Privacy Policy

SEOPacket Tool
Powered by Soft Learn Hub (softlearnhub.com)

Effective Date: September 23, 2026
Last Updated: October 19, 2026

1. Introduction

This Privacy Policy explains how Soft Learn Hub ("we," "us," "our," "Company") collects, uses, discloses, and safeguards information when you use SEOPacket Tool (the "Service," "Platform," or "SEOPacket"), a Software-as-a-Service (SaaS) product for search engine optimization analysis, keyword research, site auditing, and related digital marketing functions.

By creating an account, accessing, or using SEOPacket, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use the Service.

This Privacy Policy applies to all users of SEOPacket, whether you're using the app directly or through the MCP/API integration with your own generated API key.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Display name (optional), email address, password — stored as a salted PBKDF2-SHA256 hash; we never store or can see your plaintext password.
• Wallet Top-Ups: SEOPacket has no subscription plans. You prepay into an account wallet (minimum $10 per top-up) via Gumroad, our payment processor and merchant of record. Gumroad handles your payment details directly — we never see or store your card number, only the amount paid, the email used at checkout, and Gumroad's sale reference.
• Support Communications and Feedback: Information you send us by email, or through the in-app Feedback & community window. Feedback sent from the app is stored with your account and delivered to our support team by email.
• Website/Domain Data: URLs, domains, or projects you submit to SEOPacket for analysis, tracking, or auditing.
• Connected AI Apps (MCP): When you connect an AI app such as Claude to SEOPacket, we store the app's registration (its name and the address it returns you to) and the access tokens it uses — tokens are stored only as one-way hashes, expire after an hour, and can be renewed for up to 30 days. You can disconnect an app at any time from the AI apps & API page, which ends its access immediately.
• Keywords and Campaign Data: Keyword lists, target markets, competitor URLs, and other SEO campaign inputs you enter.
• Site Scan Data: When you open a project, SEOPacket's servers fetch that website's public homepage, robots.txt, sitemap, and llms.txt to produce your free quick scan. Only publicly available pages are fetched. The same homepage check also runs once a day for each project, so we can email you if your homepage goes down, is set to noindex, or is blocked for Google (see Section 3). It doesn't run for accounts that switch site alert emails off in Settings.
• Email Preferences: Whether you asked to receive SEO tips and product updates by email, and when you gave or withdrew that consent.

2.2 Information Collected Automatically

• Usage Data: The features you use and the actions you run (for example, which checks ran and when), kept as your activity history and spend ledger.
• Device and Log Data: IP address, browser type, and error logs recorded by our hosting provider and application server for security and troubleshooting. We mask email addresses in our server logs.
• Sign-Up and Sign-In Protection: To prevent abuse of the free signup credit and brute-force sign-in attempts, we record account sign-ups, failed sign-ins and password-reset requests against a one-way, keyed hash of your IP address's network. The IP address itself is never stored in these records, and they are deleted after 30 days.
• Security and Account Events: An audit log of security-relevant events — sign-ups, wallet top-ups, refunds and chargebacks, data exports, account deletions, and any action our administrators take on an account (such as a suspension). It holds account IDs and event details, never your email address, and is kept to resolve disputes.
• Request Rate Data: Short-lived, in-memory counts of requests per IP address or API token, used only to enforce rate limits; they are never written to disk and disappear within minutes.
• Cookies and Similar Technologies: Strictly necessary cookies that keep you signed in and protect your session. The app uses no analytics, advertising, or tracking cookies or pixels; our marketing website uses optional ones only with your consent. See Section 9 (Cookies).

2.3 Information from Third Parties

• Search Engine and SEO Data Providers: Rank tracking, backlink, keyword-volume, and SERP data retrieved from DataForSEO's APIs in connection with the domains/keywords you submit.
• AI Search Visibility: When you run an AI/GEO visibility check, the prompt and target domain are sent to Perplexity AI's Agent API, which returns whether and how your site appears in its AI-generated answers.
• Sign-In Providers: If you sign in with Google or GitHub, we receive your name, email address, and a unique account identifier from that provider — no other data from your Google or GitHub account is accessed as part of sign-in. Google Sign-In requests only the openid, email, and profile scopes.
• Google Search Console: If you choose to connect a property, we receive and store read-only credentials — an access token plus a refresh token (offline access, so features like daily alerts work while you're away), both encrypted — to fetch performance data (clicks, impressions, queries, pages) and, when you click to check a page, Google's URL Inspection result for it (whether it's indexed and why) for that property on your behalf. See Section 5 for how this Google user data is specifically handled.
• Google Analytics: If you choose to connect a property, we receive and store read-only credentials (an access token and a refresh token, both encrypted) and the property's ID and name, to read that property's aggregated report figures on your behalf. See Section 5.3.
• Payment Processor: For each wallet top-up, Gumroad sends us the sale's reference, amount, currency and the email used at checkout, and later tells us if that sale is refunded or disputed. We confirm every sale directly with Gumroad before crediting your wallet.

2.4 Data on Domains You Do Not Own

If you submit a domain or URL you do not own (e.g., a competitor's site) for analysis, SEOPacket only processes publicly available SEO metadata (rankings, backlinks, on-page structure) and does not access non-public systems.

3. How We Use Your Information

We use collected information to:

1. Provide, operate, and maintain the SEOPacket Service;
2. Create and manage your account and authenticate access;
3. Process wallet top-up payments and show you your own usage/spend;
4. Generate SEO reports, audits, rank-tracking data, and analytics dashboards;
5. Personalize your experience and remember preferences;
6. Communicate with you regarding updates, security alerts, billing notices, and support;
7. Send marketing communications (SEO tips and product updates) only where you have opted in — by ticking the box at sign-up or turning it on in Settings — with an unsubscribe link in every message and a switch in Settings;
8. Send service emails you can't opt out of while you have an account, because they're part of the Service: sign-in and verification codes, a welcome message, payment confirmations and refund notices, low-balance warnings, and site audit results you requested. Daily alerts when a project's site has a critical problem are service emails too, but you can switch them off in Settings;
9. Monitor, analyze, and improve Service performance, features, and reliability;
10. Detect, investigate, and prevent fraud, abuse, and security incidents;
11. Comply with legal obligations and enforce our Terms and Conditions.

We do not sell your personal information to third parties for their own marketing purposes.

4. Legal Basis for Processing (GDPR / UK GDPR)

Where applicable (e.g., for users in the European Economic Area or United Kingdom), we process personal data under the following legal bases:

• Contractual necessity — to deliver the Service you signed up for;
• Legitimate interests — to improve, secure, and market the Service, including preventing fraud and abuse of promotional credits;
• Consent — for optional cookies, marketing emails, and specific integrations (including connecting Google Search Console or Google Analytics);
• Legal obligation — for tax, accounting, and regulatory compliance.

5. Google API Services User Data Policy Disclosure

SEOPacket's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

SEOPacket receives Google user data in three separate ways, and only when you choose to: Google Sign-In ("Continue with Google"), Google Search Console ("Connect Google Search Console") and Google Analytics ("Connect Google Analytics"). For each one, this section sets out exactly what we access, how we use it, how we store and protect it, who we share it with, how long we keep it and how you can delete it. Search Console data (Section 5.2) and Google Analytics data (Section 5.3) each have their own section.

5.1 Google Sign-In (openid, userinfo.email and userinfo.profile scopes)

• What we access: your Google account ID, your email address, whether Google has verified that address, and your name. Nothing else: no contacts, files, calendar or other Google data. The token Google issues at sign-in is used once, to read these details, and is then discarded; SEOPacket keeps no Google token for sign-in.
• How we use it: to create your SEOPacket account, to sign you in and recognise you the next time you continue with Google, to keep your account secure, and to send you the service emails described in this policy at that address. We never use it for advertising.
• How we store and protect it: in your account record in our database, on servers run by our hosting provider, Fly.io. It travels only over encrypted (HTTPS/TLS) connections and is protected by the measures in Section 8.
• Who we share it with: no one, except your email address with our email provider, Brevo, so that it can deliver the emails we send you (Section 6). We never sell it.
• How long we keep it, and deleting it: until you delete your account (Settings → Your data → Delete my account), which deletes it immediately (Section 7). You can also ask us to delete it at privacy@seopacket.com.

5.2 Google Search Console (webmasters.readonly scope, read-only)

• What we access: With your explicit, opt-in consent, SEOPacket requests read-only access (webmasters.readonly scope — and no other scope) to the Search Console properties you choose to connect. This is requested separately from sign-in, and connecting Search Console never asks for any other permission. We cannot modify, delete, or take any action on your Search Console property — we can only read the list of your properties (to find the site you connect), performance data (clicks, impressions, click-through rate, queries, pages, and position history) and, for pages you choose to check, URL Inspection results (index status, last crawl date, and the canonical URL Google selected). SEOPacket never submits indexing requests on your behalf; its "Request indexing" button opens Search Console, where you make that request yourself.
• How we use it: solely to power the Search Console features you see directly in the app — your dashboard's numbers and next actions, charts, tables, keyword opportunities, indexing checks, and reports on your own site's search performance (including client reports you choose to create) — and, once a day, to compare your last two weeks of clicks and indexed pages so we can email you if either falls sharply. Those alerts go only to you, about your own property. You can switch site alert emails off in Settings, which also stops this daily comparison. We do not use this data for any other purpose.
• How we store and protect it:
  • Your Search Console access token and refresh token are encrypted at rest (AES, with a key kept outside the database) and never displayed in plain text anywhere in the app. The refresh token gives SEOPacket offline access, so features like daily alerts work while you're away.
  • Search performance data is fetched from Google when you open a page that uses it, and kept only in the app's memory, for up to 15 minutes, so pages load quickly. It is not written to our database, except what you choose to save: URL Inspection results you run, client reports you create (a snapshot of your results), a search you save (for example as a tracked keyword), and a suggested action you mark Done or Snooze (we save its search or page address with your choice, so it stays hidden).
  • Everything travels only over encrypted (HTTPS/TLS) connections, is stored on servers run by our hosting provider, Fly.io, is visible only to your own SEOPacket account, and is protected by the measures in Section 8.
• Who we share it with: We never sell Search Console data. We share it only:
  • (a) when you direct it: a client report link you create and share; an AI app you connect over MCP and ask for this data; or, when you ask for an AI-drafted answer to a search Search Console suggested, that search's text, sent to our AI provider, Anthropic, to write the draft (under Anthropic's commercial terms, it is not used to train its models);
  • (b) with service providers, only to run the features you use: our hosting provider, Fly.io, which runs the app and its database, and our email provider, Brevo, which delivers your site alert emails (for example, your number of clicks from Google this week and last);
  • (c) to comply with applicable law; or
  • (d) as part of a merger, acquisition, or sale of assets, as described in Section 6.
• How long we keep it, and deleting it:
  • Performance data held in memory: up to 15 minutes.
  • URL Inspection results, saved searches and Done or Snoozed actions: until you delete the project or your account.
  • Client report snapshots: until the link expires (after 7, 30 or 90 days, or never, as you choose when you create it), you turn the link off, or you delete the project or your account.
  • Records of the alerts we emailed: one week, so the same alert isn't repeated.
  • Your Search Console tokens: until you disconnect, delete the project or delete your account. Deletion is immediate (see "Revoking access" below).
  • Deleting your account deletes all of it immediately and revokes SEOPacket's access at Google. You can also ask us to delete it at privacy@seopacket.com.
• Human access: We do not allow employees, contractors, or anyone else to read your Search Console data, except: (a) with your explicit consent; (b) where necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized, for internal operations.
• No advertising: We do not use Search Console data, or any information derived from it, to serve advertisements of any kind — to you or anyone else.
• No AI training: SEOPacket never uses Google user data to develop, improve or train AI or machine-learning models, whether generalized or personalized. Our AI features use it only to produce the answer you asked for.
• Revoking access: You can disconnect Search Console at any time with one click, from the Projects page in SEOPacket. Disconnecting (or deleting the project) deletes the stored tokens from our database, and also revokes SEOPacket's access at Google when nothing else in your account is still connected to Search Console or Google Analytics (both use the same Google permission grant); deleting your account always revokes it. You can also revoke it independently at any time via your Google Account's third-party access page. Disconnecting never affects any other part of the Service.

5.3 Google Analytics (analytics.readonly scope, read-only)

• What we access: With your explicit, opt-in consent ("Connect Google Analytics" on the Projects or Client reports page), SEOPacket requests read-only access (analytics.readonly scope, and no other scope) to your Google Analytics 4 data, requested separately from sign-in and from Search Console. It reads the list of Google Analytics accounts and properties your Google account can see, and their web data streams' addresses, to find the property that measures your website. For the one property you connect, it reads aggregated report figures for the last 28 days and the 28 before: visitors, new visitors, visits, engaged visits and engagement rate, key events (conversions) and revenue; visits by channel and by source (which is how it counts visits from AI assistants such as ChatGPT); the pages people land on from search engines; and visits by device type. These are totals for groups of visits: SEOPacket never reads data about an individual visitor, and it cannot change any Google Analytics setting or data.
• How we use it: solely to show your own website's Google Analytics figures to you in SEOPacket: the "Website visitors" section of the client reports you create, and the project's connection on the Projects page. We do not use this data for any other purpose.
• How we store and protect it:
  • Your Google Analytics access token and refresh token are encrypted at rest (AES, with a key kept outside the database) and never displayed in plain text anywhere in the app. We also store the connected property's ID and name.
  • Report figures are fetched from Google when you open a page that uses them or build a client report, and kept only in the app's memory for up to 15 minutes. They are not written to our database, except in a client report you create (a snapshot of your results).
  • Everything travels only over encrypted (HTTPS/TLS) connections, is stored on servers run by our hosting provider, Fly.io, is visible only to your own SEOPacket account, and is protected by the measures in Section 8.
• Who we share it with: We never sell Google Analytics data, and we never send it to our AI providers or to an AI app you connect over MCP. We share it only:
  • (a) when you direct it: a client report link you create and share, or a report file you download and send;
  • (b) with our hosting provider, Fly.io, only to run the app and its database;
  • (c) to comply with applicable law; or
  • (d) as part of a merger, acquisition, or sale of assets, as described in Section 6.
• How long we keep it, and deleting it:
  • Report figures held in memory: up to 15 minutes.
  • Client report snapshots: until the link expires (after 7, 30 or 90 days, or never, as you choose when you create it), you turn the link off, or you delete the project or your account.
  • Your Google Analytics tokens and the property's ID and name: until you disconnect, delete the project or delete your account. Deletion is immediate (see "Revoking access" below).
  • Deleting your account deletes all of it immediately and revokes SEOPacket's access at Google. You can also ask us to delete it at privacy@seopacket.com.
• Human access: We do not allow employees, contractors, or anyone else to read your Google Analytics data, except: (a) with your explicit consent; (b) where necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized, for internal operations.
• No advertising: We do not use Google Analytics data, or any information derived from it, to serve advertisements of any kind — to you or anyone else.
• No AI training: SEOPacket never uses Google Analytics data, like any Google user data, to develop, improve or train AI or machine-learning models.
• Revoking access: You can disconnect Google Analytics at any time with one click, from the Projects page in SEOPacket. Disconnecting (or deleting the project) deletes the stored tokens and the property from our database, and also revokes SEOPacket's access at Google when nothing else in your account is still connected to Google Search Console or Google Analytics (both use the same Google permission grant); deleting your account always revokes it. You can also revoke it independently at any time via your Google Account's third-party access page. Disconnecting never affects any other part of the Service.

6. How We Share Information

We share the minimum data each of the following actually needs to do its job — never for their own marketing purposes:

Every provider above is used only to deliver the specific feature you're using, never for their own marketing purposes. How paid features are charged — the provider's cost plus a platform fee, deducted from your prepaid wallet only when you run a paid action — is described in Section 5 of our Terms and Conditions.

Beyond these:

• Business Transfers: In connection with a merger, acquisition, restructuring, or sale of assets, subject to standard confidentiality protections.
• Legal Compliance: Where required by law, court order, or governmental request, or to protect the rights, property, or safety of Soft Learn Hub, our users, or the public.
• Report links you create: When you create a private link to a client report, anyone you give the link to can view that report — a snapshot of the project's results and your report branding, taken when the link was made. Links are never indexed by search engines, can expire, stop working if you turn them off, delete the project or delete your account, and record only a view count.
• With Your Consent: Any other sharing will only occur with your explicit consent.

A current list of sub-processors is available upon request at the contact details in Section 14.

7. Data Retention

We retain personal data for as long as your account remains active or as needed to provide the Service. Specific retention periods:

• Account data: Retained until you delete your account. You can do this yourself at any time in Settings → Your data → Delete my account (we email you a code to confirm it's you), or by contacting us (Section 14). Deletion is immediate: your projects and all of their SEO data, API keys, connected apps, sessions, feedback and email preferences are deleted, your Search Console access is revoked at Google, your email is removed from Brevo, and your account record is anonymized.
• Billing records: Retained as required by applicable tax and accounting laws (typically 6–7 years). This includes your wallet top-ups, the Gumroad sales that paid for them, and your spend ledger, which are kept even when a project is deleted. After account deletion they're kept in anonymized form, linked to an account record that no longer contains your name, email or sign-in details.
• Audit log: Retained for as long as the billing records it supports; it never contains your email address.
• Project/SEO data: Retained until you delete the project or your account, unless you request earlier deletion. Deleting a project from the Projects page permanently deletes its SEO data (keywords, rank history, audits, checks, scans, fixed-issue history and shared report links) immediately; any balance left on that project moves to your shared balance.
• Google Search Console and Google Analytics tokens: Retained until you disconnect the property or delete your account, whichever comes first — deletion is immediate, not just at the end of a retention window.
• Google user data: Section 5.1 (Google Sign-In), Section 5.2 (Google Search Console) and Section 5.3 (Google Analytics) set out exactly how long each kind is kept and how to delete it.
• Log/security data: Typically retained for 90–365 days for security and troubleshooting purposes.
• Site alert records: A record of which alerts we emailed about each project, kept for a week so the same alert isn't repeated, and deleted with the project.
• Sign-up and sign-in protection records: Deleted automatically after 30 days.
• Feedback messages: Retained with your account until you ask us to delete them or you delete your account.

8. Data Security

We implement industry-standard technical and organizational measures, including:

• Encryption of data in transit (TLS/SSL) and, where applicable, at rest — including your Google Search Console and Google Analytics access and refresh tokens, which are encrypted at rest;
• Role-based access controls and least-privilege principles for internal staff;
• Regular security reviews, monitoring, and vulnerability management;
• Secure password hashing (PBKDF2-SHA256, salted per account) — we never store plaintext passwords;
• Email verification via a random, single-use, expiring link sent to the address on file;
• Strict separation of data between your projects, and between accounts;
• Protection against our servers being used to reach private networks when fetching the sites you submit;
• Rate limits on every request to the Service, plus stricter limits on sign-up, sign-in and password-reset requests;
• The ability to suspend or ban an abusive account instantly across the app and API (a suspended account's API requests are refused and its connected apps are disconnected);
• Administrator access protected by a one-time code emailed at every sign-in and a 10-minute inactivity timeout, with every administrator action recorded in the audit log.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Cookies and Tracking Technologies

SEOPacket uses only strictly necessary cookies — the ones the Service can't work without:

Your browser's local storage may also remember display preferences, such as light or dark mode.

The SEOPacket app does not use analytics, advertising, retargeting, or tracking cookies or pixels. Because every cookie above is strictly necessary, no consent banner is required; you can still block or delete cookies in your browser settings, but you'll need to sign in again and the Service may not work correctly.

This section covers the app at app.seopacket.com. Our separate marketing website, seopacket.com, may set optional analytics cookies (and, for people who subscribe to our emails, one email-marketing cookie), but only after you agree to them in its cookie banner. It shows no advertising. Its Cookie Policy lists them, and its "Cookie settings" link lets you change your choice at any time. Nothing you do on the marketing website is linked to your SEOPacket account or your Google data.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), subject to legal retention requirements;
• Restrict or object to certain processing;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent at any time where processing is based on consent — including revoking Google Search Console or Google Analytics access at any time, as described in Section 5;
• Lodge a complaint with a supervisory data protection authority.

California Residents (CCPA/CPRA): You have the right to know what personal information is collected, request deletion, opt out of the "sale" or "sharing" of personal information (we do not sell personal information), and not be discriminated against for exercising these rights.

You can exercise the most common rights yourself, at any time, in Settings → Your data: Export my data downloads everything we hold about you as a ZIP of JSON files (access and portability), and Delete my account erases it (see Section 7). The marketing switch in Settings, or the unsubscribe link in any marketing email, withdraws marketing consent immediately. For anything else, contact us using the details in Section 14. We will respond within the timeframe required by applicable law.

11. International Data Transfers

SEOPacket may process and store data on servers located outside your country of residence, including in jurisdictions that may not provide the same level of data protection. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms for cross-border transfers.

12. Children's Privacy

SEOPacket is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

13. Third-Party Links and Integrations

SEOPacket may contain links to third-party websites or allow integrations with third-party services (e.g., Google Search Console, Google Analytics). We are not responsible for the privacy practices of those third parties. We encourage you to review their respective privacy policies, including the Google Privacy Policy.

The SEOPacket community group is hosted on Facebook. Joining it is optional, and anything you share there is governed by Meta's Privacy Policy, not this one.

14. Contact Us

For questions, requests, or complaints regarding this Privacy Policy or your personal data, contact:

Soft Learn Hub
Website: softlearnhub.com
Privacy and data requests: privacy@seopacket.com
General support: support@seopacket.com
Address: Islamabad, Pakistan

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify users of material changes via email or a prominent notice on the Service prior to the change taking effect. The "Last Updated" date at the top of this policy indicates the most recent revision.