Privacy Policy

Account information. Names, email addresses and login credentials for agency team members and invited client users, used solely to operate their accounts.

Client business information. Business names, websites, services, locations and contact details for the businesses we act for, used to deliver the services they have engaged us for.

Website access credentials. Where a client asks us to manage their website, we store the access credentials they provide. They are held securely, used only to deliver the agreed services, and removed when the engagement ends.

Google data. Where a client connects Google Search Console or Google Analytics (for example via Google Site Kit on their website), we read their search and traffic statistics to report on and improve their visibility. We access only the client’s own data, read-only, and do not use it for any other purpose.

Facebook and Instagram data. Where a client connects their Facebook Page or Instagram business account, Meta provides us with access tokens, the Page/account name and identifiers. We use these solely to publish content the client has approved to their own Page or account, and to read basic engagement on that content. We do not read private messages, friend lists or personal profiles, and we do not post anything without a review step.

Public reviews. We may collect publicly available customer reviews of a client’s business (for example from Google or Trustpilot) to help them respond and to feature selected reviews, with their approval, in their marketing.

Enquiries. If you use our enquiry form or free SEO checker, we collect the details you submit (such as name, email and website address) to respond to you. We do not add you to marketing lists without your consent.

Cookies. We use only the cookies needed to keep you signed in. We do not run third-party advertising or tracking cookies on this site.

We never sell personal data. We share data only with the service providers needed to run the platform — hosting infrastructure, our database provider, and the Google and Meta APIs described above — each acting under their own security and data-processing terms. Content we publish on a client’s behalf (blog posts, social posts) is, by its nature, public.

We keep client data for as long as the client relationship is active and for a reasonable period afterwards for record-keeping, then delete it. Connected-account tokens (Google, Meta) are removed when the connection is disconnected or the engagement ends. See data deletion for how to request removal at any time.

Data is stored on access-controlled infrastructure in encrypted form where appropriate, with role-based access inside the platform so client users can only see their own business’s data.

Under UK GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, or object to our processing of it. Contact us via the enquiry form and we will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

If we make material changes to this policy we will update this page and the date above.