We built Smart SEO to help Shopify merchants get found, not to collect data. This policy explains, in plain language, what information we handle on the Smart SEO website and in the Smart SEO app, why, and the choices and rights you have.
1. Who we are and what this policy covers
This Privacy Policy explains how Seven Spikes Ltd., a company registered in Bulgaria and trading as Sherpas Design (“we”, “us”, “our”), collects, uses, shares and protects information in connection with:
- the website at www.smartseoapp.ai, including its blog and contact forms (the “Website”); and
- the Smart SEO application for Shopify, including any related support we provide (the “App”; together with the Website, the “Services”).
For the purposes of the EU General Data Protection Regulation (“GDPR”) and similar laws, Seven Spikes Ltd. is the controller of the personal data described in this policy, except where Section 6 explains that we act as a processor on behalf of a merchant.
This policy should be read together with our Terms of Use. If you do not agree with it, please do not use the Services.
2. Information we collect on the Website
No tracking cookies or analytics
The Website does not use advertising or analytics cookies, tracking pixels, or third-party analytics tools, and we do not build profiles of Website visitors. You can read the blog and browse the Website without giving us any personal information.
Technical data
Like any website, when your browser requests a page our hosting and network providers (see Section 7) automatically process technical data needed to deliver it and keep it secure, such as your IP address, browser type, the page requested, the referring page and the date and time. These records are used for security, abuse prevention and troubleshooting, and are kept only for the limited periods set by those providers.
Information you send us
When you use the contact form or the partner and affiliate enquiry forms, we receive:
- your name and email address;
- the subject and content of your message; and
- any other information you choose to include.
These messages are delivered to our team by email through our email delivery provider. Please do not include sensitive personal information (for example, health or financial details) in your message.
3. Information we collect through the App
Shopify store data
When you install the App, we access the following through the Shopify API:
- Store owner and staff information: name, email address, phone number, city and country.
- Store metadata: store name, domain, Shopify plan and locale settings.
- Store content: product titles and descriptions, images, collections, pages, blog posts and theme files, used to generate and optimise SEO metadata and structured data.
We do not collect your customers’ personal information, payment card details, order histories or any data about shoppers who visit your store.
Google Search Console data
If you choose to connect Google Search Console, we access search analytics data (queries, impressions, clicks, click-through rate and average position) and site verification status for your verified properties. Access is granted through Google’s OAuth 2.0 authorization, which you control, and you can disconnect at any time from within the App.
Google Ads API data
The App uses the Google Ads API solely for its keyword suggestions feature. We retrieve Google’s aggregated keyword planning data: average monthly search volumes, competition levels and historical search trends. We do not access, manage, modify or view any Google Ads campaigns, ad groups, ads, billing information or advertiser account data.
Billing information
Paid plans are billed through Shopify. We receive information about your subscription (such as plan, status and charges) but we never receive or store your payment card details.
Support and communications
When you contact our support team, we keep the conversation, your store name, your contact details and the context needed to help you.
Usage information
We record how the App’s features are used (for example, which optimisations are run and quota usage) to operate the App, enforce plan limits, and fix and improve features.
4. How we use information and our legal bases
We use personal data only for the purposes below, each with a legal basis under the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the App: generating and optimising meta titles, descriptions, alt text and structured data, detecting broken links, running audits, keyword research and search performance reporting | Performance of our contract with you (Art. 6(1)(b)) |
| Billing and plan management through Shopify, and enforcing quotas | Performance of contract (Art. 6(1)(b)) |
| Answering contact form enquiries and providing support | Steps at your request before entering into a contract, or performance of contract (Art. 6(1)(b)); otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f)) |
| Service and account emails (for example, about changes to the App or your plan) | Performance of contract (Art. 6(1)(b)) |
| Product update emails about the App | Our legitimate interest in keeping customers informed (Art. 6(1)(f)), or your consent where required. You can opt out at any time. |
| Keeping the Services secure, preventing fraud and abuse, and troubleshooting | Legitimate interests (Art. 6(1)(f)) |
| Improving features based on aggregated usage | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal, tax and accounting obligations, and establishing or defending legal claims | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can object at any time (see Section 11). We do not use personal data for automated decision-making that produces legal or similarly significant effects.
5. Google API Services: Limited Use disclosure
Smart SEO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We only use Google API data to provide and improve the App’s user-facing features (keyword research and search performance reporting).
- We do not transfer Google API data to third parties, except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
- We do not use Google API data for advertising, including retargeting or interest-based advertising.
- We do not sell Google API data, and we do not use it to build user profiles or segments.
- We do not allow humans to read Google API data, unless you give us your affirmative consent for specific data, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymised for internal operations.
6. When we act as a processor for merchants
Some store content you give the App may include personal data, for example a blog author’s name or a person named in a product description. When the App processes such data to provide the Services to you, we act as your processor under Article 28 GDPR: we process it only on your documented instructions (as set out in our Terms of Use and your use of the App), keep it confidential, protect it with appropriate security measures, use only bound sub-processors, assist you with data subject requests, and delete it when you stop using the App, unless the law requires us to keep it.
As required by Shopify, we respond to Shopify’s mandatory privacy requests (customer data requests, customer redaction and shop redaction).
7. Service providers and how we share information
We do not sell personal information, and we do not “share” it for cross-context behavioural advertising. We disclose information only to the following categories of recipients, and only as needed for the purposes in Section 4:
| Recipient | Purpose | Data involved |
|---|---|---|
| Microsoft Azure | Hosting, databases, file storage and monitoring for the Website and App | All data described in this policy |
| Cloudflare | Domain name services and redirects for the Website | Technical request data |
| Mailgun | Delivering Website contact form messages to our team | Name, email address and message |
| Shopify | The platform the App runs on, and billing for paid plans | Store, account and subscription data |
| Search Console and keyword data you ask the App to retrieve | The connected properties and the keywords you research | |
| AI language model providers | Generating SEO titles, descriptions, alt text and structured data on your behalf | Product and page titles, descriptions and image URLs. We do not send your customers’ personal data. |
| Site crawling and analysis tools | Broken link detection, SEO audits and backlink analysis | Your store’s publicly accessible domain and page URLs |
| Customer support and email tools | In-app support conversations, transactional and product update emails | Store name, owner name, email address and support context |
All service providers are contractually required to protect personal data and to use it only to provide their services to us. We may also disclose information:
- to comply with law, regulation, legal process or an enforceable government request;
- to enforce our Terms of Use, or to protect the rights, property or safety of our users, the public or us;
- to a buyer or successor in a merger, acquisition, financing or sale of assets, subject to this policy’s protections; and
- with your consent or at your direction.
Links on the Website to third-party apps (for example, on our Integrations page) take you to services that have their own privacy policies; we are not responsible for their practices.
8. International data transfers
We are based in the European Union and store App data on Microsoft Azure. Some of our service providers process data outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework, where the recipient is certified) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where appropriate. You can contact us for more information about these safeguards.
9. How long we keep information
- App data is kept while the App is installed on your store. When you uninstall the App, your Google Search Console authorisation is revoked, and your store data is deleted in line with Shopify’s shop redaction process, unless we must keep certain records by law.
- Cached keyword data from the Google Ads API is kept for up to 7 days and then deleted automatically.
- Contact form and support messages are kept for as long as needed to handle your enquiry and any follow-up, and then deleted or anonymised.
- Billing and accounting records are kept for the periods required by tax and accounting law.
- Technical logs are kept for the limited periods set by our hosting and network providers.
10. How we protect information
We use appropriate technical and organisational measures to protect personal data, including encryption of data in transit (TLS/HTTPS), encryption of sensitive credentials such as OAuth tokens at rest, access restricted to personnel who need it, and infrastructure hosted with providers that meet recognised security standards. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach where the law requires us to.
11. Your rights
Everyone
You can ask us to access, correct or delete the personal information we hold about you. You can disconnect Google Search Console from within the App and uninstall the App at any time, which stops further collection.
EEA, United Kingdom and Switzerland
Under the GDPR and equivalent laws, you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data rectified;
- have your data erased;
- restrict processing;
- receive your data in a portable format (data portability);
- object to processing based on our legitimate interests, and to direct marketing at any time; and
- withdraw consent at any time, where we rely on consent, without affecting earlier processing.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (www.cpdp.bg). We would, however, appreciate the chance to address your concerns first.
California and other U.S. states
If you are a resident of California or another U.S. state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it. Because the Website does not track visitors, we do not need to act on Global Privacy Control or “Do Not Track” signals, but we would honour them if that changed. You may use an authorised agent to make a request on your behalf.
How to exercise your rights
Email us at hello@smartseoapp.ai. We will respond within one month (or within the period required by your local law), and we may need to verify your identity first. If you are a merchant’s customer and your request concerns data we process for that merchant, we will forward it to the merchant or help them respond.
12. Children
The Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and we will delete it.
13. Changes to this policy
We may update this Privacy Policy to reflect changes to our practices, the Services or the law. We will update the “Last updated” date at the top of this page and, for material changes, give you notice through the App, by email or on the Website before the changes take effect.
14. Contact us
For questions about this policy or your personal data, or to make a complaint, contact:
Seven Spikes Ltd. (trading as Sherpas Design)Serdikijski Sabor St., Jujen Park, bl. 27, entrance A, ap. 15
Sofia 1421, Bulgaria
Email: hello@smartseoapp.ai