Privacy Policy

Last updated: September 25, 2026

Who we are

SEOTrack.app (seo-track.codedatda.casa) is operated by BOT-HOLDINGS, LLC, doing business as codedatda.casa (“BOT-HOLDINGS”, “we”, “us”), based in Las Vegas, Nevada, United States. We are the data controller for the personal data described here, except where this policy says that our customer is the controller. Questions and requests go to dev@codedatda.casa.

This policy covers the SEOTrack.app service: the web application at seo-track.codedatda.casa and the SEOTrack.app apps for iOS and Android, which sign in to the same account. The seotrack.app marketing website, its contact form and its support chat are covered by the policy at https://seotrack.app/privacy-policy/.

If you are a business using SEOTrack.app, you decide what goes into your workspace (domains, keywords, competitors, report recipients, imported Google data and articles). For personal data inside that workspace data we act as your processor under our Data Processing Addendum at /dpa; this policy covers the data we control ourselves, such as your account, billing and security records.

What we collect, and why

• Server and security logs. Like every website, when you visit we and the services in front of us receive your IP address, browser type, the pages you request, timestamps and referring page. Our host keeps standard access logs and our content delivery network (Cloudflare) filters traffic for attacks. We use this to run the site, keep it secure and investigate abuse.
• Accounts. If you create an account we store your email address, a hashed password and your account settings. Sign-up asks for your email address, a password and a workspace name; we do not ask for your real name. The account's display name is the workspace name you choose (or, if you leave it blank, the part of your email address before the @). Sign-in records for every workspace are kept in one shared user database; each workspace's SEO data is kept in its own separate database. The iOS and Android apps sign in to the same account and keep only a session cookie and your preferences on your device.
• Your workspace data. The domains, keywords, competitors, projects and settings you add, any images you upload (article images and product or brand reference pictures), and the results the service produces for you: rank history, search-result snapshots, AI-assistant answers and mention scores, site-audit results, reports and article drafts. It is stored in your workspace's own database and folder on our server in Las Vegas, Nevada. Uploaded images are stored as you upload them, including any location or camera details embedded in them.
• Sign-in cookies. The service sets two strictly necessary cookies: taxprep_session keeps you signed in (its name is inherited from the software this service was built on) and csrf_token protects forms against cross-site request forgery. Both last up to 30 days. The service sets no analytics or advertising cookies, and the iOS and Android apps contain no analytics or advertising SDKs.
• Search-result and keyword data. To check rankings and keyword metrics we send your keywords, domains and chosen location, language and device to DataForSEO. Today these requests run under SEOTrack.app's own DataForSEO account, not an account of yours.
• AI-provider keys and WordPress credentials. AI features use an API key that you add for the AI provider you choose. If you use article publishing, you add your WordPress site address, username and an application password. Keys and passwords are encrypted at rest in the service's single credential vault, and you can remove them at any time.
• Google Search Console and Google Analytics (optional). If you choose to connect Google, you sign in on Google's own consent screen and grant read-only access (the webmasters.readonly and analytics.readonly scopes). We store the resulting token encrypted and import search statistics (queries, pages, clicks, impressions, click-through rate and position) and Analytics traffic figures for the sites in your projects. SEOTrack.app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use it only to show it to you in your workspace, we do not use it for advertising, we do not sell it, we do not use it to train AI models, and people on our team read it only with your permission, for security, or where the law requires. You can revoke access at any time at myaccount.google.com/permissions.
• Billing. Subscriptions are paid through PayPal. To set up the subscription we give PayPal your email address and workspace name. We receive and keep the PayPal subscription ID and an invoice history (date, amount, plan and whether a payment succeeded, failed or was refunded). PayPal processes the payment itself; we never receive your card or bank details. No purchases happen inside the iOS or Android apps; on iPhone the app can open our website so you can subscribe there.
• Service emails and reports. We email you about your account: a welcome message, receipts, payment-problem notices and password-reset links. If you turn on rank reports, we email them to the recipient addresses saved in Settings. That field starts empty; reports are only sent to the addresses you enter.
• Account activity records. We record account events such as sign-up, payments, cancellation and deletion, with the time, so we can run billing and investigate problems. These records are kept after a workspace is erased.
• Where our team works. Our team works from Las Vegas and Hong Kong, so the people who support you and run the service, and the devices they use to do it, may be outside the United States.

We do not collect more than we list here, we do not buy data about you from data brokers, and we do not sell your personal data.

How we use AI

Some of what this service does is generated by machine-learning models run by a third-party provider. Specifically:

• AI Visibility sends the prompts you set up, which usually name your brand, products or competitors, to the AI models you turn on, several times each, and a second model scores each answer for mentions and citations
• the article generator sends your keywords, chosen topic and instructions to an AI model to draft articles; if you ask for images, it sends image prompts and any product or brand reference pictures you uploaded to OpenAI's image model, and images you upload for an article are sent to an AI model that writes their alt text

We use OpenAI (OpenAI, L.L.C.), Anthropic (Anthropic, PBC) for this. We send them only what is needed to answer the request. Where the provider is one we contract with, its API terms say the content we send is not used to train its models; where you bring your own provider account, that provider's terms apply. We do not use your content to train models. Generated text can be wrong, incomplete or out of date; treat it as a draft, not as professional, legal, medical or financial advice. A person on our team may read a conversation or output to help you or to check quality.

Where you connect your own AI provider account (your own API key), that provider processes your data under the terms between you and them, and its charges are billed to you by them.

For your workspace these AI requests run on the API key you add for the provider you choose, unless we have agreed with you to run them on our own keys. Article images are always generated with OpenAI's image model, so image features need an OpenAI key. Besides OpenAI and Anthropic you can choose another OpenAI-compatible provider (for example Perplexity or Mistral); its own terms then decide whether it keeps or trains on your requests and in which country it processes them.

Legal bases (EU, UK and similar laws)

• Contract: to provide what you asked for, such as answering a message, fulfilling an order or running your account.
• Legitimate interests: keeping the site secure, preventing fraud and abuse, understanding aggregate use of the site, and running our business, balanced against your rights.
• Consent: any optional field you choose to fill in, and any optional feature you switch on. You can withdraw consent at any time; it does not affect processing that already happened.
• Legal obligation: tax, accounting and responding to lawful requests.

Cookies and similar technologies

This site sets no tracking cookies. It may set strictly necessary cookies (for example a Cloudflare security cookie such as cf_clearance or __cf_bm, or a sign-in session cookie) that do not track you across sites and need no consent.

Our site does not currently respond to Do Not Track or Global Privacy Control browser signals; use your browser settings instead.

Who we share it with

We share personal data only with the service providers that help us run this site and deliver what you asked for. Each is a separate company that processes it under its own terms, which include data-protection commitments:

We also disclose data when the law requires it (for example a valid court order), to protect our rights, safety or property or those of others, and, if our business is sold or reorganized, to the successor under this same policy. We do not sell personal data and we do not share it for cross-context behavioral advertising.

International transfers

We are based in the United States and our providers are mostly US companies, so your data is processed mainly in the United States. Our team also administers our sites and services from Hong Kong, and working copies of some production data are kept on our administrators' workstations there. If you are in the EU, UK or Switzerland, transfers rely on the providers' EU Standard Contractual Clauses or Data Privacy Framework certification, plus the security measures below. You can ask us for details of the safeguard that applies.

How long we keep it

• Server logs: the application's own log is rotated at 5 MB and the five most recent files are kept; Cloudflare keeps request logs only briefly.
• Accounts: if the workspace owner deletes the account in the app, sign-in is disabled at once and the workspace database and your stored AI-provider API keys are erased 30 days later (the gap lets us undo an accidental deletion). If a subscription is canceled or a payment fails and is not resolved, the workspace is archived 90 days later and erased 30 days after that. If you start sign-up but never approve the subscription at PayPal, the account and its empty workspace stay until you or we delete them; email us and we will. When a workspace is erased, the sign-in record (email address and password hash) is deactivated rather than deleted; email us and we will delete it.
• Invoice history: kept after an account is deleted, as accounting law requires.
• Account activity records: kept for as long as we run the service.
• Recovery snapshots: before software updates we copy the service's databases and credential vault to computers held by our operations team, which may be outside the United States; data from a deleted workspace can remain in those snapshots until the snapshot is deleted.

Security, and what happens if something goes wrong

We protect personal data with encryption in transit (HTTPS), Cloudflare's edge network in front of the site, which blocks known attack traffic, uptime and health monitoring of our servers, passwords stored only as Argon2id hashes, CSRF protection, a Content-Security-Policy and HSTS on the web app, and per-IP rate limits, with tighter limits on sign-in and password reset. No system is perfectly secure, so we also plan for failure: if we learn of a security incident that affects your personal data, we will investigate, contain it, and notify you and any regulator we are required to notify without undue delay and within the time the applicable law sets (72 hours to the supervisory authority under the GDPR).

If you believe you have found a security problem in this site or any of our services, please tell us at dev@codedatda.casa before you tell anyone else. We will not pursue good-faith researchers who report responsibly and do not access, change or destroy other people's data.

Your rights

Wherever you live, you can ask us what personal data we hold about you, ask us to correct or delete it, ask for a copy in a portable format, object to or restrict how we use it, and withdraw any consent you gave. If you are in the EU, UK or Switzerland these are your rights under the GDPR and UK GDPR, and you may also complain to your data protection authority. If you are a California resident, the CCPA/CPRA gives you the rights to know, delete, correct, and to opt out of sale or sharing (we do not sell personal data and we do not share it for cross-context behavioral advertising), and we will not treat you differently for exercising them; residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other US states with privacy laws have similar rights, including the right to appeal a decision we make about your request.

To exercise any of these, email dev@codedatda.casa from the address you used with us, or tell us enough for us to find and verify your record. An authorized agent may act for you if they show us your written permission. We answer within 30 days (45 for California requests, extendable once) and we do not charge for this unless a request is clearly excessive.

Children

This site is not directed to children and we do not knowingly collect personal data from anyone under 13 (or under 16 in the EU). If you believe a child has given us data, contact us and we will delete it.

Links to other sites

Links to sites we do not run (including app stores, GitHub, payment processors and social networks) are covered by those sites' own policies.

Changes

When we change this policy we update the date at the top and, for material changes, post a notice on the site or email registered users. Earlier versions are available on request.

Contact

BOT-HOLDINGS, LLC, doing business as codedatda.casa
Las Vegas, Nevada, United States
dev@codedatda.casa