Privacy
policy.

SEOVentra is an SEO operations platform built for developers, agencies, and growth teams. We help you manage URL indexing, run technical SEO audits, track AI discoverability scores, and monitor your presence across Google, Bing, and AI-powered search engines.

When we say "SEOVentra", "we", "our", or "us" in this policy, we mean the SEOVentra platform and its operators. When we say "you" or "your", we mean you — the individual or organisation using our platform.

This policy explains clearly what data we collect, why we collect it, how we use it, and what control you have over it. We've written it in plain language intentionally.

We collect data in two ways: data you give us directly, and data generated automatically when you use the platform.

Data you provide directly:

• Account information — your name and email address when you sign up, plus a password (stored as a hashed credential, never plaintext) if you choose that sign-in method instead of magic link or Google OAuth
• Organisation details — organisation name, slug, and plan tier
• Domain data — domain names and URLs you add to the platform for tracking and indexing
• Verification tokens — DNS records, HTML tags, or file contents used to verify domain ownership
• Payment information — billing name, email, and payment method (processed by Razorpay or Stripe — we never store raw card numbers)
• API keys — keys you generate for programmatic access; we store only the hashed prefix after creation
• Alert configurations — notification rules including email addresses, webhook URLs, Telegram chat IDs, or Discord endpoints you configure
• Support messages — any communication you send to our team

Data generated automatically:

• Indexing job metadata — URLs submitted, provider used (GSC/IndexNow), job status, attempt count, timestamps, and API response data from Google and Bing
• Audit data — crawled URLs, discovered issues, SEO scores, AI discoverability scores, recommendations, and associated metadata
• GSC OAuth tokens — encrypted access and refresh tokens used to operate Search Console on your behalf
• Usage metrics — event counts for URL submissions, audits, AI scores, inspections, API calls, and sitemap submissions used for quota tracking
• Session data — login sessions, device type, and IP address for authentication and security
• Log data — request logs, error traces, and worker execution logs on Cloudflare infrastructure

We use your data only to operate, improve, and support the SEOVentra platform. Specifically:

• Providing the service — processing indexing jobs, running crawls, calling Google Search Console and IndexNow APIs, generating audit reports, computing AI visibility scores, and displaying your dashboard
• Authentication — verifying your identity on login, maintaining sessions, and securing your account
• Billing and quota management — tracking usage against your plan limits, processing payments, and sending billing-related notifications
• Alerts and notifications — delivering email, webhook, Discord, or Telegram notifications when your configured events trigger
• Platform improvement — understanding which features are used most, diagnosing errors, and improving performance (using anonymised aggregate data, not profiling individual users)
• Security — detecting abuse, preventing fraud, and protecting the platform and other users
• Legal compliance — retaining records as required by applicable law or in response to valid legal requests
• Support — responding to your questions, bug reports, and account requests

We do not use your data ourselves to train AI or machine learning models. Content routed through Google's Gemini API free tier is the one exception where a third-party provider may use it to improve their own products — see Section 07 for detail. We do not build advertising profiles. We do not sell, rent, or trade your data with third parties for their commercial purposes.

Connecting Google Search Console is optional but required for GSC-based URL inspection and sitemap submission features. When you authorise SEOVentra to access your Google account, we request the following OAuth scopes:

• webmasters.readonly — to inspect URL indexing status and fetch Search Console property data
• webmasters — to submit URLs and sitemaps to your Search Console properties

We store your OAuth access token and refresh token in encrypted form using AES-256 encryption with a key stored separately from the data. Tokens are decrypted only at the moment an API call is made and are never logged or exposed in plaintext.

We access only the Search Console properties associated with domains you have explicitly added and verified in SEOVentra. We do not read search performance data, keyword data, or any other Search Console reports beyond what is required for indexing operations.

You can revoke Google access at any time from your Google Account security settings (myaccount.google.com/permissions) or by disconnecting GSC within the SEOVentra dashboard. Revocation immediately disables all GSC-dependent features for your account and invalidates stored tokens.

IndexNow is a free, open indexing protocol supported by Bing, Yandex, and other search engines. When you use IndexNow features in SEOVentra, we:

• Derive a unique IndexNow key for each of your verified domains from your domain's verification token using a one-way hash function
• Submit your URLs and sitemaps to IndexNow-compatible endpoints (Bing, api.indexnow.org, Yandex, Seznam) on your behalf
• Store the submission results for your records and retry logic

IndexNow submissions do not require you to create a Bing account. Your platform key is used as a service-level credential covering all domains you manage through SEOVentra. Bing may log the submitted URLs in accordance with their own privacy policy.

If you have a Bing Webmaster API key configured, we use it to fetch crawl statistics from Bing Webmaster Tools on your behalf. This key is stored encrypted and used only for that purpose.

SEOVentra is built entirely on Cloudflare's infrastructure. Here is where your data lives:

• Cloudflare D1 (SQLite at the edge) — primary database storing accounts, domains, jobs, audits, scores, and all structured data
• Cloudflare KV — session tokens, rate limit counters, and short-lived cache values
• Cloudflare R2 — audit report artifacts and any stored file exports
• Cloudflare Workers — serverless compute processing all API requests and background jobs

Cloudflare operates a global network. Data may be processed at edge locations around the world for performance and availability. Cloudflare's own data processing agreements and DPA apply to this infrastructure layer.

We do not operate our own data centres. We do not use AWS, Google Cloud, or Azure as primary infrastructure. All data processing occurs within Cloudflare's network.

Your data is not transferred to any other cloud provider or third-party database service. Payment data is processed by Razorpay (India) or Stripe (international) and is not stored in our systems beyond transaction metadata.

We integrate with or rely on the following third-party services to operate the platform:

• Google — for OAuth authentication and Search Console API access
• Google Analytics 4 — optional, consent-gated usage analytics; only loads if you accept it on the cookie banner (see Section 09 and our Cookie Policy)
• Razorpay — for payment processing (India); governed by Razorpay's privacy policy
• Stripe — for payment processing (international); governed by Stripe's privacy policy
• Cloudflare — for infrastructure, DNS, CDN, and compute; governed by Cloudflare's privacy policy
• Bing / Microsoft — for IndexNow URL submission; Microsoft's privacy policy applies to submitted URLs
• Yandex — for IndexNow URL submission; Yandex's privacy policy applies to submitted URLs
• Anthropic, Google (Gemini), and Groq — power content generation, keyword scoring, and audit analysis features across the platform; which provider handles a given feature can change over time. OpenAI is configured as a final fallback if the others are unavailable.

Groq and Anthropic do not use content submitted via their APIs to train their models, and do not retain it beyond serving the request. Google's Gemini API free tier — which we currently use — is the exception: per Google's own Gemini API Additional Terms of Service, content submitted through the free tier may be used by Google to improve its products and may be reviewed by human reviewers. We do not currently pay for a Gemini tier that opts out of this. See our AI Disclaimer at seoventra.com/ai-disclaimer for feature-level detail.

We select third-party services carefully and only share the minimum data required for each integration. We do not pass your personal account data (name, email, billing information) to indexing or crawling services.

SEOventra offers two separate, optional browser extensions (Chrome and Firefox), each its own install with its own store listing: SEO Assistant and Directory Submission Assist. Their permissions differ, and we describe both here rather than treating them as one product.

SEO Assistant requires broad host permissions (access to the pages you visit) because its link-health checker follows links found on the page you're auditing to check their status — those link targets are different domains discovered at audit time, which a narrower permission cannot cover in advance. Directory Submission Assist does not request broad host permissions at all — it uses activeTab, which only grants temporary access to the specific directory page you have open when you click Autofill, and nothing else. Here is exactly what that means in practice.

What the extension reads from a page you're on:

• Publicly-visible on-page SEO and social-sharing markup when you run an audit: the page URL, page title, meta description, canonical URL, hreflang tags, Open Graph tags (title, description, image URL, type), Twitter Card type, heading text (H1–H6), link URLs and anchor text, image URLs and alt attributes, JSON-LD structured data, the viewport meta tag, and the site's favicon URL. This is the complete list — every field is metadata already present in the page's own public HTML source; nothing hidden, no form values, no cookies, no logged-in-user-specific content, and nothing from any other extension or script running on the page.
• The status (working, redirecting, broken, or unverifiable) of links on an audited page, checked via a standard HEAD/GET request — we read the HTTP response status only, never the response body or content of the linked page.
• Which tab is currently active and that tab's URL — used only to keep the docked side panel showing the right page's data as you switch tabs. This stays local to your browser and is never sent to our servers.

What the extension writes, and only when you ask it to:

• Directory Submission Assist's autofill feature fills form fields on a directory's submit page using data from your own SEOVentra listing (name, tagline, description, and similar profile fields you already entered). It never reads a form's existing values, never submits the form, and never sends anything from the page back to SEOVentra — it is a one-way, local fill operation you review before clicking submit yourself.

What the extension sends to our servers:

• Your extension sign-in key (a separate credential from your dashboard password, used to identify your account to our API)
• The specific page URL and SEO markup described above, only when you actively run an audit
• Your Directory Submission Assist requests (which directories to show, your submission profile, and your own status updates like "submitted" or "live")

What the extension never does:

• It contains no third-party analytics, telemetry, or advertising SDK of any kind — we checked the entire codebase to confirm this, not just the parts we remembered writing.
• It never auto-submits any form on any website. Every directory submission requires you to open the page and click submit yourself — see our Directory Submission Assist page for why this is a deliberate product decision, not a limitation.
• It never collects browsing history, passwords, or content from pages beyond the specific SEO markup described above, and never touches password fields under any circumstance during autofill.
• It never sells or shares data collected through the extension with third parties.

You can review the extension's exact permissions before installing from the Chrome Web Store or Firefox Add-ons listing, and revoke access at any time by removing the extension from your browser.

SEOVentra uses a minimal cookie footprint. Two cookies are always set:

• A session cookie — an HttpOnly, Secure, SameSite=Strict cookie containing your encrypted session token. This is strictly necessary for authentication and is required to use the platform.
• A consent-choice cookie — remembers whether you accepted or rejected analytics cookies on the cookie banner, so we don't ask again for 12 months.

A third category is set only if you click "Accept" on the cookie banner:

• Google Analytics 4 cookies — aggregate, anonymised usage analytics (which pages get visited, roughly how many people), with IP addresses anonymised before reaching Google. These are entirely optional and off by default.

We have no advertising cookies, no third-party behavioural tracking (no Mixpanel, Segment, Hotjar, or similar), and no cross-site tracking infrastructure. Google Analytics, when accepted, does not receive your name, email, or account data from us. See our Cookie Policy at seoventra.com/cookies for exactly which cookies exist, and how to change your choice at any time via "Cookie preferences" in the footer.

Your browser's "Do Not Track" preference is respected in spirit for everything outside your own Analytics choice — we do not track you across other websites and have no cross-site tracking infrastructure.

We retain your data for as long as your account is active or as needed to provide the service. Specific retention periods:

• Audit history (audit reports, AI scores, and indexing job history) — retained per your plan's history window: 7 days on Free, 30 days on Pro Lite, 90 days on Pro, and 1 year on Business
• Usage metrics and billing records — retained for 7 years as required for financial compliance
• OAuth tokens — deleted immediately upon GSC disconnection or account deletion
• Session tokens — expire after 30 days of inactivity; deleted on logout or account deletion
• Support communications — retained for 3 years to maintain context for ongoing support

To delete your account, email hello@seoventra.com from your account's registered email address. We will verify the request and then delete your account data, keeping only what we are legally required to retain (such as billing records) for as long as applicable law requires. You may request a data export before deletion is completed.

Aggregated, anonymised statistical data (e.g. "X% of audits find missing canonical tags") may be retained indefinitely as it contains no personally identifying information.

We take security seriously and implement industry-standard protections:

• Encryption in transit — all communication between your browser and SEOVentra uses TLS 1.2 or higher
• Encryption at rest — OAuth tokens, API keys, and sensitive credentials are encrypted with AES-256 before storage
• Password hashing — for accounts that use a password, it's hashed with PBKDF2-SHA256 (256,000 iterations) and a unique random salt per account; we cannot recover your password
• API key design — API keys are shown once on creation; we store only a hashed prefix for identification
• Session security — sessions use cryptographically random tokens with HttpOnly, Secure, SameSite cookies
• Role-based access — platform access is enforced by an RBAC system with viewer, member, and admin roles
• Infrastructure security — Cloudflare's WAF, DDoS protection, and edge network provide additional hardening

No security system is perfect. If you discover a vulnerability in SEOVentra, please report it responsibly to security@seoventra.com. We commit to acknowledging reports within 48 hours and resolving critical issues within 14 days.

In the event of a data breach affecting your account, we will notify you by email within 72 hours of becoming aware of it, in compliance with applicable data protection regulations.

Depending on your location, you may have the following rights regarding your personal data:

• Right to access — request a copy of all personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your account and all associated personal data
• Right to data portability — request an export of your data in a machine-readable format (JSON)
• Right to restriction — request that we limit processing of your data in certain circumstances
• Right to object — object to processing of your data for specific purposes
• Right to withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at privacy@seoventra.com. We will respond within 30 days. We may ask you to verify your identity before processing requests.

You also have the right to lodge a complaint with your local data protection authority if you believe we have mishandled your data. We would prefer you contact us first so we can resolve the issue directly.

SEOVentra is a B2B platform built for developers, agencies, and marketing teams, and is not directed at or designed for use by children. We do not knowingly collect personal data from children.

Age thresholds differ by jurisdiction: India's Digital Personal Data Protection Act, 2023 defines a "child" as anyone under 18 and requires verifiable parental consent to process a child's data; the EU's GDPR sets the age of digital consent at 16 (or lower, per member state); the US COPPA framework applies under 13. We apply the strictest applicable standard — under 18 — across the platform rather than tracking jurisdiction-specific ages individually.

If you are a parent or guardian and believe a minor has created an account or provided personal data, contact us at privacy@seoventra.com and we will promptly investigate and delete the relevant data.

Because SEOVentra runs on Cloudflare's global edge network, your data may be processed in data centres located outside your country of residence, including outside the European Economic Area.

Cloudflare maintains Standard Contractual Clauses (SCCs) and a comprehensive Data Processing Addendum (DPA) that govern cross-border data transfers in compliance with GDPR and equivalent regulations.

If you are located in the EU or UK and have concerns about international data transfers, you may request a copy of the relevant transfer mechanisms by contacting us at privacy@seoventra.com.

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) applies to our processing of your personal data. Our legal bases for processing are:

• Contract performance — processing your account data, domain data, and indexing jobs is necessary to deliver the service you signed up for
• Legitimate interests — security monitoring, abuse prevention, and platform analytics are in our legitimate interests and do not override your rights
• Consent — where we ask for your consent (e.g. for optional email communications), you may withdraw it at any time
• Legal obligation — retention of financial records as required by law

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the right to know what personal information we collect, the right to delete it, the right to opt out of "sale" (we do not sell data), and the right to non-discrimination.

To exercise any GDPR or CCPA rights, email privacy@seoventra.com with the subject line "Privacy Rights Request".

If you are located in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 govern our processing of your personal data. Here's where things actually stand: the Data Protection Board of India was established on 13 November 2025; the Consent Manager framework becomes operational from 13 November 2026; and the Act's substantive obligations — notice, consent, breach reporting, retention, and data-principal rights — become fully binding on 13 May 2027. We're building toward that deadline now rather than waiting for it.

Your rights as a Data Principal under the DPDP Act:

• Right to access a summary of your personal data and how it's being processed
• Right to correction, completion, and updating of your personal data
• Right to erasure of your personal data once it's no longer needed for the purpose it was collected for
• Right to grievance redressal — we will acknowledge and resolve DPDP-specific grievances within 90 days
• Right to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity — email privacy@seoventra.com with the nominee's details to register a nomination
• Right to withdraw consent at any time, as easily as it was given

If we become aware of a personal data breach affecting you, we will notify the Data Protection Board of India and affected Data Principals without undue delay, describing what happened and what we're doing about it — consistent with the notification commitment in our Security section above.

Cross-border data transfer: Section 16 of the DPDP Act permits transfer of personal data to any country except ones the Central Government specifically restricts by notification. As of this policy's effective date, no country has been restricted, so our use of infrastructure and AI providers based outside India (see Sections 06–07) is permitted. We monitor for any government notification that would change this.

If you believe we've mishandled your personal data, you may also file a complaint with the Data Protection Board of India — we'd prefer the chance to resolve it directly first at privacy@seoventra.com.

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes — changes that affect how we collect, use, or share your data — we will:

• Notify you by email at the address associated with your account at least 14 days before changes take effect
• Display a prominent notice in the SEOVentra dashboard
• Update the effective date at the top of this page

Minor changes (clarifications, typo corrections, formatting) may be made without notice. The current version of this policy is always available at seoventra.com/privacy.

Continued use of SEOVentra after changes take effect constitutes your acceptance of the updated policy. If you do not agree with changes, you may delete your account before they take effect.

In accordance with the Information Technology Act 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, the name and contact details of our Grievance Officer are provided below.

Grievance Officer: Anita R. (SEOVentra / Muqira) Designation: Grievance Officer Email: support@muqira.com Address: Muqira.com, Sector-9, Mumbai, Maharashtra 400703, India Response time: We will acknowledge your grievance within 24 hours and resolve it within 30 days of receipt, as required under applicable Indian law.

If you are located in India and have a complaint or concern regarding your personal data or our privacy practices, you may contact our Grievance Officer directly at the email above. Complaints should include your name, contact information, and a clear description of the concern.

For all other privacy requests (data access, deletion, correction), see Section 12 — Your rights, or Section 16 for DPDP-specific rights.