Privacy Policy

Last updated: 19 September 2026

Introduction
Key Definitions
Information We Collect
How We Use Your Information
Google API Services User Data Policy
How We Disclose Your Personal Data
Data Retention
How We Protect Your Personal Data
International Transfers of Personal Data
Our Public Website and Advertising
Privacy Rights and Choices
Children
Changes to this Privacy Policy
Contact Information

1. Introduction

This Privacy Policy explains how My SEO Toolbox collects, uses, stores, discloses and otherwise processes Personal Data when you use our Services, and sets out the rights available to you in respect of that data. It applies to myseotoolbox.com and to all of its subdomains.

Where you choose to connect a Google account to the Services, this Privacy Policy also explains what Google User Data we access, the purposes for which we use it, with whom we share it, how we protect it, and how it may be deleted. Sections 3.2, 5, 6, 7 and 11 are of particular relevance in that regard.

My SEO Toolbox is the controller of the Personal Data described in this Privacy Policy.

2. Key Definitions

“Account Data” means the Personal Data associated with your My SEO Toolbox account, as described at section 3.1.
“Google User Data” means data obtained from the Google APIs under the authorisation you grant, as described at section 3.2.
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processor” means a third party that processes Personal Data on our behalf and upon our instructions, and which is not permitted to use that data for its own purposes.
“Services” means the My SEO Toolbox application, together with the websites and subdomains through which it is made available.
“UK and European Data Protection Law” means the UK General Data Protection Regulation, the Data Protection Act 2018, and the EU General Data Protection Regulation, in each case as applicable to the processing in question.
“you” means the individual using the Services, and “we”, “us” and “our” mean My SEO Toolbox.

3. Information We Collect

We collect Personal Data in three ways: data you provide to us directly, data obtained from third parties where you authorise us to obtain it, and data collected automatically as you use the Services.

3.1 Information you provide to us directly

Registration requires an email address and a password only. We do not request, and do not collect, your name or any other identifying detail.

We hold the following in respect of each account: the email address supplied at registration; the password, stored solely as a one-way cryptographic hash; a record of your acceptance of our Terms and Conditions; the confirmation status of your email address; the access level assigned to the account; and a reference to the subscription held with our payment processor. We do not receive or store payment card details, which are collected by our payment processor directly.

We also hold the configuration you enter in the course of using the Services, such as the websites you ask us to monitor and the settings applied to them.

3.2 Information we obtain from Google where you authorise us to do so

Connecting a Google account is optional, is disabled by default, and takes effect only upon your express authorisation. The Services may be used without it.

We request the following OAuth scopes, each of which confers read-only access:

https://www.googleapis.com/auth/analytics.readonly — Google Analytics;
https://www.googleapis.com/auth/webmasters.readonly — Google Search Console;
https://www.googleapis.com/auth/userinfo.email — the email address of the Google account granting the authorisation.

We request no scopes beyond those listed above. As userinfo.email is a sign-in scope, Google may return the standard openid and email scopes alongside it, and these may accordingly appear on your consent screen. They serve to identify the Google account signing in and to return its email address, and confer no further access.

Under these scopes we access the following categories of Google User Data:

Account, property and site listings. Upon connection, the names by which Google identifies the Google Analytics accounts and properties, and the Google Search Console sites, to which your Google account has access. These are accessed solely so that you may select which property and site to connect. No reporting data is accessed at this stage.
Google Analytics reporting data. For the property you select only, the number of organic search sessions recorded against each landing page, by day.
Google Search Console reporting data. For the site you select only, the impressions, clicks and average position recorded against each page, by day.
Google account email address. Used to label the connection within the interface so that multiple connections may be distinguished from one another.

The scopes set out above are read-only and do not permit us to create, modify or delete anything within your Google account. Within those scopes we access only such data as is required for the purposes described at section 4, and we do not retrieve reporting data for any property or site you have not selected. Where we change the Google User Data we access, we will update this Privacy Policy in accordance with section 13.

3.3 Information collected automatically

Our systems record events in log files. These comprise the internet protocol (IP) address, browser type, internet service provider, date and time stamp, referring and exit pages, and the number of page requests. Log files contain no Google User Data and are not linked to information by which you are personally identifiable.

We use cookies, being small data files stored on your device by your browser, to maintain your signed-in session and to record your preferences. Cookies set by My SEO Toolbox are read only by My SEO Toolbox. Third-party cookies are set by the advertising partners identified at section 10, and are set exclusively on our public marketing pages. Cookies may be disabled through your browser settings, although doing so may prevent you from remaining signed in.

4. How We Use Your Information

Account Data is used to identify you, to determine which workspaces you may access and what actions you may take within them, to send the transactional messages the Services require (namely confirmation of your email address upon registration, and password reset instructions where you request them), and to administer your subscription. We process Account Data on the basis that it is necessary for the performance of our contract with you.

Google User Data is used for a single purpose: to present traffic figures alongside the changes we detect on the websites you monitor, so that you may establish whether traffic has moved following a modification to a page. The sessions, impressions, clicks and average position we import are recorded against the pages we monitor on your behalf and are displayed within the dashboards and performance views of the Services. They are not sent to you by email and are not used for any other purpose. We process Google User Data on the basis of the consent you give when authorising the connection, which you may withdraw at any time in accordance with section 11.

Data collected automatically is used to analyse usage trends, to administer and secure the Services, and to diagnose faults. We process such data on the basis of our legitimate interests in operating, securing and improving the Services.

We do not use Google User Data for advertising of any description, including personalised, retargeted or interest-based advertising. We do not sell Google User Data, nor transfer it to data brokers or information resellers. We do not use it to determine credit-worthiness or for lending purposes, to construct databases or profiles concerning you, or to develop, train or improve generalised artificial intelligence or machine learning models.

5. Google API Services User Data Policy

My SEO Toolbox’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How We Disclose Your Personal Data

We do not sell Personal Data, and we do not transfer or disclose it to third parties for any purpose other than the provision of the Services described in this Privacy Policy.

6.1 Google User Data

Google User Data is stored within infrastructure hosted on Google Cloud Platform, which provides the hosting, database storage and messaging upon which the Services operate, and which acts as a Processor. No other external service provider receives Google User Data.

6.2 Account Data

Account Data is disclosed to the following Processors, each acting upon our instructions and for the purpose stated:

Amazon Web Services (Amazon SES) — receives your email address for the purpose of delivering registration confirmation and password reset messages, and receives nothing further;
Stripe — receives your email address for the purpose of maintaining a customer record against your subscription. Payment details are collected by Stripe directly through its own facilities; we neither receive nor store card details, and retain only Stripe’s subscription reference and its status.

Neither Processor receives Google User Data.

6.3 Other users of your workspace

Data imported from Google is accessible to those persons you invite to the relevant workspace. You control who is invited.

6.4 Our personnel

Personnel of My SEO Toolbox do not access Google User Data save where you have given express permission, for example in connection with a support request; where access is necessary for security purposes, including the investigation of abuse; where we are required to do so by law; or where the data has been aggregated and anonymised such that it no longer relates to an identifiable person.

6.5 Legal and safety disclosures

We may disclose Personal Data where required to do so by law, or where necessary to investigate abuse or a security incident. We will notify you of any such disclosure save where we are legally precluded from doing so.

7. Data Retention

Data imported from Google Analytics and Google Search Console is retained for so long as your account remains active, the purpose of the feature being the comparison of traffic against changes over time. You may delete it at any time in accordance with section 11.2.

Authorisation tokens are retained until the corresponding connection is removed, at which point they are deleted permanently and immediately.

Account Data is retained for so long as the account remains open, and is deleted following closure in accordance with section 11.3.

8. How We Protect Your Personal Data

We maintain technical and organisational measures appropriate to the confidentiality of the information entrusted to us, including data imported from Google Analytics and Google Search Console:

Encryption in transit. All traffic between your browser and the Services, and between the Services and the Google APIs, is encrypted by means of HTTPS/TLS.
Encryption at rest. Account Data and imported Google User Data are held in a database residing on encrypted storage volumes provided by our hosting provider.
Passwords. Passwords are stored solely as salted one-way hashes and cannot be read or recovered by any person, including ourselves.
Authorisation tokens. The token by which we read your Google Analytics and Google Search Console data is held in our database, is not exposed to or usable by other users, and is used solely to authenticate the API requests described in this Privacy Policy. It is not disclosed to unrelated third parties, and is permanently deleted upon removal of the connection.
Access control. Imported data is visible only to you and to those persons you invite to your workspace, and every request to our servers is authenticated.
Operational access. Access to production systems is restricted to those persons who operate the Services, and is exercised solely for the purpose of operating and supporting them.

No method of transmission over the internet, and no method of electronic storage, is entirely secure. While we take the measures described above, we cannot guarantee the absolute security of Personal Data transmitted to or held by us.

9. International Transfers of Personal Data

We are established in the United Kingdom. Our Processors may process Personal Data outside the United Kingdom and the European Economic Area. Where Personal Data is transferred to a country that has not been the subject of an adequacy decision, the transfer is made subject to the safeguards required by UK and European Data Protection Law, such as standard contractual clauses or the UK International Data Transfer Addendum. Further information about these safeguards may be obtained using the contact details at section 14.

10. Our Public Website and Advertising

The Services comprise two distinct parts: the public marketing website, and the signed-in application in which the Services are delivered. Advertising appears only on the public marketing website and is not present within the signed-in application.

The advertising cookies and partners described in this section receive no data obtained from the Google APIs. Google User Data is at no point used for advertising, nor transferred to any advertising network or data broker.

10.1 Google DoubleClick DART cookie

Google acts as a third-party vendor on our public marketing website and employs a cookie known as the DART cookie to serve advertisements there. Such advertising funds the operation of the Services. The DART cookie operates exclusively on the public marketing website and receives no data obtained from the Google APIs. It may be declined at the Google ad and content network Privacy Policy.

10.2 Advertising partners

Our advertising partners may set cookies and web beacons on our public marketing website. None receives data obtained from the Google APIs, and none receives data from the signed-in application. Each maintains its own privacy policy:

Google — https://policies.google.com/technologies/ads

Third-party advertising servers and networks employ technologies such as cookies, JavaScript and web beacons within the advertisements and links appearing on our public marketing website. These are transmitted directly to your browser and automatically receive your IP address, and are used to measure the effectiveness of advertising campaigns and to personalise the advertising displayed to you. My SEO Toolbox has no access to, and exercises no control over, cookies set by third-party advertisers.

10.3 Third-party privacy policies

This Privacy Policy does not extend to other advertisers or websites. You are advised to consult their respective privacy policies for details of their practices and of the means by which you may opt out.

11. Privacy Rights and Choices

11.1 Withdrawing your Google authorisation

You may withdraw our access to your Google account at any time, by either of the following means:

within the Services: select your avatar in the upper right, then “My account”; locate the account listed under “Google Analytics”; select the delete icon and confirm by selecting “Remove” in the “Remove Google Analytics Connection” dialogue. The authorisation token is thereupon deleted permanently from our database, and all further import from Google Analytics and Google Search Console ceases;
from your Google account, at https://myaccount.google.com/permissions, which has the same effect as regards future import.

11.2 Deleting data already imported

Withdrawal of authorisation does not of itself delete data already imported, which remains available so that historical figures continue to display. You may delete it at any time by opening the settings of the relevant workspace, locating “Performance Data” and selecting “Wipe”. This permanently removes every stored Google Analytics day and every stored Google Search Console day for that workspace with immediate effect, and cannot be reversed. Alternatively, a request may be sent to info@myseotoolbox.com and we will effect deletion within 30 days.

11.3 Closing your account

A request for closure of your account may be sent to info@myseotoolbox.com. We will delete the account, all authorisation tokens held in respect of it, and all Google Analytics and Google Search Console data imported for its workspaces, within 30 days.

11.4 Your statutory rights

Subject to the conditions and exemptions provided by UK and European Data Protection Law, you have the right to request access to the Personal Data we hold about you; to request its rectification or erasure; to request the restriction of its processing; to object to its processing; to receive it in a portable format; and to withdraw any consent you have given, without affecting the lawfulness of processing carried out before withdrawal. Requests may be made using the contact details at section 14, and we will respond within the period required by law.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office, the United Kingdom’s supervisory authority for data protection, or with the supervisory authority of the country in which you reside.

12. Children

The Services are not directed at children, and we do not knowingly collect Personal Data from children under the age of 13. Should you believe that a child has provided such data, please contact us and we will remove it from our records.

13. Changes to this Privacy Policy

We keep this Privacy Policy current. Where we change the manner in which the Services access, use, store or share Google User Data, we will update the date appearing at the head of this page and notify registered users by email at the address held on their account before the change takes effect.

14. Contact Information

Questions about this Privacy Policy, and requests concerning your Personal Data, should be addressed to info@myseotoolbox.com.

By using the Services you acknowledge this Privacy Policy and agree to our Terms and Conditions. Connecting a Google account requires a separate and express authorisation, which may be withdrawn at any time in accordance with section 11.