1. Who operates SeoAdMax
SeoAdMax is operated by Łukasz Biedroń ISU, trading as ISUdev, at ul. Opalowa 7, 55-002 Dobrzykowice, Poland, Polish tax ID (NIP): 7372152595. For privacy requests, contact hello@isudev.com.
This policy covers our public website, application dashboard and MCP service. We manage account and security data as controller. When an organization connects client accounts, it determines the purpose of processing that client data; SeoAdMax processes it to provide the requested service. Connecting an account requires authority to use and share its data.
2. Data we access and store
- Account and security: name, email, organization membership, password hashes, session records and optional authenticator/passkey credentials. We never receive your Google password. Passkeys do not disclose your biometric data to us.
- Connections: provider and client account identifiers, permission scopes, encrypted OAuth access/refresh tokens, MCP app authorizations and hashed manual access tokens.
- Connected reports: advertising campaigns, keywords, search terms, costs and conversions; Analytics traffic, events, settings and configuration history; Search Console queries, pages and indexing; Tag Manager configuration. Where connected and available, Merchant Center products and Business Profile information, performance and reviews are also read. Reports can contain names, URLs, actor emails or review content, depending on the source.
- Operations: tool/provider names, client/token identifiers, call counts, timing, status, error categories and administrative audit records. Hosting providers may also process IP addresses and request metadata in operational logs.
- Support: information you choose to send us.
Reports are fetched as requested and processed to return a result. Usage records are separate from report content; they do not constitute a stored archive of complete provider reports. Avoid putting personal or sensitive data into campaign names, URLs, search terms or support messages.
3. Purposes and permissions
We use data to authenticate users, retrieve and combine authorized reports, deliver client-scoped MCP responses, manage connections, troubleshoot the service and prevent misuse. We do not sell connected account data or use it for targeted advertising.
We request Google permissions for the enabled integrations. Some Google scopes permit writes even though our analytics tools perform reads only. The optional GA4 configuration history feature requires analytics.edit; enabling it does not add tools that modify your Analytics configuration. Availability also depends on your account role and provider API access.
For account/service administration, processing is necessary to provide the requested service. Security and operational processing serves our legitimate interest in maintaining a secure service. Optional provider access and sharing with an assistant require your authorization; where consent is the legal basis, you may withdraw it. Legal obligations may require limited records to be retained.
4. Sharing and AI assistants
Our infrastructure providers process data to operate the service: SEO Host hosts the public website, Railway runs the dashboard/MCP service, and Neon stores application data. Google and other connected providers receive the API requests needed for your reports.
When you connect an AI assistant such as ChatGPT, Codex, Claude or Cursor, the report results requested through MCP are sent to that service under the client and source permissions you approve. Such results may contain personal or commercially sensitive information. Choosing and authorizing an assistant controls this disclosure; check that service’s data handling and retention settings before connecting. SeoAdMax does not operate its models or control copies already delivered to it.
SeoAdMax does not use Google API data to train generalized AI/ML models or provide it for that purpose. Human access to Google data is limited to your specific permission, necessary security investigation, legal obligations, or permitted aggregated internal operations. SeoAdMax’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The dashboard and MCP service run on Railway in the United States (San Francisco region); the Neon database is in the United States (AWS Ohio). Data is therefore processed outside the EEA. Further destinations depend on the assistant you select. Applicable transfer safeguards must be established for the relevant service before transferring personal data; contact us for details of the arrangements applicable to your account.
5. Security and retention
Connections use HTTPS. Provider tokens are encrypted in the application before database storage, passwords are hashed, and authorization limits access by organization, client and approved source. These measures reduce risk but cannot guarantee absolute security.
Account, connection and authorization records remain while needed to operate your account or resolve an outstanding request. Disconnecting a provider deletes its stored connection tokens. Revoked MCP grants and usage/audit history can remain as operational records. Deleting a client in the panel disables it; it is not a full erasure of every related record. There is currently no automatic purge schedule for account and usage/audit records: request erasure by email for manual review and deletion where appropriate. Records may remain where required for security, legal obligations or claims, and copies in backups follow the applicable hosting provider’s retention cycle.
6. Your controls and rights
Disconnect Google in the dashboard or revoke access through Google Account connections. Manage or revoke individual assistant grants and manual tokens in MCP connections. Revocation prevents future authorized requests; it does not delete reports already held by an assistant or change data at Google.
Email hello@isudev.com to request access, correction, erasure, restriction, portability or to object to processing, where applicable. We may need to verify your identity. We aim to respond within one month and explain any permitted extension. You may complain to the competent data protection authority, including Poland’s President of the Personal Data Protection Office (UODO). We do not make decisions with legal or similarly significant effects solely through automated processing.
7. Cookies and changes
The dashboard uses necessary session/security cookies and browser storage for preferences and authentication. The public website serves local fonts and does not currently embed advertising or analytics trackers. Hosting request logs may still be generated. Third-party sites and assistants follow their own policies.
The pilot is intended for adults and professional use. We update this policy when features or data handling change, showing a new revision date. Material new uses of connected Google data require notice and renewed consent before they begin.