Privacy Policy

We collect the following categories of personal data:

• Account data — email, name, hashed password, plan, role, workspace preferences.
• Payment data — processed directly by Stripe; we receive customer/subscription IDs but never see full card details.
• Product data — domains, keywords and notes you input; rank snapshots; project settings; branding assets.
• Usage data — pages visited, features used, API calls made, error logs. Collected via PostHog analytics and our own logs.
• Device data — IP address (masked in analytics), browser type, operating system, referrer URL.
• Communications — support emails and any info you share with us.

We use your data to:

• Provide, secure and improve the Service (legal basis: contract performance).
• Process payments and prevent fraud (contract + legitimate interest).
• Send transactional emails — rank alerts, password resets, billing receipts (contract).
• Send product updates and marketing — only with your consent, and you can unsubscribe from every email (consent).
• Analyse usage patterns to improve the product (legitimate interest).
• Comply with legal obligations (legal obligation).

We share the minimum required data with the following categories of processors, each bound by a Data Processing Agreement:

• Stripe — payment processing.
• Resend — transactional and marketing email delivery.
• DataForSEO — SERP ranking data (domains and keywords you look up are sent to their API).
• MongoDB Atlas — database hosting.
• PostHog — product analytics and session replay (IP masked).
• Cloudflare — DDoS protection and CDN.

We never sell your personal data. We only disclose data to law enforcement when compelled by a valid legal order or to protect our rights.

Account and project data is kept while your account is active. If you close your account, we delete personal data within 30 days, except:

• Billing records — retained 7 years for tax compliance.
• Anonymised analytics — kept indefinitely.
• Backups — purged on our regular rotation (max 90 days).

Under UK/EU GDPR and CCPA, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectify — correct inaccurate data.
• Erase — request deletion (subject to legal retention obligations).
• Restrict / object — limit or object to certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — unsubscribe from marketing and revoke consent at any time.
• Complain — lodge a complaint with your local supervisory authority (e.g. the UK ICO).

Contact us at privacy@whatkeywords.com to exercise any right. We'll respond within 30 days.

We apply industry-standard security controls:

• Passwords hashed with bcrypt; never stored in plaintext.
• HTTPS/TLS on every connection.
• JWT access tokens with a 15-minute lifetime; refresh tokens rotated regularly.
• Brute-force lockout, rate limiting and password-reset token single-use.
• Database encryption at rest and in transit; least-privilege access controls.
• Regular security audits and dependency-vulnerability monitoring.

No system is 100% secure — if we discover a breach affecting your data, we'll notify you within 72 hours as required by law.

We use a small number of essential cookies (authentication, session, security) and optional analytics cookies (PostHog). Details, categories and controls are documented in our Cookies Policy.

The Service is not directed to anyone under 16, and we don't knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we'll delete it.

Your data may be processed in the UK, EU or United States (where our processors are based). We rely on Standard Contractual Clauses and adequacy decisions to protect international transfers as required by GDPR.

We may update this Privacy Policy from time to time. If we make a material change, we'll notify you by email or in-app notice 30 days before it takes effect.

Data controller: WhatKeywords. Privacy contact: privacy@whatkeywords.com. Postal address available on request.