Privacy Policy

1. Status and privacy posture

The trading identity, available operator details, website domain, and monitored contact addresses that apply to this policy are displayed above. Product availability is controlled separately from the completeness of those published details.

SEO Dispatch is designed to follow the Australian Privacy Principles as a product baseline where they apply. This policy does not claim regulatory or legal approval.

2. Information we collect

• Account and authentication information, including email, verified identity data supplied by the authentication provider, account status, and security events.
• Workspace, membership, site, property, Search Console, analytics, crawl, keyword, ranking, audit, opportunity, Guide, verification, and report data needed for features you request.
• MCP client registrations, selected workspace grants, optional Start Guide work permission, connection and last-use times, outcome codes, and sanitized audit metadata.
• Billing customer, subscription, promotion, tax, and transaction identifiers supplied by Stripe. SEO Dispatch does not receive or store full card numbers.
• Support correspondence, waitlist and marketing consent records, unsubscribe records, and product feedback.
• Technical and security information such as timestamps, bounded event metadata, rate-limit identifiers derived from a keyed hash, and logs needed to operate and protect the service.

3. Information deliberately excluded from MCP audit records

MCP audit records must not contain access or refresh tokens, credentials, Guide Markdown, prompts, evidence bodies, request or response payload bodies, raw IP addresses, or integration secrets. A user-selected AI client may receive the Guide or other bounded data the user authorises at request time; that client's handling is governed by its own terms and privacy policy.

4. How and why we use information

• Provide authentication, workspaces, audits, Guides, reporting, integrations, billing, support, and user-requested AI or MCP workflows.
• Authorise access, enforce workspace boundaries and user choices, prevent abuse, investigate incidents, maintain auditability, and comply with law.
• Measure reliability, feature use, cost, and product performance using the minimum data reasonably needed.
• Send transactional messages and, only with a valid basis and functional unsubscribe, direct marketing.

5. Processors and disclosures

Expected providers include Supabase for authentication and database hosting, Vercel for application hosting, Stripe for billing, configured AI providers for requested generation, Google services for user-authorised Search Console or analytics access, and the AI clients and integrations a user chooses. We disclose only what is reasonably needed for the selected function, security, support, or legal obligation.

We maintain and update processor, purpose, contractual-role, and overseas-recipient information as service providers and data flows change. We will not replace that information with a vague statement that data may be processed globally.

6. Overseas disclosure

Some processors or user-selected clients may process information outside Australia. SEO Dispatch assesses appropriate contractual and security measures and publishes the countries or regions reasonably likely to receive personal information. A user may also intentionally direct information to an overseas AI client they select.

7. Retention and deletion

• Account and workspace data: while active, then deleted or de-identified under the published closure schedule, subject to backups, disputes, security, and legal obligations.
• Public audit reports: 30 days; successful public-host results may be reused for up to 24 hours to reduce repeat crawling.
• MCP tool audit metadata: 90 days; rate-limit buckets: no more than 48 hours; MCP idempotency records: 7 days, unless an incident requires lawful preservation.
• Billing and legal acceptance records: retained for the period reasonably required for tax, accounting, dispute, fraud-prevention, and legal obligations. Acceptance records are immutable evidence and are not used for marketing.
• Support, security, and marketing-consent records: retained only for the documented operational, legal, or consent purpose and then deleted or de-identified.

8. Security

Controls include authenticated server boundaries, least-privilege database access, row-level security, encrypted transport, restricted service credentials, bounded inputs and outputs, rate limits, revocation, and sanitized auditing. No online service can promise absolute security. Users must protect their accounts and connected-client access and report suspected misuse promptly.

9. Access, correction, deletion and complaints

You may request access to or correction of personal information, disconnect integrations, revoke AI-client access, unsubscribe from marketing, or request account closure. We will verify identity and respond within a reasonable period, subject to lawful exceptions and records that must be retained.

Send privacy complaints to the monitored privacy contact displayed above. If a complaint is not resolved, you may contact the Office of the Australian Information Commissioner where it has jurisdiction.

10. Direct marketing

Marketing messages will identify the sender, use recorded consent or another lawful basis, and provide a functional unsubscribe method consistent with the Spam Act 2003 (Cth). Transactional and security messages may still be sent where needed to provide or protect an account.

11. Data breaches

We will maintain an incident process to contain and assess suspected breaches. Where the Notifiable Data Breaches scheme applies and an eligible data breach is identified, the operator will notify affected individuals and the OAIC as required by law.

12. Changes and contact

Material changes will be versioned and, where required, presented for renewed acceptance. Use the privacy contact displayed with the operator details above.