Privacy Policy
Last updated: 02 June 2026 | OVOSeo - operated by Robert Haba, România
1. Who Is the Data Controller
Robert Haba, located in Romania, Vaslui, str. Avram Iancu, România, is the data controller for personal data collected through OVOSeo.
Contact for privacy matters: privacy[at]ovoseo.com
2. What Data We Collect
2.1 Data you provide directly
- Account data: name, email address, password (stored hashed).
- Billing data: billing name, country. We do not store full card numbers - all payment processing is handled by Stripe, which is PCI-DSS compliant.
- Support communications: messages you send us by email or in-app chat.
2.2 Data collected through Google integrations
When you connect your Google account, OVOSeo requests access to:
- Google Search Console: keyword performance, impressions, clicks, average position, page-level data for your connected websites.
- Google Analytics (GA4): sessions, active users, bounce rate, traffic source data.
- Google Business Profile (if you connect Local SEO Tracker): business name, address, review count, map pack rankings.
We access only the data necessary to provide OVOSeo features. We do not sell or share your Google data with third parties.
2.3 Data we collect automatically
- IP address (used to detect country for taxation/analytics purposes, then discarded).
- Browser type and version, operating system.
- Pages visited on ovoseo.com, time spent, click paths (via analytics cookies - see Cookie Policy).
- Error logs and performance data to maintain the service.
3. Legal Basis for Processing (GDPR)
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Name, email, password | Contract performance (Art. 6(1)(b)) |
| Processing subscription payments | Billing details, Stripe tokens | Contract performance (Art. 6(1)(b)) |
| Providing SEO analytics features | Google Search Console + Analytics data | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (receipts, password resets) | Email address | Contract performance (Art. 6(1)(b)) |
| Sending product updates and tips | Email address | Legitimate interests (Art. 6(1)(f)) - unsubscribe anytime |
| Website analytics and performance monitoring | Cookies, IP, usage data | Consent (Art. 6(1)(a)) via cookie banner |
| Complying with legal obligations | Billing records, invoices | Legal obligation (Art. 6(1)(c)) |
4. How We Use Your Data
We use your data only for the purposes described in Section 3. Specifically:
- To deliver the OVOSeo platform and its features to you.
- To generate invoices and process payments via Stripe.
- To send account-related emails (welcome, password reset, billing receipts).
- To send product-related emails and SEO tips (unsubscribe link in every email).
- To detect and prevent fraud or unauthorized access.
- To improve OVOSeo features using aggregated, anonymized usage data.
We do not sell your personal data. We do not use your data for advertising targeting.
5. Third-Party Processors
We share data with the following trusted third-party processors, strictly for the purpose of providing the Service:
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | USA (EU Standard Contractual Clauses in place) |
| Google (APIs) | Search Console & Analytics integration | USA / EU (subject to Google's DPA) |
| Evolution Hosting | Server infrastructure | Romania, EU |
| Zoho Mail | Transactional & support email delivery | EU / Global |
We maintain Data Processing Agreements (DPAs) with all processors handling EU personal data. For transfers outside the EU, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
6. Data Retention
- Account data: retained while your account is active, plus 30 days after deletion (to allow recovery).
- Billing and invoice data: retained for 10 years to comply with Romanian and EU accounting laws.
- Google integration data: retained while your account is active. Disconnecting Google removes your authorization; cached data is deleted within 30 days.
- Support communications: retained for 2 years.
- Anonymized analytics data: retained indefinitely (no personal identifiers).
7. Your Rights Under GDPR
If you are located in the EU or UK, you have the following rights regarding your personal data:
- Right of access: Request a copy of the data we hold about you.
- Right to rectification: Ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): Request deletion of your data, subject to legal retention obligations.
- Right to restriction: Ask us to pause processing of your data in certain circumstances.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interests (e.g., marketing emails).
- Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, email privacy[at]ovoseo.com. We will respond within 30 days. We may need to verify your identity before acting on a request.
8. Security
We implement appropriate technical and organizational measures to protect your data, including:
- HTTPS encryption for all data in transit.
- Encrypted storage of passwords (bcrypt).
- Access controls - restricted to authorized personnel who need data to perform operational duties.
- Regular security reviews of our infrastructure and code.
9. Children's Privacy
OVOSeo is not directed at children under 16 years of age. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Continued use of the Service after notification constitutes acceptance of the updated policy.
11. Contact
For privacy-related questions or to exercise your rights:
Robert Haba
Adresa: Vaslui, str. Avram Iancu, România
Email: privacy[at]ovoseo.com
ANSPDCP contact: www.dataprotection.ro
