Privacy Policy

1.Who we are

Crispy Bebek SEO is operated by crispybebekseo (ABN 39 899 614 993), based in Brisbane, Queensland, Australia (“Crispy Bebek SEO”, “we”, “us”, “our”).

This policy explains how we handle personal information when you visit crispybebekseo.com, create an account, or use our SEO platform and the snippets you can add to your websites (together, the “Service”). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you're in the European Union, the United Kingdom or the United States, sections 14 and 15 explain the extra rights you have.

Your use of the Service is also covered by our Terms of Service.

2.Information we collect

Information you give us

• Account details — your name, email address and password. We store your password only as a one-way bcrypt hash, so nobody (including us) can read it.
• Websites you connect — each site's name and address. For WordPress sites, your WordPress username and an application password you create in WordPress for Crispy Bebek. For other sites, a verification code that links your snippet to your account. Passwords and verification codes are encrypted before they're stored.
• Your work in Crispy Bebek — projects, tracked keywords, competitors, backlinks, SEO titles, meta descriptions, keyphrases, page edits, schema and social settings, reports, AI visibility topics and white-label branding (business name, logo, colours and custom domain).
• Your clients' details — if you use client management, the client names, email addresses, websites and notes you choose to add. Please only add details you have the right to share with us.
• Messages — anything you send us by email, such as support requests.

Information from services you connect

• Your WordPress site — the pages, posts, media, site settings, theme details and SEO settings we need to show and edit your site, read through the WordPress REST API using your application password. What we can see and change is limited by your WordPress user role.
• Google Analytics and Search Console — only if you connect them. Section 5 explains exactly what we access.
• Paddle — your Paddle customer and subscription IDs, your plan, and your billing period dates and status. Paddle never sends us your card or bank details.

Information collected automatically

• Usage counts — which tools you use and how often (for example, how many audit pages or keyword searches you've used this month), so we can apply your plan's limits.
• Server logs — like most websites, our hosting provider's servers automatically record technical information such as IP addresses, browser type, the pages requested and the time of each request. These are used for security and troubleshooting.
• A sign-in token stored in your browser — see section 9.

Public web data

Our SEO tools work with publicly available information about websites — search volumes, search results, rankings, backlinks, page content and the ads shown on Google — which we gather with our own crawler and from our data provider, DataForSEO. This is information about websites and businesses rather than about you, although public web pages can sometimes include people's names.

3.Visitors to your website

If you add a Crispy Bebek snippet to your website, here's what it does with your visitors' information:

• WordPress snippet — runs on your WordPress server. When a page loads, it asks our servers for the SEO settings you saved for that page, sending only your site's key and the page's address and ID. It sends nothing about your visitors.
• Snippet for other websites — runs in your visitors' browsers. It sends us the page's address (without any query string), its title and meta description, and the page's content as it appears, so you can see and edit your pages from the dashboard. It doesn't set cookies or use browser storage, doesn't identify or track visitors, and we don't save visitors' IP addresses with your page data. (Like any web server, our hosting provider's logs record the IP address of each request, for security.)

For the snippet on other websites, you're responsible for telling your own visitors (usually in your privacy policy) that you use a third-party service to manage your site's SEO, and for only adding it to public pages — not pages that show visitors' personal information, such as account, checkout or member pages.

4.How we use information

• To provide the Service — connecting and editing your sites, running site audits, checking your keyword rankings each day, showing your reports and pushing your changes live when you ask us to.
• To manage your plan and billing — with Paddle, including applying your plan's limits.
• To keep the Service secure — protecting accounts and preventing fraud and abuse.
• To support you — answering your questions and telling you about important changes to the Service or your account.
• To improve the Service — understanding, in aggregate, which features are used.
• To meet legal obligations — such as tax and accounting requirements.

We don't sell personal information, we don't use it for advertising, and we don't send marketing emails unless you've agreed to receive them (you can unsubscribe at any time). We don't make decisions about you by automated means that have legal or similarly significant effects on you.

5.Google user data

You can choose to connect Google Analytics and Google Search Console to a site in Crispy Bebek. You sign in on Google's own page and approve each connection there. Here's exactly what that gives us access to and what we do with it.

What we access

• Google Analytics (permission: analytics.readonly — read-only) — the list of Analytics accounts and properties you can access, so you can pick the right one, and reports for the property you pick, such as visitors, sessions, page views and traffic sources. We can't change anything in your Analytics account.
• Google Search Console (permission: webmasters) — the list of sites you've verified, and search performance data for the site you pick (search queries, pages, clicks, impressions, click-through rate and average position). We use this permission's write access for one thing only: submitting your sitemap to Search Console when you click to submit it. We don't add or remove properties, users or settings.

How we use it

Only to show you your own Analytics and Search Console reports and insights inside Crispy Bebek, and to submit your sitemap when you ask. We never send your Google data to our AI provider or to any other company.

How we store it

We store the access and refresh tokens Google gives us — encrypted with AES-256 — and the property you selected. Your report data is fetched from Google each time you view it and isn't stored in our database.

How we share it

We don't sell Google user data, use it for advertising, or transfer it to anyone, except when needed for security (for example, investigating abuse), to comply with the law, or as part of a merger, acquisition or sale of our business, with your consent first. Nobody at Crispy Bebek reads your Google data unless you ask us to (for example, in a support request), or it's needed for security or to comply with the law.

AI training

We don't use Google user data to develop, improve or train artificial intelligence or machine learning models — ours or anyone else's.

Disconnecting

You can disconnect Google Analytics or Search Console from a site in Crispy Bebek at any time, which deletes the stored tokens straight away. Removing a site from Crispy Bebek deletes its Google connections too. You can also revoke our access at any time from your Google Account permissions page.

6.AI features

Some features use AI to help you: the SEO title and meta description generators, keyword suggestions, the on-page and SEO tab analyses, competitor analysis and AI-written reports. When you use one, we send the information that request needs — for example a page's title and content, your keyphrases, a domain or competitor's domain, or the figures in a report — to our AI provider, Anthropic, to generate the result.

Under Anthropic's commercial terms, information sent through its API isn't used to train its models. We only send information when you use an AI feature, and we never send your Google Analytics or Search Console data.

7.Who we share information with

We use a small number of trusted service providers to run the Service. They only receive the information they need to do their job for us.

We also share information when you direct us to (for example, sending your edits to your own website), with professional advisers such as our accountant or lawyer, with authorities when the law requires it, and with a buyer if our business is ever sold (we'd tell you first). We don't share it with anyone else.

8.Overseas disclosure

Because our service providers are based overseas, your personal information is likely to be disclosed to recipients in the United States, the United Kingdom, Estonia and Lithuania, and stored on servers in the other countries where Hostinger and Paddle operate data centres. We take reasonable steps to make sure these providers handle your information consistently with the Australian Privacy Principles, including by choosing providers bound by strong privacy and security commitments.

9.Cookies and local storage

• Our website and dashboard don't use advertising or tracking cookies, and we don't run third-party analytics or advertising tags.
• When you sign in, we keep a sign-in token in your browser's local storage so you stay signed in. It expires after 7 days.
• When you pay, Paddle's checkout may use its own cookies for payment and fraud prevention. These are covered by Paddle's privacy policy.
• When you connect a Google service, you sign in on Google's own pages, which are covered by Google's privacy policy.

10.Security

• All connections to Crispy Bebek use HTTPS. WordPress only allows application passwords over HTTPS, so connections to your WordPress site are encrypted too.
• Your account password is stored only as a bcrypt hash.
• WordPress application passwords, snippet verification codes and Google tokens are encrypted with AES-256-GCM before they're stored. The encryption key is kept outside the database, so a copy of the database on its own can't reveal them.
• These credentials are never sent back to your browser and never written to our logs.
• A WordPress application password only works for API requests — it can't be used to sign in to your WordPress dashboard — and you can revoke it at any time from your profile in WordPress.

No system is perfectly secure, but we work hard to protect your information. If a data breach is likely to cause you serious harm, we'll tell you and, where required, the Office of the Australian Information Commissioner.

11.How long we keep information

• While your account is open, we keep your information so the Service works.
• When a paid plan ends, anything above the free plan's limits (your oldest tracked keywords and connected sites) is locked. If you don't resubscribe within 30 days, locked items are permanently deleted.
• When you remove a site, we delete its stored password or verification code, its SEO settings, page data, audits and Google connections straight away.
• When you delete your account, we delete your personal information within 30 days, except anything we must keep to meet legal, tax or accounting obligations, or to resolve disputes. Copies in our hosting provider's backups are overwritten in their normal backup cycle.
• Paddle keeps transaction records under its own privacy policy.

12.Access, correction and deletion

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@crispybebekseo.com. We may need to confirm your identity first. We'll respond within 30 days, and there's no charge.

You can delete your account yourself from Settings in your dashboard. If you have a paid plan, cancel your subscription first (also in Settings) so you're not billed again.

If we can't do what you ask (for example, because the law requires us to keep certain records), we'll explain why in writing.

13.Complaints

If you think we've mishandled your personal information, please email hello@crispybebekseo.com and tell us what happened. We'll look into it and respond in writing within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. If you're in the EU or UK, you can also complain to your local data protection authority (see section 14).

14.EU and UK users

If you're in the European Union or the United Kingdom, the GDPR or UK GDPR gives you extra rights. crispybebekseo is the controller of your personal information.

Why we use your information (legal bases)

• To perform our contract with you — providing your account and the Service.
• Our legitimate interests — keeping the Service secure, preventing abuse and improving the Service. We balance these against your rights.
• Your consent — connecting Google services and receiving any marketing. You can withdraw consent at any time (for example, by disconnecting Google).
• Legal obligations — such as keeping tax records.

Your rights

You have the right to access, correct or delete your personal information, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent. To use any of these rights, email hello@crispybebekseo.com. We'll respond within one month. You can also complain to your local data protection authority — in the UK, that's the Information Commissioner's Office.

International transfers

We're based in Australia, so your information is processed in Australia and in the countries listed in section 8. Where our providers transfer personal information out of the EU or UK, they use safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses.

15.US users

We don't sell personal information, and we don't share it for cross-context behavioural advertising. Wherever you live, you can ask us to tell you what personal information we hold about you, to correct it or to delete it, as described in section 12. We won't treat you differently for using these rights.

16.Age requirement

Crispy Bebek SEO is a business tool for people aged 18 or over. We don't knowingly collect personal information from anyone under 18. If you think someone under 18 has given us their information, contact us and we'll delete it.

17.Changes to this policy

We'll update this policy when our practices change, and change the “Last updated” date at the top. If we make a significant change, we'll tell you by email or in your dashboard before it takes effect.

18.Contact us

For any question about this policy or your personal information: