Privacy Policy

Controller: Tobias Lochau, Teltower Straße 15, 14109 Berlin, Germany — [email protected]

1. What we process

• Account data: your email address (magic-link login, no passwords stored).
• Project data: the website URL you connect, the site context our pipeline extracts from your public pages, keywords and generated articles.
• CMS credentials: if you connect WordPress, we store the URL, username and application password to publish on your behalf. They are stored server-side, are never exposed to your browser after saving, and are deleted when you delete the project.
• Payment data: processed by Stripe; we never see your card number.
• Server logs: our hosting provider Cloudflare processes IP addresses for security and delivery (legitimate interest, Art. 6(1)(f) GDPR).

2. Processors

• Cloudflare, Inc. — hosting/CDN
• Supabase (AWS Frankfurt, Germany) — database and authentication
• Stripe Payments Europe, Ltd. — payments
• Anthropic, PBC — article generation (your site's public content and the article briefing are processed; no account data is shared)
• DataForSEO — keyword and search-results data (receives keywords, not personal data)
• PostHog EU (PostHog, Inc., hosted in the EU) — privacy-friendly product analytics (page views, feature usage, funnel events). Configured cookieless: no cookies, no cross-site tracking, no session recordings. For logged-in users, usage events are linked to the account to improve the product (Art. 6(1)(f) GDPR).

2a. Newsletter

If you subscribe to our blog newsletter, we store your email address and send you a confirmation email (double opt-in) — only after you confirm do you receive our articles (about one per week). Legal basis: consent (Art. 6(1)(a) GDPR). Every email contains an unsubscribe link; you can also withdraw anytime via [email protected]. Sending is handled by Resend (EU-verified sender domain), storage by Supabase (Frankfurt).

3. Legal basis

Contract performance (Art. 6(1)(b) GDPR) for account, project and payment data; legitimate interest (Art. 6(1)(f)) for security logs.

4. Retention & your rights

Account data is deleted when you delete your account; invoices are kept as required by tax law. You have the right to access, rectification, erasure, restriction, portability and objection, and to lodge a complaint with a supervisory authority. Contact: [email protected].

5. Cookies

Seofable uses only technically necessary storage (login session). Our analytics (PostHog EU) runs cookieless — it sets no cookies and stores nothing on your device — therefore no cookie banner.

6. Fonts

All fonts are self-hosted; no requests are sent to third-party font services.