Privacy policy

What DispatchSEO is

DispatchSEO is an open-source SEO manager. You can self-host it, in which case your data lives entirely in your own accounts (your Vercel deployment, your Supabase database, your Google Cloud project) and this policy applies only in the sense that the software behaves as described below. This policy primarily covers the hosted service at dispatchseo.com, operated by the DispatchSEO maintainer.

Data we collect

Account data.When you create an account we store your email address and, if you sign in with Google, the basic profile Google shares for sign-in (name, email, avatar). Sign-in itself never asks for access to your Google data - that is a separate, optional consent described below. We use your email to run your account and to send service messages such as setup and failure alerts; we don't send marketing email without your consent, and we never sell it.

Billing data. Payments are handled by Polar as merchant of record; your card details go to Polar and its payment processor, never to us. We store your plan, subscription status, and Polar customer reference so the service knows what your account includes.

Site and integration data.To run your SEO we store what you connect and what the service produces: your site's domain and repository name, tracked keywords, rank history, generated article and tool records, and the tokens you provide (such as a GitHub token) - tokens are stored encrypted (AES-256-GCM) and deleted when you disconnect them.

Google Search Console data. If you connect Search Console, DispatchSEO requests read-only access (the webmasters.readonly scope). It reads your properties list and search analytics: queries, clicks, impressions, and average positions. It cannot modify anything in your Google account. Any Google OAuth refresh token is stored encrypted (AES-256-GCM) and is deleted immediately when you disconnect. Search statistics derived from this data are stored per site to power rank tracking and reporting.

Cookies. The dashboard sets authentication cookies to keep you signed in, and a short-lived cookie may carry your typed domain from signup into setup. There are no advertising cookies.

Where it lives and who processes it

The hosted service runs on Vercel with a Supabase (Postgres) database; email alerts are delivered by Resend; payments run through Polar; keyword and ranking data comes from DataForSEO. These providers process data only to run the service. We never sell your data or share it for advertising.

Google API Services disclosure

DispatchSEO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features described above, is never used for advertising, and is never sold. No humans read it except with your permission, for security purposes, or as required by law.

Deleting your data

Disconnecting an integration on the dashboard deletes its stored token immediately. To delete your account and everything stored with it (sites, keywords, rank history, search statistics), email support@dispatchseo.com and it will be deleted within 30 days - billing records stay with Polar as merchant of record where the law requires it. You can also revoke DispatchSEO's access at any time from your Google account permissions. If you joined our old pre-launch waitlist, that email is covered by the same request.

Changes

Changes to this policy are published on this page with an updated effective date. The policy's history is visible in the public repository.