Privacy Policy - Seller's Bay

1. Information We Collect

We collect several types of information from and about users of our Service:

1.1 Personal Information

Account Information: When you register, we collect your name, email address, password, and other contact details.
Payment Information: Subscriptions, trials, and credit packs are billed by Stripe when a payment method is used. We store Stripe customer and subscription IDs, invoice references, and plan status. We do not store full card numbers. Cardless free trials do not require a payment method and do not auto-bill when they end. Where checkout collects a card, trial checkout may include an authorisation or verification charge shown at checkout; unless you cancel, Stripe may bill the selected plan when that trial ends.
Store Information: When you connect WooCommerce or Shopify we store store URLs and encrypted API credentials or OAuth tokens needed to import, optimise, and sync products you request.
Agency Information: Invites, roles, staff-seat usage, and campaign-share settings for staff and client-portal users you add.
Automation preferences: Opt-in flags for weekly keyword tracking, Organic Rankings, backlinks, and GEO jobs, plus related pause and last-run timestamps.

1.2 Usage Data

Product Data: Information about products you import or manage through our Service.
AI Requests: Content you submit for AI processing and the resulting outputs.
Log Data: Information about your usage of our Service, including IP address, browser type, referring pages, and timestamps.
Cookies and Similar Technologies: Information collected through cookies and similar tracking technologies.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Process transactions and manage your account
Communicate with you about your account, updates, and support
Connect WooCommerce or Shopify stores and sync product data you request
Bill subscriptions, retries, invoices, and credit packs, and send billing email
Send low-balance and scheduled-job notices (for example when credits cross remaining thresholds or an opted-in weekly job is paused)
Send service, security, and (where you have not opted out) product update messages
Process AI requests and generate the content, recommendations, or analysis requested by the user
Monitor service usage and ensure compliance with our Terms of Service
Detect, prevent, and address technical issues or fraudulent activities

2a. Legal bases, roles, and processors (GDPR)

Where GDPR or UK GDPR applies, we rely on: contract (to run your account, billing, and features you request); legitimate interests (security, fraud and chargeback prevention, service improvement, and support), balanced against your rights; legal obligation (tax, accounting, and responding to lawful requests); and consent where required (non-essential cookies, optional marketing).

For your Seller’s Bay login, billing, and usage data we are the controller. For personal data in stores, campaigns, client workspaces, or content you upload (including shoppers’ data on connected shops), you are the controller and we act as your processor only to provide the Service you request. You warrant that you have a lawful basis and any required notices or contracts to upload that data. Shopper or client access requests should be directed to you first; we will assist where the product allows.

Processors and sub-processors may include Stripe (payments and tax), hosting and email providers, OpenAI, Anthropic, Google (sign-in, Search Console, Analytics, APIs), DataForSEO or similar research vendors, and social platforms you connect. They process data under their terms and our instructions. Some processing may occur outside the EEA/UK. We use appropriate safeguards required by law (such as Standard Contractual Clauses where used by the vendor).

We do not make solely automated decisions that produce legal effects about you other than applying plan, credit, fraud, and access rules. Payment-risk scoring may be performed by Stripe. We do not sell personal data.

3. How We Share Your Information

We may share your personal information with:

Service Providers: Third-party vendors who provide services on our behalf (e.g., payment processing, hosting, analytics)
AI Partners: Prompts and outputs may be processed by providers such as OpenAI, Anthropic, and Google APIs when you use those features
Ranking and research vendors: Keyword, backlink, and similar lookups may be sent to providers such as DataForSEO
People you invite: Staff and clients see only the campaigns and modules you share
Business Partners: When necessary to provide integrated services you've requested
Legal Requirements: When required by law, to enforce our Terms, or to protect our rights, users, or the public
Business transfers: In a merger, acquisition, or asset sale, subject to this Policy

We do not sell your personal information to third parties.

4. Google User Data

Seller's Bay lets you sign in with Google and, if you choose, connect your own Google account to Marketing Reports for read-only Google Search Console reporting. This section describes how we handle Google user data for the integrations that are currently enabled.

4.1 OAuth scopes used for Search Console (Marketing Reports)

When you connect Google Search Console in Marketing Reports, Seller's Bay may request these OAuth scopes:

openid
email
profile
https://www.googleapis.com/auth/webmasters.readonly

openid, email, and profile: identify the Google account you approved during OAuth and show which Google account is connected in Seller's Bay.
webmasters.readonly: provides read-only access to the Search Console properties and reporting data available to that Google account.

Seller's Bay cannot modify your Search Console settings or data through this scope. After connecting, you select the exact Search Console property used for your reports.

4.2 Google sign-in (optional)

If you choose Sign in with Google, Seller's Bay uses your Google account identifier, name, and email address only to authenticate you and manage your Seller's Bay account. This sign-in flow does not request Search Console access.

4.3 Search Console data we may access

If you connect Google Search Console, we access read-only data for the Search Console property you select, such as:

Property identifiers (for example URL-prefix or sc-domain: properties)
Search performance metrics such as queries, pages, clicks, impressions, CTR, and average position

We do not modify your Search Console settings or data. Access is read-only.

4.4 Why we use Google data

To authenticate your Seller's Bay account when you choose Google sign-in
To display Marketing Reports you request for your selected Search Console property
To refresh those reports while your connection remains authorized

4.5 How Google OAuth tokens are stored

Search Console OAuth access and refresh tokens are stored in our database in the oauth_tokens table under the google_search provider.
Each Seller's Bay user has separate token records per connected Google service.
Access and refresh tokens are encrypted at rest using libsodium authenticated encryption and a dedicated server secret.
We do not store your Google password.

4.6 How data is separated between users

Google tokens, selected Search Console properties, and imported report data are stored and queried per Seller's Bay user account. One customer cannot access another customer's Google connection, selected property, or report data through the application.

4.7 How we do not use Google user data

We do not sell Google user data.
We do not use Google user data for advertising or ad targeting.
We do not use Google user data to build unrelated user profiles.

4.8 How to disconnect or revoke access

In Seller's Bay, open Marketing Reports Settings and click Disconnect for Google Search Console.
In your Google Account, visit Google Account permissions and remove Seller's Bay access.

4.9 Future Google integrations

Google Merchant Center integration is planned but is not currently available. Seller's Bay does not request the Merchant Center content OAuth scope while that feature is disabled.

4.10 Google API Services User Data Policy

Seller's Bay use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Other API Integrations

Our Service also integrates with:

WooCommerce and Shopify: Encrypted credentials or OAuth tokens are used only for the store actions you request.
OpenAI / Anthropic / other AI APIs: Content you submit for generation is sent to the provider you trigger. We do not use your content to train Seller’s Bay’s own models.
Stripe: Billing, invoices, tax collection where enabled, and payment-method updates. We do not store full card numbers.
DataForSEO and similar research APIs: Domain, keyword, and backlink queries you run.
Hosting: Application and database hosting in the regions we use to operate the Service.

6. Data Retention

We retain account, billing, and usage records for as long as the account is open and as required for tax, accounting, chargeback, and legal obligations. After you request deletion we keep a 30-day grace period (the subscription stays active until deletion completes). Some encrypted backups and statutory records may persist for a limited time after deletion.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information. These include:

Encryption of sensitive data at rest and in transit
Regular security assessments and updates
Access controls and authentication requirements
Secure handling of API credentials

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a personal-data breach that requires notice, we will notify the competent authority and affected users as required by law.

8. Your Privacy Rights

Depending on your location, you may have rights regarding your personal information, including:

The right to access your personal information
The right to correct inaccurate information
The right to delete your personal information
The right to restrict or object to processing
The right to data portability
The right to withdraw consent

To exercise these rights, please contact us using the information in Section 12.

Account Deletion

We offer two methods for closing your account:

Temporary Deactivation: Your account data is preserved but inaccessible until you reactivate by logging in.
Permanent Deletion: After a 30-day grace period your account is deleted. You can cancel the request during that period. The subscription remains active during the grace period and is canceled when deletion is completed.

When your account is permanently deleted, we will:

Delete all your personal information from our active databases
Archive limited information for legal and accounting purposes
Retain anonymized data that cannot be linked back to you

You can initiate account deletion from your Account Settings page. Please note that some information may persist in backup copies for a limited time after deletion.

9. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

10. International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer personal information internationally, we rely on the safeguards described in Section 2a. You remain responsible for any extra-EEA transfers you cause by connecting a store or tool hosted outside the EEA.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of our Service after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Controller: Seller’s Bay, 3 Green Street, Waterford City, Ireland, X91 NY5A
Email: privacy@sellersbay.com
Support: support@sellersbay.com

EEA/UK users may lodge a complaint with a supervisory authority (in Ireland, the Data Protection Commission) after contacting us.