About this notice
Ainomiq B.V. (Dutch Chamber of Commerce registration 42032616) provides Ainomiq SEO. This notice covers the product at seo.ainomiq.com. Other Ainomiq products have their own data uses and notices. For a question or a privacy request about this product, email info@ainomiq.com and mention Ainomiq SEO.
Ainomiq decides how account, service administration, billing, support and security information is used. If you provide personal data about other people for us to process on your instructions, the respective responsibilities must also be addressed in the applicable data-processing arrangements. You remain responsible for having authority to provide that information.
Information used by the product
- Account and access: your email address, account identifier, verification status, authentication and session information. Authentication is provided by Supabase.
- Trial access: your account's trial start and expiry, eligibility and audit, AI-request and ranking-check usage. These records provide the 72-hour allowance and prevent it from restarting when you sign in again. Starting a trial does not collect payment-card details or create a paid subscription.
- Website reports: submitted website names and URLs, discovered URLs, page titles and descriptions, canonical links, audit findings, bounded evidence and comparison data. Reports can contain personal information found in public page metadata, URLs or link text. The stored report is not an archive of the complete page HTML.
- Saved improvement proposals: bounded public page text and metadata, suggested changes, the analytics baseline available when the proposal was created, publication dates you record and later verification results. These are saved with your website so you can review a proposal and its history.
- Search positions: the keywords, search location, language and device settings you select, task status, observed search positions and matching URLs, measurement times and provider cost records.
- Connected Google properties: accessible property identifiers and names, web stream website URLs, property timezone and currency, used to find and connect a property matching your website. We retain the selected property details and encrypted access and refresh credentials.
- Connected Google reports: Search Console search queries, page URLs, clicks, impressions, click-through rate and average position; optional GA4 aggregate organic sessions, total users, key events and revenue, with dates and landing pages. Reports can be filtered by country and device. Landing-page URLs can include query strings; do not place personal or sensitive information in website URLs. We do not request individual visitor identifiers.
- Purchases: your selected product, plan, currency, billing period, payment and invoice references, payment status and records needed to manage access, refunds or payment disputes. Stripe collects payment details in its hosted checkout. We do not receive your complete payment-card number through the SEO application.
- Support and operations: messages you send us, technical request and error records, and records of service activity used to investigate issues, protect accounts and operate the product.
Why the information is used
- To create and authenticate your account, deliver requested audits and ranking checks, provide reports and answer service requests: to perform our agreement with you or take steps you request before an agreement.
- To administer purchases and access: to perform the service agreement. Necessary tax and accounting records are also processed to meet legal obligations.
- To prevent abuse, diagnose failures and understand whether the product is delivering its service: our legitimate interests in running a reliable and secure product, balanced against your rights. Internal reporting includes aggregate account, audit and ranking activity and separate subscription and payment records.
- To handle privacy requests and other applicable legal obligations: compliance with those obligations. Where a particular use requires consent, that consent must be requested separately; creating an account is not blanket consent to unrelated marketing.
Services involved
Service providers may process information outside the European Economic Area. Applicable protection depends on the provider, service and processing location; an EU database location does not mean that every support, email or payment operation stays in the EU. You can contact us for information about the relevant recipients and transfer arrangements.
- Ask us processes your question, recent conversation and relevant data from your own account through OpenAI to generate a requested answer. Do not send passwords or unnecessary sensitive information. We do not store conversation text in the application database; it remains in page memory until you leave or reload. The database stores request IDs, account IDs and timestamps for abuse and spending limits, removed on subsequent assistant requests after two days. Provider processing and operational logs are subject to their applicable retention terms.
- Connecting Search Console or Google Analytics is optional. Signing in with Google or starting a trial does not grant access to those reports. Each connection asks you to approve read-only Google permissions separately and choose a property matching your website. We retrieve reports for that website to display analytics, period comparisons and your change timeline. Google API requests use HTTPS. Access and refresh credentials are encrypted with AES-256-GCM on the server, and stored analytics are isolated by account and website. We do not modify your Google properties.
- When you ask an account or analytics question in Ask us, relevant data from your selected website, available reports, date range and filters may be sent to OpenAI with your question. Follow-up questions keep the selected context. Creating an improvement proposal sends bounded public page content and the relevant available analytics baseline to OpenAI. The proposal and its baseline are saved; ordinary chat messages are not saved in the application database. This does not grant OpenAI direct access to your Google account, and Google credentials are never sent to OpenAI. We do not use Google user data to train general-purpose AI models, sell it, or use it for advertising. Ainomiq SEO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- Connecting your own AI client through MCP is a separate optional action. When that client requests an analytics report or page queries, it receives the permitted data from your account, including the selected website, reporting period and source status. Google credentials are not returned. The client and its provider handle received information under their own settings and terms; disconnect the client in AI agents to stop its access.
- Supabase provides authentication, including Sign in with Google, and the application database. Vercel hosts the application and processes requests and operational logs. The section below lists every party that receives Google user data.
- Resend delivers account confirmation and recovery emails. This involves your email address, the message and the verification or recovery link.
- DataForSEO provides search-result measurements. A ranking task includes the selected keyword, search location, language and device, together with a task reference. Our current task payload does not include your account email or the website being matched.
- Stripe handles checkout, recurring billing, invoices, refunds and payment disputes. Stripe also processes some information for its own payment security and legal responsibilities.
- A website you ask us to inspect receives requests from our crawler. The audit does not use your browser's signed-in session or ask for your website administrator password.
With whom we share Google user data
Google user data means the information we receive through Google APIs when you sign in with Google or connect Google Search Console or Google Analytics: your Google account email address and profile name for sign-in, the list of properties you can access, and the read-only reports described above. We share, transfer or disclose Google user data only with the parties below, and only to provide the features you requested.
- Vercel, Inc. hosts the application and runs the server code that requests reports from Google and shows them to you. Google user data passes through Vercel's infrastructure and request logs while your request is processed.
- Supabase, Inc. provides authentication and the application database, hosted in the European Union. Encrypted access and refresh credentials, the selected property details and the imported reports are stored there, isolated by account and website. When you sign in with Google, Supabase receives your Google account email address and profile name to create and verify your account.
- OpenAI, L.L.C. receives relevant website and report context when you request an answer in Ask us or create an improvement proposal. This can include search queries, page URLs, aggregate metrics, reporting periods, filters and a recorded baseline. OpenAI never receives your Google credentials and has no direct access to your Google account.
- An AI client and its provider that you explicitly connect through MCP receive report data when that client requests our read-only analytics tools. This is separate from connecting Google to Ainomiq SEO. The data is limited to your account and the requested website and period; Google credentials are not returned.
- Nobody else. We do not sell Google user data, do not share it with advertisers or data brokers, do not use it to build advertising profiles or to train general-purpose AI models, and do not transfer it to any other third party. Ainomiq staff may access stored data only to resolve a support request you made or to investigate a security incident.
- Legal requests: we disclose Google user data to public authorities only when a valid legal obligation requires it, limited to what that obligation covers.
- Business transfer: if Ainomiq is acquired or merges, stored Google user data may be transferred to the successor under this same policy, and you will be notified before that transfer takes effect.
Browser storage
The product stores authentication session information so you can remain signed in, and stores your market preference so prices can use the currency you selected. Nomi's introduction progress and whether you skipped or completed it are stored in this browser under your account. This preference can update across tabs in the same browser; it does not follow you to another device. If storage is unavailable, progress lasts only in the current tab. Clearing browser storage can reset the introduction, but it cannot restart the trial recorded on the server. These functions are separate from marketing consent.
Keeping and removing information
Your saved websites, audit history, ranking history and improvement proposals support the reports and comparisons in your workspace. Turning off monitoring stops future scheduling; it does not delete existing reports. Trial expiry, a plan's usage period or the period for using a purchased recheck is not an automatic data-deletion deadline. Trial eligibility and usage records remain to prevent a used trial from restarting.
Google report snapshots are cached for reuse and may be refreshed while a source is connected. Scheduled maintenance removes cached snapshots whose last refresh is more than seven days old. Connection credentials, selected-property settings and any previously imported search records remain until that source, website or account is deleted. Temporary Google connection states expire after ten minutes and are removed when consumed or during maintenance.
To remove a connected source, open Analytics, Manage connections, and disconnect that source. This deletes its saved credentials and imported report cache and stops further synchronisation. Recorded change notes and saved improvement proposals, including their historical analytics baseline, remain with the website. Contact us to request removal of those saved records. Disconnecting inside Ainomiq SEO does not revoke the permission recorded in your Google Account; use the Google Account permissions link below to remove that access separately. Removing Google permission alone does not delete data already saved in Ainomiq SEO.
If you want to close your account or request deletion, contact info@ainomiq.com. Requests are handled individually, including the effect on active work, subscriptions, report access and records that must be kept for legal obligations. Cancellation of renewal, account closure and a privacy request are separate actions.
Basic accounting records are generally subject to a seven-year Dutch retention requirement; different requirements can apply to particular tax records. That requirement does not apply automatically to all website reports. Where a record must be retained despite an erasure request, the reason and the relevant category should be explained in the response.
Your choices and rights
Depending on the applicable law and the processing involved, you may ask for access, correction, deletion, restriction, a portable copy, or object to processing based on legitimate interests. You can withdraw consent for a use that depends on consent without affecting earlier lawful processing.
Send your request to info@ainomiq.com. Include enough information to identify your SEO account or the relevant report, without sending passwords, recovery links or payment-card details. We may need proportionate information to verify who is making the request. An audit CSV is a report export, not a complete response to every personal-data request.
Under the GDPR, a response is generally due within one month. Where the law permits an extension, you must be informed of the extension and its reason. You may also complain to the Dutch Autoriteit Persoonsgegevens or your competent supervisory authority.
Changes and contact
This page is dated so you can identify the version you read. Material changes to how information is used may require further notice or another appropriate step before that use begins. Contact info@ainomiq.com with questions about this notice.