How We Protect Your Data & Privacy

1. Introduction

AuthoritySpecialist SEO Solutions OÜ ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

The data controller is AuthoritySpecialist SEO Solutions OÜ, a company registered in Estonia (registry code 17165573), Sepapaja tn 6, 15551 Tallinn, Estonia. Because we are established in the European Union, we apply the EU General Data Protection Regulation (GDPR) to all personal data we process, wherever you are located.

2. Information We Collect

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services
• Improve and personalize your experience
• Process your transactions and manage your account
• Send you technical notices, updates, and support messages
• Respond to your comments and questions
• Send you marketing and promotional communications (with your consent)
• Analyze usage patterns and improve our services
• Detect, prevent, and address technical issues and security threats

4. Legal Bases for Processing

Under the GDPR, we rely on the following legal bases:

• Performance of a contract — providing the services you signed up for, managing your account, and processing payments
• Legitimate interests — securing our services, preventing fraud and abuse, and understanding aggregated usage so we can improve the product
• Consent — marketing communications and non-essential cookies; you can withdraw consent at any time
• Legal obligation — accounting, tax, and other records we are required to keep under Estonian and EU law

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

• Service Providers: Third-party vendors who perform services on our behalf
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6. International Data Transfers

Some of our service providers (for example payment, hosting, analytics, and AI infrastructure providers) are located outside the European Economic Area, primarily in the United States. Where personal data is transferred outside the EEA, we rely on safeguards recognized by the GDPR: an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses.

You can request more information about the safeguards applied to a specific transfer by contacting us.

7. Data Retention

We keep personal data only as long as needed for the purposes described in this policy: account data for the life of your account and up to 30 days after deletion; billing and invoicing records for 7 years as required by Estonian accounting law; support correspondence for up to 3 years; and analytics data in aggregated or anonymized form. Specific retention periods for Google user data are described below.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure.

9. Google User Data — Access, Use, Retention & Deletion

When you choose to connect a supported Google service to your account, we access Google user data through Google OAuth only within the scopes you explicitly authorize. Supported connections may include Google Search Console, Google Analytics and, where the integration is available, Google Business Profile. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data accessed: Search Console connections provide read-only site and search-performance data for properties you own or manage. Google Analytics connections provide read-only property, measurement and reporting data. If you connect Google Business Profile, thehttps://www.googleapis.com/auth/business.managescope may allow us to access the Business Profile accounts and locations you are permitted to manage, including business details, categories, contact information, opening hours, attributes, verification status, reviews and replies, media or posts, and available performance metrics. We access only the data needed for the GBP features made available to you.

How we use it: solely to provide user-facing features you request, such as displaying search, analytics or Business Profile information in your dashboard, matching properties and locations, monitoring performance and profile health, generating reports, and carrying out an authorized user-initiated Business Profile update or review reply where that functionality is offered. Connecting a Google service does not authorize us to make unrelated changes to your Google account.

Limited use and sharing:we do not sell Google user data, use it for advertising, determine creditworthiness, or use it to train generalized or personalized AI models. We do not transfer or disclose Google user data except to service providers acting on our behalf when necessary to provide or secure the user-facing service, as permitted by Google's Limited Use requirements, or when required by law. Those providers are bound by confidentiality, security and data-processing obligations.

Storage and security: OAuth credentials are stored with access controls and encryption at rest. We use transport encryption, least-privilege access, logging and other technical and organizational safeguards appropriate to the sensitivity of Google user data.

Data retention: we retain Google user data only as long as necessary to provide the connected service. Cached Search Console, Analytics and Business Profile API data is refreshed periodically and ordinarily retained for up to 90 days. Report outputs you choose to generate are kept for the life of your account so you can access your history, unless you delete them or request deletion.

Revocation and deletion: you can revoke our access at any time by disconnecting Google from your dashboard (Settings → Data connections) or through your Google Account permissions page. When you disconnect the integration, delete your AuthoritySpecialist account, or submit a verified deletion request, we revoke or delete the associated OAuth credentials and delete the associated cached Google user data within 30 days, except where retention is required by law. You can request an export or deletion at any time from your dashboard (Privacy & data) or by contacting us.

10. Your Rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights:

• Access: Request access to your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Restriction: Request restriction of processing
• Portability: Request transfer of your data
• Objection: Object to processing of your data
• Withdraw Consent: Withdraw consent at any time

You can exercise these rights from your dashboard (Privacy & data) or by contacting us. You also have the right to lodge a complaint with your supervisory authority — in our case the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), aki.ee/en.

California residents (CCPA / CPRA)

We do not sell or share your personal information. If you are a California resident, you have the right to know what personal information we hold, to request access or deletion, and to non-discrimination for exercising these rights. Submit a request via your dashboard (Privacy & data) or by contacting us.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our website and store certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

12. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites.

13. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

15. Contact Us

If you have any questions about this Privacy Policy or want to exercise your rights, contact us at contact@authorityspecialist.com or by mail: