Privacy Policy

This Privacy Policy explains how Deon SEO Reports (deonseoreports.com, the “Service”) collects, uses, stores and shares information. The Service is operated by Deon Designs, a partnership formed in British Columbia, Canada (“we”, “us”, “our”). It applies to visitors to the website, to people who sign in to the reporting system, and to people who receive reports from it.

By using the Service you agree to this Privacy Policy. If you do not agree with it, please do not use the Service.

1. Who we are

Deon SEO Reports produces monthly SEO reports for website owners and agencies. Signed-in users connect data sources for the websites they manage, review a technical audit, and generate, download and email branded reports. Deon Designs is responsible for the personal information described in this policy.

2. Information we collect

Website visitors

We do not use analytics, advertising or tracking tags on this website. Our hosting provider, Cloudflare, processes technical information such as IP address, browser type and the pages requested, in order to deliver the site, keep it secure and record errors.

Account holders

• Your name, email address and business or agency name.
• Your password, which we store only as a salted one-way hash.
• Branding you add: logo, brand colour, website address, contact email and footer text.
• A record of failed sign-in attempts (email address and count) to protect accounts from password guessing.

Client and report information

• The names and website domains of the clients you add, and any client logo you upload.
• Email addresses of report recipients that you enter.
• Technical audit results and notes, report notes, and the reports generated for each client.

Information from services you connect

• Google Analytics and Google Search Console, described in detail in section 3.
• DataForSEO: your API login and password. We send client domain names to DataForSEO to retrieve keyword rankings and backlink data.
• Google PageSpeed Insights: an optional API key. We send the client's homepage address to test its speed.
• Resend: your API key and sending address, used to email reports.

The Service also checks each client website's publicly available pages, headers and DNS records (for example robots.txt, sitemaps and security headers) for the technical audit.

When you contact us

If you email or call us, we keep the information you provide so we can respond.

3. Google user data

When you choose to connect a Google account, the Service asks Google for the following permissions. You can see them on Google's consent screen before you agree.

• Basic profile (OpenID and email address): to show which Google account is connected.
• Google Analytics, read-only (analytics.readonly): to list the GA4 properties you can access and read aggregated report metrics: sessions, users, new users, engagement, session duration, key events, traffic channels, landing pages and device categories.
• Google Search Console, read-only (webmasters.readonly): to list the sites you can access and read search performance data: clicks, impressions, click-through rate, average position, search queries, pages, devices and countries.

This data is aggregated reporting data about website traffic. The Service does not request information that identifies individual visitors to your website. Read-only access means the Service cannot change your website, your Google Analytics settings or your Search Console properties.

How we use it. We use Google user data only to provide the features you see in the Service: dashboards, the monthly reports you generate, download, share or email, and the plain-language highlights in those reports.

How we store it. Google access and refresh tokens are encrypted with AES-256-GCM before they are stored. Report metrics are cached so dashboards load quickly, and are saved inside each report you generate.

How we share it. Google user data is shown only to the signed-in users of the account that connected it, and to the people you choose to send a report to or share a report link with. We do not sell Google user data, use it for advertising, or transfer it to anyone except as needed to provide the Service (our hosting provider stores it), to comply with the law, or with your consent. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. Our staff do not read it unless you ask us to help with your account, it is needed for security purposes, or it is required by law.

Deon SEO Reports's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect Google at any time in Settings → Integrations, which deletes the stored tokens. You can also remove the Service's access from your Google account at myaccount.google.com/permissions. To have cached data and reports deleted as well, delete the client or contact us.

4. How we use information

• To provide the Service: dashboards, technical audits, report generation, PDF export, share links and scheduled emails.
• To keep accounts secure, prevent abuse and fix errors.
• To respond to questions and support requests.
• To comply with legal obligations.

We do not sell personal information, we do not use the data in your account for marketing, and we do not make automated decisions about people that have legal or similarly significant effects.

5. Service providers and sharing

We share information only with the providers that run parts of the Service, and only what each one needs:

• Cloudflare: hosting, database, file storage, and the headless browser that creates PDF reports.
• Google: sign-in for data connections, Analytics, Search Console and PageSpeed Insights.
• DataForSEO: keyword ranking and backlink data for client domains.
• Resend: delivery of report emails, including the recipient addresses and the attached report.

Each report has a private share link made of a long random code. Anyone who has the link can view that report, so share it only with people who should see it. Deleting a report disables its link.

We may also disclose information if required by law, or to protect the rights, property or safety of our users or others.

6. Where information is stored

The Service runs on Cloudflare's global network, and our service providers may store and process information outside Canada, including in the United States. When information is outside Canada it is subject to the laws of that country, and authorities there may be able to access it.

7. How long we keep information

• Account information is kept while your account is open. To close your account and delete its data, contact us.
• Client data, cached metrics, audit results and reports are kept until you delete the report or client, or close your account. Deleting a client removes its audit, cached data and reports.
• Connection credentials (Google tokens, API keys) are kept until you disconnect the integration.
• Hosting logs are kept by Cloudflare for a short period for security and troubleshooting.

8. How we protect information

• All connections use HTTPS encryption.
• Passwords are stored as salted hashes, and stored API keys and Google tokens are encrypted.
• Each account can see only its own clients and reports.
• We collect only what the Service needs, and request read-only access to Google data.
• We keep software and dependencies up to date.

9. Cookies and analytics

The Service sets one essential cookie, which keeps you signed in to the reporting system for up to 30 days. It is set only when you sign in and is not used for tracking. The public website does not use analytics, advertising or tracking cookies. Because we do not track visitors, we do not change our behaviour in response to browser “Do Not Track” signals.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• ask us to correct information that is inaccurate;
• withdraw your consent, for example by disconnecting a data source;
• ask us to delete your personal information;
• lodge a complaint with a privacy authority.

To exercise these rights, contact:

We may need to verify your identity before acting on a request. We respond to most requests within 30 days and will tell you in writing if we need more time or cannot fulfil a request, with the reason.

11. Complaints and accountability

The person named above is accountable for our privacy practices. Please send any complaint to them first; we usually respond within 30 days. If you are not satisfied with our response, residents of Canada may contact the Office of the Privacy Commissioner of Canada (1-800-282-1376), and residents of British Columbia may also contact the Office of the Information and Privacy Commissioner for British Columbia.

12. Other terms

Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect information from anyone under 18.

Other websites

The Service links to websites we do not control, such as Google and the websites in your reports. Their own privacy policies apply when you visit them.

Changes to this policy

We may update this policy. When we do, we will post the new version on this page and change the “Last updated” date. If a change materially affects how we use Google user data, we will ask for your consent where required.

Questions

For questions about this policy, email sales@deondesigns.ca.