Privacy policy
This privacy policy explains what information is collected when you use Lala SEO, why it is collected, and how it is managed. Every time-based data retention period stated below is strictly enforced by an automated scheduled job, ensuring compliance with our commitments.
What we do not do
- No tracking pixels or ad networks: We do not deploy third-party advertising scripts or tracking pixels. Google Analytics runs exclusively if you explicitly grant permission.
- Strict cookie management: We only use necessary cookies to keep you securely signed in and to remember your privacy choices. Google Analytics cookies are only set after you opt in. You are never tracked before giving consent, and you can change your preferences at any time.
- No server-side payment storage: No payment card details ever touch our servers. All transactions are securely processed directly on hosted payment pages run by Creem, our merchant of record.
- No data monetization: We never sell, rent, or share your personal data with third parties for marketing purposes.
What we store
| Data category | Purpose | Lawful basis |
|---|---|---|
| Your name | Personalising your dashboard and greetings instead of using your login ID. | Contract |
| Your website (optional) | Automatically populating the audit tool and analyzing performance changes over time. | Contract |
| Your email address | Facilitating account identification, secure sign-ins, and password resets. | Contract |
| Bcrypt password hash | Securing your login credentials. We only store an irreversible hash; we can never read or access your actual password. | Contract |
| Session IP & browser | Identifying potential session hijacking and maintaining account security. | Legitimate interest |
| Audit initiation IP | Preventing system abuse, brute-forcing, and enforcing rate limiting. | Legitimate interest |
| Target URLs & crawl results | Generating, compiling, and presenting your technical SEO report. | Contract |
| Notification email (optional) | Sending user-requested notifications or recurring crawl alerts. | Consent |
| Plan & subscription status | Managing paid tiers: which plan you are on, its price, its renewal or expiry date, and Creem's transaction references. | Contract |
How long we keep it
- Guest Audits (No Account): Deleted after 30 days. The generated report and all underlying crawled page metrics are permanently erased. If you wish to retain a report, creating an account automatically links and saves any guest audits run from your current session.
- Audit IP Records: Purged automatically after 90 days.
- Email Unsubscriptions: Requests to unsubscribe lead to deletion of the address record within a day, by our daily job, rather than retaining it as a muted or flagged entry.
- Account Closure: Deleting your account instantly triggers the collective destruction of your profile, all associated reports, crawl data, and subscription history. Transaction elements managed independently by Creem remain governed by their own corporate data retention lifecycles. If a payment is still being settled, or a paid plan cannot be cancelled, deletion waits until that is resolved, so that you are never charged for a plan you can no longer reach.
- Active Sessions: Destroyed immediately upon explicit sign-out.
Data Controller & Corporate Ownership
For the purposes of global privacy compliance frameworks—including the European Union General Data Protection Regulation (GDPR), the United Kingdom UK GDPR, and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)—the legally accountable operator and data controller for this service is Eshariom, a registered sole proprietorship operating in Ontario, Canada.
Auditing a site for someone else
If you run technical audits on a client's website rather than your own, you act as the data controller and Lala SEO functions strictly as your data processor. Our standard Data Processing Agreement (DPA) governs these terms, lists authorized subprocessors, and outlines server locations. It is fully binding and requires no physical signature.
Who else sees it
| Subprocessor / Partner | Service Provided | Data Shared |
|---|---|---|
| Fly.io | Cloud hosting infrastructure and database storage. | All account, session, and audit metrics outlined above. |
| Anthropic | AI analysis used to generate plain-English SEO explanations. | The finding code and isolated example URLs from the crawled website. Never your email, password, or profile information, and never the source code of your pages. |
| Creem | Secure billing, card verification, sales tax computation, and receipt delivery. | From Lala SEO: Your email address and a unique account reference code. From you directly (via payment form): Full billing name, country, and raw payment card criteria. |
| DataForSEO | Premium search data engine (keyword rankings, backlinks, competitive spaces, and AI search presence). | Target website URLs, keywords, or explicit competitor brand terms queried. Never your account metrics or credentials. |
| Google (PageSpeed Insights) | Optional page-speed measurements, used only when you tick PageSpeed Insights on an audit. | The address of the page being measured. Never your email, password, or account information. |
| Resend | Transactional email delivery infrastructure. | Destination email address, and the content of the message sent to it. |
| Zoho | Customer helpdesk infrastructure and support ticketing system. | Any context, names, site addresses, or metadata you willingly include in an inbound support inquiry. |
Note: Paid subscription details are managed via Creem, who acts as the
merchant of record. Purchases will reflect on your financial statements under the descriptor
CREEM.IO* rather than Lala SEO. When you pay, Creem tells us
that the payment was made, which plan it was for, and the name, email address and country you
gave them.
Reports describe other people's websites
Every generated audit report is assigned a randomized, unguessable URL token and forced to
default to a noindex indexing rule to prevent exposure in public search engine
result pages. However, anyone who possesses the direct link can read the contents. If you
audit a confidential site that you do not want public, treat the report URL as a secret.
Your rights
Under the GDPR, UK GDPR, and PIPEDA, you hold fundamental rights to access a copy of your personal data, request data corrections, or execute full data deletions.
We have automated these actions entirely. You do not need to wait for a support ticket; you can execute them directly on your account settings page:
- Export Data: Download everything we store about you instantly in a machine-readable JSON structure. (Individual audit reports can also be exported independently via their specific pages).
- Rectify Data: Change your legal name, connected website URL, or email address at any time.
- Erase Data: Delete your entire account, wiping all reports, historical logs, and subscription metadata instantly.
For all other specific data processing inquiries, please message support@lalaseo.com. We will officially address your request within 30 days. If you remain dissatisfied with our handling of your privacy, you have a right to file an official complaint with your regional regulatory entity (e.g., the Office of the Privacy Commissioner in Canada or your respective national Data Protection Authority across the UK and Europe).
Where the data lives
Our main storage clusters and operational servers are located in the United States. If you are interacting with our tools from international territories, your usage constitutes an explicit acknowledgement that your personal data will be transferred to and securely stored within the United States.
Contact
Eshariom
Ontario, Canada
support@lalaseo.com