What we hold, and what we do with it.

Who we are

SystemsCo builds apps for marketing teams and agencies. We run this site and the apps at app.systemsco.io.

The data controller is Chris Walker, trading as SystemsCo.

For anything on this page, including a request to see or delete what we hold about you, email privacy@systemsco.io. You can also use the contact form.

What we collect

When you get in touch

The contact form asks for your name, email address, company and your message. It goes to our inbox as an email. We keep it so we can reply and so we have a record of what was discussed. Nothing is stored in a database, and it is not used for marketing.

When you have an account

We store your email address, your password as a one-way hash, the display name and avatar colour you choose, which workspaces you belong to, and the work you create in the apps. If somebody invites you to a workspace, we store that invitation against the address it was sent to.

When you connect Google Search Console

SEO Suite works from your Google Search Console data. This is the part most worth reading closely, so it has its own section below.

Google Search Console, and what we do with it

If you connect a site, we ask Google for read-only access to Search Console. The permission we request is webmasters.readonly. We use it for one thing: to ask Google which sites you have, so you can pick the one you want to work on from a list instead of typing its name.

We record which site you picked, the Google account address that picked it, and the level of access Google says you hold on that site. We keep that as the record of who connected what.

We do not do any of the following:

• Change anything in your Search Console. The access we ask for cannot write.
• Keep a long-lived key to your Google account. The permission is used once, while you are connecting, and then it is gone. Nothing of ours can reach your Google account afterwards.
• Read your Gmail, your Drive, your calendar or anything else. We never ask for them.
• Use your Google data for advertising, or sell it, or share it with anyone not named on this page.

SystemsCo’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can withdraw our access at any time from your Google account permissions. Because we do not hold a lasting key, this mostly matters for the next time you connect a site.

Your search data

The numbers behind SEO Suite come from Search Console’s bulk export into BigQuery. There are two ways to set that up, and they differ in who holds the raw data.

• You export to us. Search Console writes your data into a dataset in our Google Cloud project. We hold it.
• We read yours. You already export to your own BigQuery and grant us read access to that one dataset. The raw export stays yours and we never copy it out.

Either way, the results we work out from it are stored in our database: your pages, their keywords, positions, impressions and clicks, the scores we calculate, and the recommendations we write. So “we never store your data” would not be true of either option, and we are not going to say it.

Search terms can contain personal data. People search their own names, their health and their employers. Google withholds the text of rare searches for that reason, but not all of them, so treat this as data about your visitors and not only about your site. If you are a customer, this is the part your own privacy notice needs to account for, and it is why we will sign a data processing agreement.

Your pages

When you ask us to analyse a page, we fetch that page the way a browser would and read its headings and text. Only pages on a site you have connected, and only ones you nominate. We identify ourselves with a code unique to your account, so you can allow us through your firewall without letting anyone else in.

Who else processes it

We use other companies to run the service. Each one only receives what it needs for its part.

• Vercel hosts the site and the apps.
• Supabase is our database and handles sign-in.
• Google Cloud holds the BigQuery datasets and runs the queries behind every number in SEO Suite.
• Resend sends our email: password resets, confirmations and workspace invitations.
• Anthropic and Google Vertex AI run the analysis that writes recommendations. Your page URLs, keywords and headings are sent to them to do it. Neither trains a model on it.
• DataForSEO fetches competitor search results, competitor page headings and search volumes. Your keywords are sent; your own data is not.

We do not sell data, and we do not share it with anyone else. If we ever add another processor, it will be named here first.

Where it is kept

In the EU. Our database is in Ireland, the BigQuery datasets we host are in the EU, and the code that serves you runs in Dublin. Some of the companies above are based in the United States and may support us from there, which we cover with the standard contractual clauses.

How long we keep it

• Your account and your work, for as long as you have an account.
• Enquiries, for two years.
• Sign-in records, for twelve months.
• A Google sign-in while you are connecting a site, for thirty minutes, then it is deleted automatically.

Close your account and we delete it, the work in your workspaces, the search data we derived, and any BigQuery dataset we host for you. Ask and we will confirm when it is done.

Cookies

Only the ones that make signing in work, plus a short-lived one that protects the Google connection while you are setting it up. There is no analytics on this site, no advertising, and no third-party tracking of any kind. That is why you have never seen a cookie banner here, and why you will not.

Your rights

Under UK and EU data protection law you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to send it somewhere else, or object to what we are doing with it. Ask, and we will answer within a month.

If we get it wrong you can complain to the Information Commissioner’s Office. We would rather you told us first, so we can put it right.

Our grounds for processing: your account and the apps, because we need them to provide what you signed up for. Enquiries and keeping the service secure, because we have a legitimate interest in replying to you and in stopping abuse.

Changes

If this changes we will update the date at the top. If a change actually affects you, we will email you rather than hope you noticed.