Privacy Notice

ikanSEO Ltd operates ikanSEO and is the controller of the personal data described in this Notice where we decide why and how it is used. It is registered in England and Wales with its place of registration in England. Our registered or principal business address is 123 Example Street, London, UK.

For privacy questions, requests or complaints, contact us at privacy@ikanseo.com. If we are required to appoint a Data Protection Officer or representative, we will publish their contact details here.

This Notice is written for a service operated from or offered into the United Kingdom. It does not replace a separate data processing agreement where we process personal data solely on a business customer’s documented instructions.

Connecting Google is optional. If you choose to do so, the connection flow requests basic identity information (openid and email) plus read-only Google Search Console and Google Analytics permissions. GA4 reporting is optional in the product, but the Google Analytics read-only permission is requested in the current connection flow. We use the information only to identify the connected account, discover permitted properties, import and display the requested SEO/analytics information, maintain the connection and provide related support.

Google Search Console information can include verified properties, search-query and page performance, countries, devices, clicks, impressions, click-through rate and average position. The GA4 integration currently retrieves aggregate daily performance information, such as sessions, users, engagement, conversions and purchase revenue, for a selected property. We do not use the connection to change your Google settings or your website.

You can revoke access through Google or disconnect a property in the Service. Revocation stops future access once it takes effect; it does not automatically delete historical data already imported. We use Google user data in accordance with the Google API Services User Data Policy, including its Limited Use requirements where they apply.

We share personal data only where needed for the purposes above, including with:

• Google, to provide the Google integration you request;
• Stripe, to process payments and manage subscriptions;
• DataForSEO, to run requested keyword research, rank checks, backlink analysis and technical audit work;
• Bunny Fonts, which supplies the web font requested by your browser when you load our website and may receive the technical connection data needed to do that;
• hosting, database, infrastructure, email-delivery, security and support providers that help us operate the Service;
• our authorised staff and advisers, including administrators who may access an account to provide support, maintain security or investigate a problem;
• regulators, law-enforcement bodies, professional advisers or other parties where law requires or permits disclosure; and
• a buyer, successor or adviser in connection with a genuine corporate transaction, subject to appropriate confidentiality protections.

Shared research-result caches are a limited exception: a provider result produced for one request may be reused for a different customer’s equivalent request, as explained in our Terms. We do not make your account profile visible to that customer through this cache, but you must not use shared-result features to submit personal, sensitive or confidential information.

Some recipients may process information outside the UK. Where a transfer is subject to UK data-protection law, we will use an appropriate lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, and supplementary safeguards where required. You may ask us for more information about the relevant safeguards using the contact details above.

We retain information only for as long as necessary for the purpose for which it was collected, including the periods below. The exact period can vary because of your plan, active settings, a legal obligation, a dispute, a security investigation or an operational backup cycle.

• Account, connection and service data: normally for as long as the account or relevant property remains active. We may retain historical property data after a property is disconnected so it can be reconnected, unless it is deleted or we no longer need it. Web Analytics event data is deleted when the account is deleted; it may remain with the disconnected property while that account is open.
• Google credentials: until you disconnect or revoke the connection, close the account, or they are no longer required to provide the Service. If Google revokes a connection, we may retain limited connection and security records for troubleshooting, fraud prevention and legal claims, subject to our security-retention processes.
• Billing and subscription records: for as long as needed to administer the subscription and meet applicable tax, accounting, fraud-prevention and dispute-resolution obligations.
• Support, security and audit records: for as long as reasonably necessary to resolve the issue, secure the Service, enforce our Terms or establish, exercise or defend legal claims.
• Shared cached provider results: according to the cache and operational-retention lifecycle. These records can outlive an account closure because they support equivalent requests across the Service; this is why personal, sensitive and confidential data must not be entered into shared-result features.
• Backups: until replaced or removed in line with our backup lifecycle. A backup may retain a limited copy temporarily after a live-system deletion.

You can close your account from account settings after cancelling any active paid Stripe subscription in the Stripe billing portal. We block closure while an active subscription remains so you do not lose access to the cancellation route. If you cannot access the portal, contact us using the privacy contact details above. We will handle retained information as described above and in accordance with applicable law.

We use appropriate technical and organisational measures designed to protect personal data, including access controls, authentication measures and safeguards for integration credentials. Access is limited to people who need it for the purposes described in this Notice.

No online service can guarantee absolute security. Please protect your password and connected accounts, use a unique password, and tell us promptly if you believe your account has been compromised.

Depending on the circumstances and applicable law, you may have the right to request access to, correction of, deletion of, restriction of or portability of your personal data. You may also object to processing based on legitimate interests, including direct marketing. Where we rely on consent, you can withdraw it at any time; this does not affect processing before withdrawal.

To make a request, contact us at privacy@ikanseo.com. We may need to verify your identity and will respond within the time required by law. Some rights are subject to legal exceptions.

If you are unhappy with our response, you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concerns first.

Cookies and similar technologies store or access information on your device. We use essential technologies that are needed to provide the website and authenticated Service, such as session, security, request-protection and appearance-preference technologies. They are not used for advertising or cross-site behavioural tracking.

We do not currently use advertising cookies or third-party behavioural analytics in the application. We also offer an optional, cookie-free Web Analytics snippet for customers to install on their own websites. It sends a limited pageview request to our service and uses a daily-rotating hash rather than placing a persistent visitor identifier on the visitor’s device. The customer operating that website is responsible for its own visitor notice and any choices required by law.

If we add optional storage/access technologies, we will provide clear information and the consent or simple free objection mechanism required by applicable law before or when they are used. You can also manage cookies in your browser, although blocking essential technologies may prevent parts of the Service from working.

Automated decisions. We do not make decisions about you solely through automated processing that produce legal or similarly significant effects. Automated monitoring, plan limits and background data processing help operate the Service but do not replace a legally significant human decision about you.

Children. The Service is not intended for anyone under 18. Do not create an account or provide personal data if you are under 18.

Changes to this Notice. We may update this Notice when our practices, Service or legal requirements change. We will post the updated version here and change the “Last updated” date. For material changes, we will take additional steps to notify you where required by law.