In short: we collect what we need to run ArvaSEO for you, we never sell personal data or use it for advertising, Google data is used only to show you your own results, and you can ask us to see, correct, export or delete your data at any time by writing to privacy@arvaseo.com.
1. Who we are
ArvaSEO is operated by Aries Vincent Digital Solutions, 1073 Lipata, Linao, Minglanilla, Cebu 6046, Philippines (“ArvaSEO”, “we”, “us”). For the personal data described in this policy we are the data controller (in Philippine law, the personal information controller), except where section 3 explains that we act for our customers.
Our Data Protection Officer can be reached at privacy@arvaseo.com, or by post at the address above, marked “Data Protection Officer”.
2. What this policy covers
This policy covers the website arvaseo.com, the ArvaSEO app at app.arvaseo.com, our emails and our support. It applies to people who visit our website, sign up, use ArvaSEO, contact us, or receive emails sent through ArvaSEO.
3. When we act for our customers
Agencies and businesses use ArvaSEO to manage websites, sometimes for their own clients. Information they put into their workspace, such as their clients’ names, contacts and logos, the email addresses of people who receive their reports, client portal logins and details about prospects, is controlled by that customer. We process it on their behalf and only on their instructions, under our Data Processing Addendum. If your information is in someone’s ArvaSEO workspace and you have questions or requests, please contact that business; we’ll help them respond.
4. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored only as a secure hash), workspace name, role, email preferences | You, or the teammate who invited you |
| Workspace content | Websites, keywords, tasks, notes, reports, branding, clients and report recipients you add | You and your team |
| Google data | Search Console clicks, impressions, queries and pages; Google Analytics metrics for your properties; the Google account email you connect | Google, only after you connect an account (see section 6) |
| Website data | The public pages of websites you add and verify, or audit as a prospect: text, titles, links, images, speed results | Our crawler and Google PageSpeed Insights |
| AI keys and requests | Your AI provider key (stored encrypted, shown again only as its last four characters), the page text you ask about | You |
| Billing details | Plan, subscription status, invoices and amounts, the billing email, card brand and last four digits | Lemon Squeezy (we never receive full card numbers) |
| Support and enquiries | Name, email, company, your messages, the page you sent it from and your browser type | You, through the app or our contact form |
| Technical and security data | IP address, browser and device type, sign-in times, actions recorded in the workspace’s audit log, error reports | Your browser and our systems |
You don’t have to give us personal data, but we can’t create an account or provide the Service without an email address and the information needed to run it. We don’t ask for sensitive personal data, and ArvaSEO isn’t meant for children: you must be 18 or older to use it.
5. How we use it, and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account and workspace, and providing ArvaSEO’s features | Performance of our contract with you |
| Processing payments, preventing fraud, and keeping billing and tax records | Contract; legal obligation |
| Answering support tickets and enquiries | Contract; our legitimate interest in helping people who contact us |
| Sending service emails: sign-in and security messages, invitations, billing notices, support replies, and the notifications you choose | Contract; legitimate interest |
| Keeping ArvaSEO secure: detecting abuse, investigating incidents, keeping audit logs | Legitimate interest in protecting the Service and our users; legal obligation |
| Fixing errors and improving ArvaSEO, using aggregated or de-identified usage information | Legitimate interest in a reliable, better product |
| Optional website analytics, only if you accept them (see section 10) | Consent, which you can withdraw at any time |
| Complying with law and responding to lawful requests | Legal obligation |
We don’t make decisions about people based solely on automated processing that have legal or similarly significant effects. Scores in ArvaSEO, such as SEO Health, describe websites, not people.
We don’t currently send marketing emails. If we start, we’ll ask for your consent where the law requires it, and every marketing email will have an unsubscribe link.
6. Data from Google APIs
When you connect a Google account in ArvaSEO, you choose which access to grant. ArvaSEO asks only for:
- Search Console (read-only), to show your websites’ clicks, impressions, queries and pages in your dashboard, keyword pages and client reports;
- Google Analytics (read-only), to show organic traffic, conversions, e-commerce and landing pages for the properties you link;
- Google Drive, files ArvaSEO creates only (drive.file), to save Google Sheets exports you ask for. ArvaSEO can’t see any other file in your Drive;
- your basic profile (email address) to identify the connected account.
We use this data only to provide and improve the features you see in ArvaSEO. We do not sell it, transfer it to data brokers or advertising platforms, use it for advertising, or use it to determine credit-worthiness. ArvaSEO staff don’t read it unless you ask us to (for example in a support ticket), it’s needed for security, or the law requires it. Access tokens are encrypted at rest and never sent to your browser.
ArvaSEO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect a Google account at any time from the Integrations page (ArvaSEO then revokes its access at Google and deletes the stored tokens) or from your Google account permissions. Data already imported stays in your workspace so your history and reports remain complete; delete the website or ask us to delete the data if you want it removed.
7. Who we share it with
We share personal data only as needed to run ArvaSEO, and never sell or “share” it for cross-context advertising. The recipients are:
- Service providers that host and run ArvaSEO for us, under contracts that require them to protect the data and use it only for us: hosting, email delivery, encrypted backups and error monitoring. They’re listed on our subprocessors page.
- Lemon Squeezy, our payment partner and merchant of record, which handles checkout, payments, tax and invoices as an independent controller under its own privacy policy.
- Search data providers that supply keyword volumes, rankings and competitor estimates. They receive keywords, website addresses and locations, not information about you.
- Services you choose to connect: Google (as described above) and, if you add your own key, OpenAI, Anthropic or Google Gemini, which receive the page text and questions you send for AI suggestions under their own terms.
- Your workspace. Owners and admins of your workspace can see its content and the support tickets its members send; your clients see what you share in reports and the client portal.
- Authorities and others where required: to comply with law, enforce our terms, or protect the rights, safety and security of our users, the public or ArvaSEO.
- A buyer or successor, if ArvaSEO is involved in a merger, acquisition or sale of assets. We’ll tell you, and this policy continues to protect your data.
8. International transfers
We’re based in the Philippines, our servers are hosted in Kuala Lumpur, Malaysia, and some of our providers process data in other countries, including Singapore and the United States. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or another lawful safeguard. You can ask us for a copy of the relevant safeguards.
9. How long we keep it
- Account and workspace data: while your account or workspace is active. When it’s closed, we delete it within 30 days, and it leaves our backups within a further 30 days.
- Google data: while the website is in your workspace, or until you ask us to delete it.
- Backups: kept for 30 days, then deleted automatically.
- Billing records: as long as tax and accounting laws require.
- Support tickets and website enquiries: while needed to help you and for our records, and no longer than 3 years after the last message, unless you ask us to delete them sooner.
- Security and audit logs: as long as needed to protect the Service and investigate incidents, normally no longer than the life of the workspace.
10. Cookies and similar technologies
On arvaseo.com, we use no advertising or tracking cookies. We remember your cookie choice in your browser’s storage so we don’t ask again. If we add website analytics, it will run only after you accept it in the cookie notice, and you can change your mind at any time with “Cookie settings” at the bottom of every page.
In the ArvaSEO app, we use only cookies that are strictly necessary: a session cookie to keep you signed in (arvaseo-session) and a security cookie that protects your requests (XSRF-TOKEN). The app also stores interface preferences, such as light or dark mode, in your browser. These don’t require consent because the app can’t work without them, and they’re never used for advertising.
You can block or delete cookies in your browser settings, but you won’t be able to sign in to the app without the essential ones.
11. How we protect it
We use encryption in transit (HTTPS) everywhere; encrypt Google tokens and AI keys at rest; store passwords only as secure hashes; limit staff access to those who need it, with two-step verification and a tamper-resistant audit log of staff actions; keep encrypted backups; and monitor for errors and abuse. No system is perfectly secure, but we work to protect your data and will tell you and the relevant authorities about a personal data breach as the law requires.
12. Your rights
Depending on where you live, you have rights over your personal data, which you can exercise by emailing privacy@arvaseo.com. We’ll reply within one month (or sooner where the law requires), may need to confirm your identity first, and won’t charge you or treat you differently for using your rights.
Everyone
- See the personal data we hold about you, and get a copy.
- Correct it if it’s wrong. You can update most account details yourself in the app.
- Ask us to delete it, or to close your account.
- Change which emails you receive (Account → Email notifications) or unsubscribe from any notification email.
European Economic Area, United Kingdom and Switzerland
Under the GDPR and UK GDPR you also have the right to restrict or object to processing (including processing based on our legitimate interests), to data portability, to withdraw consent at any time without affecting earlier processing, and to complain to your local data protection authority. We’d appreciate the chance to help first.
Philippines
Under the Data Privacy Act of 2012 you have the rights to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, and to damages, and you can file a complaint with the National Privacy Commission.
California and other US states
If a US state privacy law such as the California Consumer Privacy Act applies, you have the right to know what personal information we collect, use and disclose (the categories are in sections 4 and 7), to delete it, to correct it, and to opt out of its sale or sharing. We don’t sell or share personal information for cross-context behavioural advertising, and we don’t knowingly collect information from anyone under 16. You may use an authorised agent to make a request.
13. Changes to this policy
We’ll update this policy when our practices or the law change. If a change is material, we’ll tell account owners by email or in the app before it takes effect, and where a change affects how we use data received from Google, we’ll ask for your consent first. The date at the top shows the latest version.
14. Contact
Data Protection Officer, Aries Vincent Digital Solutions
1073 Lipata, Linao, Minglanilla, Cebu 6046, Philippines
Email: privacy@arvaseo.com