Data and privacy: what's stored, how it's protected, how to delete it

This page sums up what data SEOAsist keeps, how secret keys are protected and how you can delete your data.

#What data does SEOAsist store?

Your account details (name, email, hashed password), crawl results for the public pages of the sites you add, and, if you allow it, Search Console and Analytics data. It also stores the keys of integrations you connect and logs of crawls, syncs, fixes and AI calls.

#How is my password stored?

Never as plain text. It's hashed with bcrypt, so nobody, including the SEOAsist team, can see it.

#How are my API keys and tokens protected?

Secret values are stored encrypted in the database with AES-256-GCM. That covers Google connection tokens, AI provider keys, the DataForSEO password, GitHub and Cloudflare tokens, the Site API token and other integration keys. The panel only ever shows them masked (the first and last few characters).

#How are SEOAsist API keys stored?

A key you create under Settings → API keys is shown only once, when it's created. The database keeps a hash (SHA-256), not the key itself. If you lose it, create a new one.

#Which Google permissions are requested, and why?

Search Console (performance data, sitemaps and property management), site verification (to add new properties), Analytics read and edit (GA4 data and creating new properties) and Business Profile (local SEO). Your name and email are also read for sign-in. If a permission is missing, that feature won't work; see Google permissions.

#Is my Google data used for ads or anything else?

No. Data from Google is only used to show analysis, reports and suggestions to you and the authorized members of your organization in the panel. It isn't used for advertising and isn't sold.

#Can other organizations see my data?

No. Each organization's data is kept apart from the others. Inside an organization, roles decide what people can do: Viewers can look but not change anything.

#Does the Pixel collect personal data about my visitors?

The Pixel records page views, engagement events and bot visits. Visitor IP addresses aren't stored in the clear; they're one-way hashed. Pixel events are deleted automatically after 90 days.

#What happens when I delete a site?

When you remove a site on Sites, all of its crawl and Search Console data is deleted. This can't be undone.

#How do I delete my account completely?

There's no delete-account button in the panel. Email destek@seoasist.com and your account will be deleted within 7 days. You can also revoke Google access separately under Google Account → Security → Third-party access.

#Are share links public?

Yes. Reports, SEO analysis share links and workspace weekly reports can be opened by anyone who has the link. Links contain a code that can't be guessed and are kept out of search engine indexes. When you delete a report, its shared link stops working.

#Where does my data go during AI jobs?

When you start an AI job, the content it needs is sent to the AI provider you picked: SEOAsist AI or a provider you added yourself. With your own key, that provider's data rules apply.

#Where is the data hosted?

On servers in Europe, transferred over encrypted connections (TLS).