions, or by disconnecting the integration inside the app under Settings then Integrations. Revoking access does not delete data already fetched; to delete that too, remove the project or contact support.

Some processors above are based outside the UK, primarily in the United States. Where UK personal data is transferred, we rely on appropriate safeguards under UK GDPR, typically the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, along with additional technical and organisational measures.

• Account and workspace data: for as long as your account is active, plus 30 days after deletion for restore purposes.
• Billing records: retained for six years to meet UK accounting and tax obligations.
• Support emails: up to 24 months after your last contact.
• Usage analytics: up to 24 months in identifiable form, then aggregated.
• Signup fraud-prevention record: when an account is closed we keep a one-way keyed hash of the email address, plus the deletion timestamp, for up to 90 days. This lets us stop the same address opening a new free-trial account straight away. The stored value is a hash, not the email itself, and is not shared with anyone. Lawful basis is Article 6(1)(f) legitimate interests (fraud prevention). If you'd like this record removed sooner, email us and we'll delete it.

Under UK GDPR Article 32 we apply appropriate technical and organisational measures to protect your personal data, and take extra care with data received through your Google integrations. Concretely:

• Encryption in transit: all traffic between you, the app, our providers, and Google APIs uses TLS 1.2 or above.
• Encryption at rest: our databases and object storage are encrypted at rest by our infrastructure providers (Cloudflare and its underlying platforms).
• OAuth token protection: Google Search Console and Google Analytics OAuth tokens are stored encrypted at rest with an application-level key that is separate from the database, and are decrypted only in memory for the duration of a single API call. Tokens are refreshed and rotated automatically, and are deleted when you disconnect the integration or delete your account.
• Least-privilege access: production systems are accessed only by named staff with multi-factor authentication, and only when needed to operate, support, or debug the service. Access is logged.
• Tenancy isolation: every project belongs to one organisation, and every database query is scoped by organisation ID, so one customer cannot see another customer's Google data, keywords, or reports.
• Backups and recovery: our production database (Cloudflare D1) provides point-in-time recovery for the previous 30 days, encrypted at rest by Cloudflare, and used only for production restore purposes.
• Vulnerability management: dependencies are monitored for known vulnerabilities and critical patches are applied promptly. We do not store payment card details.
• Incident response: if a personal-data breach occurs and poses a risk to your rights, we will notify the UK Information Commissioner's Office within 72 hours and, where required, notify you directly.

Under UK GDPR you have rights to access, correct, delete, restrict, port, and object to processing of your personal data, and to withdraw any consent you’ve given. You can exercise most of these from inside the app (Settings), or by emailing us at support@rolewithus.com. We’ll respond within one month.

If you’re not happy with how we’ve handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, though we’d rather have the chance to fix it first.

We use a small set of cookies. Essential cookies keep you signed in and protect the service from abuse; these don’t need consent under PECR. Optional analytics cookies are covered by PostHog and only fire if you accept them. You can clear or block cookies in your browser settings; the essential ones being blocked will stop the app from working.

When we make material changes, we’ll update the “last updated” date and, where the change affects you, email account holders. Continued use of the service after a change means you accept the updated policy.

Questions about this policy or your data? Email support@rolewithus.com or write to us at 13 Hope Street, Liverpool L1 9BQ.