Privacy policy
What we collect, why, how long we keep it, and how to get it deleted. Written to be read, not to be survived.
Last updated August 1, 2026
What we collect
From you, as a customer: your name, work email, and the domain you connect. Billing is handled by our payment processor; we never see full card numbers.
From your site: publicly available page content, used to generate your SEO profile, topics and recommendations.
From your connected integrations: page and query performance from Search Console and Analytics, when you connect them. All read-only.
From your use of the product: analysis results, chat history, content you create, and your display preferences.
What we never do
- We never sell or rent personal data.
- We never use your site content or your data to train models.
- We never share data between customer projects unless the projects share an owner.
- We never write to your connected Google properties — every integration is read-only.
- We do not use third-party tracking cookies or advertising pixels beyond first-party analytics.
How we use your information
- Generating SEO analysis, keyword research and recommendations.
- Creating AI-assisted content tailored to your domain.
- Providing personalised chat responses based on your own site data.
- Operating your account, billing and support.
Storage and security
Data is held in managed cloud infrastructure and protected with row-level security policies so only you can read your own rows. All traffic is encrypted in transit over HTTPS/TLS, and integration tokens are stored encrypted.
Retention
| Data | Retention | Notes |
|---|---|---|
| Account and billing records | Life of account | Deleted on request, except records we must keep by law. |
| Cached SEO and scan results | 30 days | Refreshed on your next scan. |
| Keyword research results | 30 days | Removed automatically after the window. |
| Content you create | Life of account | Exportable at any time. |
| Support correspondence | 24 months | Kept so we can follow up on an issue. |
Deleting a project deletes its integration data within 30 days. Closing an account deletes everything except records we must keep by law.
Subprocessors
| Subprocessor | Purpose | Notes |
|---|---|---|
| Supabase | Database, authentication and edge functions | Managed cloud |
| Google OAuth | Social login, Search Console and Analytics access | Read-only scopes |
| AI providers | Generating SEO insights and content | No training on your data |
| SEO data providers | Keyword, backlink and traffic data | Queries only |
| Brevo | Transactional email | support@mail.woop1.com |
| Dodo Payments | Billing and subscriptions | We never see full card numbers |
We give notice by email before adding a subprocessor, and you may object.
Your rights
You can request access, correction, export or deletion of your personal data, and object to processing. Write to hello@woop1.com; we respond within 30 days and do not require a form.
If you are in the EU or UK, you may also complain to your supervisory authority.
Children's privacy
Woop AI is not intended for children under 13, and we do not knowingly collect data from children.