1. Data We Collect
We collect the following data to operate That SEO Agent:
- Account data: your name and email address, obtained via Google OAuth when you sign in.
- Google Search Console (GSC) data: search queries, impressions, clicks, and index coverage for the sites you connect.
- Google Analytics 4 (GA4) data: traffic metrics and event data for the properties you connect.
- Usage data: number of sites, data syncs, and page audits used each month.
2. Website Analytics
We use two analytics tools to understand traffic on our landing page:
- Vercel Web Analytics: a cookie-free tool that collects fully anonymous, aggregated data (pages visited, referrer, device type, country). It stores no personal identifiers and does not allow individual user tracking. No consent is required under GDPR.
- Google Analytics 4: we use GA4 with Consent Mode v2 and with all advertising and personalization features disabled. We use it solely to measure traffic in aggregate — not for advertising or user identification. When you reject cookies, GA4 operates in anonymous, cookieless mode and Google models the data statistically. When you accept, GA4 may use first-party cookies for more accurate measurement. In no case do we sell or share this data with third parties.
3. How We Use It
Your data is used solely to operate and improve That SEO Agent. We do not sell your data to third parties or use it for targeted advertising.
4. Google API Data
Our use of Google API data (GSC + GA4) complies with the Google API Services User Data Policy, including the Limited Use requirements. Google data is only used to provide the SEO analysis features you request — it is never used for other purposes or shared with third parties.
5. Data Security
- All data is transmitted over encrypted connections (TLS/HTTPS).
- Google OAuth tokens are encrypted at rest using AES-256-GCM with a per-user derived key.
6. Data Retention
We retain your data for as long as your account is active. You may request deletion of your account and all associated data at any time via the Settings page or by emailing privacy@thatseoagent.com.
7. Your Rights (GDPR)
If you are in the European Economic Area (EEA), you have the following rights under GDPR:
- Right of access: request a copy of the personal data we hold about you.
- Right to erasure: request deletion of your account and all personal data.
- Right to rectification: request correction of inaccurate data.
- Right to restrict processing: request that we limit how we use your data.
- Right to data portability: request your data in a portable format.
To exercise any of these rights, email privacy@thatseoagent.com.
8. Cookies
That SEO Agent uses strictly necessary functional cookies for authentication (session cookies). For analytics, you can accept or reject cookie usage via the banner shown on your first visit. Vercel Analytics never uses cookies regardless of your choice. Google Analytics 4 uses first-party cookies only if you accept — otherwise it operates in anonymous, cookieless mode.
9. Contact
For privacy concerns or data requests, email us at privacy@thatseoagent.com.
10. OAuth Connectors
When you connect That SEO Agent as an OAuth connector (for example, via the Claude Connectors directory), the following additional data is stored and processed:
- Connector scope: The mcp scope grants the connector read access to your SEO data via the MCP API. It does not grant access to your email, Google Drive, Calendar, or any other Google service.
- Token storage: OAuth access and refresh tokens issued during connector authorization are encrypted at rest using AES-256-GCM with a per-user derived key and stored in our database alongside your account record.
- Token lifecycle: Access tokens are short-lived (typically 1 hour) and are refreshed automatically using the stored refresh token. Tokens are deleted when you disconnect the connector or delete your account.
- Revoking connector access: You can revoke the connector at any time from Claude.ai Settings → Connectors. Revoking access immediately invalidates the stored tokens and removes the connector's ability to access your data.
Third-party services accessed through the connector:
- Google Search Console API — query performance and index coverage data for properties you authorize.
- Google Analytics 4 Data API — traffic and engagement metrics for GA4 properties you link.
- Google PageSpeed Insights API — public performance scores for site URLs; no authentication required.
- Google OAuth 2.0 — used to obtain and refresh access tokens; governed by Google's OAuth terms.
Data accessed through the connector is used solely to respond to your MCP tool requests. It is not stored beyond what is necessary for caching (TTL: 5 minutes to 24 hours depending on tool) and audit snapshots tied to your account. It is never shared with other users or used to train models.