Privacy policy

This policy explains how C&C Digital (the “agency,” “we,” or “us”) operates this SEO Buddy installation and handles information used for client website management, SEO research, reporting, and related agency work. This installation is operated for one agency. Other agencies operating their own installations are responsible for their own notices and practices.

Information we handle

We handle team account details, client business names and websites, company assignments, business profiles, task requests, uploaded documents, generated reports, and activity records that authorized users provide or create in the portal. Passwords are stored as salted hashes; session cookies support sign-in and access controls.

If you connect Google, SEO Buddy receives your Google account identifier and verified email address, authorization tokens, the Analytics accounts/properties/web streams, Search Console sites, Google Ads manager/advertiser accounts, and Business Profile business accounts/locations that account can access when you authorize those services, and data read from the resources selected for a client. This can include website traffic and channel totals, search queries, page URLs, clicks, impressions, click-through rates, and average search position. Google sign-in happens on Google’s website; SEO Buddy does not receive your Google password.

Google permissions and purpose

The direct Google connection requests account identity and read-only Google Analytics and Search Console access. Google Ads is an optional, separate authorization using Google’s broad Ads permission; this release uses it only to read manager/advertiser identity and ad final website URLs to verify a client connection. It does not change campaigns, budgets, billing, ads, or conversions. An owner chooses the property or site for each client. We use these connections to verify client resources, display performance reports, support keyword research and content planning, and provide requested SEO analysis. Connecting a reader does not install tracking or change Google properties, site ownership, advertisements, or website content. The reporting connection does not request Gmail, Drive, Sheets, or Google account administration access. Google Ads permission is requested only when you choose to connect Ads. Business Profile is also optional and requests Google’s broad business.manage permission only when selected. SEO Buddy uses it only to read business account and location identifiers, names, addresses and website URLs, and aggregate daily performance such as impressions, website clicks, call clicks and direction requests. An owner selects a location for each client and verifies its website and performance access. This integration does not edit profiles, publish posts, read or reply to reviews.

Agency email is an optional, separate owner-authorized connection. It requests basic account identity and Gmail send permission for the installation’s configured agency mailbox, without requesting inbox-reading, mailbox-management or Google account administration permissions. Owners can compose a plain-text message, review the exact sender, recipient, subject and body, and explicitly confirm sending through Gmail. Message content is stored encrypted on this agency’s server for the review and send record, and transmitted to Google and the chosen recipient when sent. Send records and Gmail receipt identifiers are retained for work history and duplicate prevention. There is no inbox reading, automatic follow-up or automatic retry of an uncertain send. Gmail acceptance does not prove inbox delivery. Connecting this mailbox does not verify SPF, DKIM, DMARC or inbox placement. Tokens are not provided to AI services.

Your Google authorization may cover multiple resources accessible to the selected Google account. Account inventory is available to hub owners for resource selection. Team members see data through their assigned client permissions.

CallRail reporting

If an owner connects CallRail, SEO Buddy stores the API key encrypted on this agency’s server and reads accessible account/company names and identifiers so the owner can select a company for each client. The connection uses read requests only. Dashboard refreshes read aggregate inbound call counts, answered/missed counts, form submission totals when available, and source attribution for the selected company and dates. This integration does not retrieve caller names, telephone numbers, recordings, transcripts, or form field contents. Aggregate results are cached on the server and shown according to client assignments. Disconnecting a credential removes its active key and stops its client mappings; previously generated reports and backups may remain. Revoke the key in CallRail to prevent its use elsewhere.

Sharing and AI-assisted features

Client information and reports are available to authorized agency users and the recipients of reports or content they choose to share through the portal’s workflows. Hosting, communication, and configured AI services may process information as needed to provide those features. Relevant client facts, performance summaries, search evidence, and user requests may be sent to a configured AI service for requested analysis, recommendations, or content work. Google authorization tokens are not included in AI prompts.

Google-derived information is used to provide the portal’s user-facing features, not to sell personal information, create advertising audiences, determine creditworthiness, or train general-purpose AI models. Any service used to process Google data must be configured and governed consistently with these limits. We do not permit unrestricted secondary use of that data by service providers.

We may also disclose information when required by law or when necessary to investigate abuse, protect security, or enforce applicable rights. Human access to Google data is limited to the authorized user-facing workflows and the exceptions allowed by Google’s policies.

SEO Buddy’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Storage and safeguards

This installation stores operational records on the agency’s server and related backups. Direct Google authorization tokens are encrypted at rest, restricted to the service account, and transmitted over HTTPS. Access checks restrict client workflows by team assignment. These safeguards reduce risk but do not guarantee that every system or transmission is free of security incidents.

Retention and deletion

We retain account, client, task, research, and report records while needed to operate the agency workspace and maintain its work history. Disconnecting Google stops future API access through that connection and removes its active tokens from SEO Buddy; it does not automatically delete existing reports, research evidence, activity records, or copies in backups. Disconnecting only a client mapping stops that mapping while leaving the Google account available for other clients.

To request deletion of previously collected information or close a hub account, contact us using the address below. We will verify the requester’s authority and address the request, including relevant retained reports and backups, subject to legal and security retention needs. This portal does not currently provide a single-button purge of all historical client data.

Your choices

You can decline Google access, ask an owner to change client assignments, disconnect a client mapping or Google account in SEO Buddy, or revoke the application through Google Account third-party connections. Revoking access can stop reporting and research features that depend on that data. Contact us to request access to, correction of, or deletion of information associated with this installation.

Changes and contact

We will update this notice when our practices change. Material changes to Google data access or use will be disclosed before the changed use, with renewed consent where required. This portal is intended for agency business use, not as a service directed to children.

Privacy contact: carlos@candcdigital.co
Operator: C&C Digital