Privacy Policy

1. Introduction

In plain terms: we describe the data used to run your account and our AI agents, the recipients we share it with, and how to request access, export, correction, objection, or deletion. The sections below set out the detail.

ATLIO INFORMATION TECHNOLOGY L.L.C S.O.C, a Dubai mainland company, licence 1594473 (Dubai DET/DED), supplies SearchChamp. We act as controller for account administration, billing and our own security and marketing purposes, and as processor where we handle customer-submitted data on a customer’s instructions, as described in the DPA. Our parent company is ATLIO LIMITED, registered in New Zealand. Parent ownership does not itself mean that the parent receives or processes customer data. Existing agreements and historical processing roles require their own assessment; this draft does not retrospectively substitute a party. The UAE PDPL and other applicable privacy laws, including EU/UK GDPR where applicable, inform this policy. Our control reviews are ongoing; this policy does not by itself establish legal compliance.

This Privacy Policy explains how we collect, use, share, and safeguard your personal data when you access or use our platform, websites, and services. By creating an account or continuing to use SearchChamp, you acknowledge that you have read and understood this policy.

2. Data we collect

We collect the following categories of personal data:

2.1 Data you provide directly

• Account data: name, email address, company name, and job title when you register.
• Payment data: billing address and payment method details processed by Stripe. We never store raw card numbers on our servers.
• Connected platform credentials: credentials you authorise for the website and commerce platforms you connect, such as WordPress Application Passwords, Shopify OAuth tokens, and equivalent credentials for the other platforms we support. These are stored encrypted, used only to perform the actions you request (for example publishing content or applying fixes), and can be revoked at the connected service or disconnected in the app.
• Connected email account (optional): if you connect a Gmail or Outlook account for link outreach, we store the OAuth tokens you authorise, encrypted, in AWS Secrets Manager. By default we request sending access and your basic profile. If you separately opt in to bounce detection, we also request mailbox read access. That feature retrieves candidate messages, including raw message contents, to classify delivery failures; candidates may contain information beyond an eventual bounce classification. Read access is optional and distinct from permission to send.
• Other optional connections: a Slack token and channel selection if you connect Slack for notifications, and a scoped Cloudflare API token if you connect Cloudflare for bot-access verification. Both are stored encrypted and can be disconnected at any time.
• Outreach contacts: names, email addresses, and domains of link-building prospects that you add or that the platform finds from public sources for your campaigns. Outreach messages are drafted for your review, and sending is always initiated by you.
• Support communications: messages, attachments, and metadata when you contact our support team.
• Free-tool submissions: the email address you enter and the inputs you submit (for example the domain, competitor domain, or keyword you want analysed) when you request a report from one of our free tools at searchchamp.com. You do not need an account to use these tools.

2.2 Data collected automatically

• Usage data: pages visited, features used, agent jobs initiated, keyword searches run, and timestamps of those actions.
• Device and browser data: IP address, user-agent string, browser type and version, operating system, referrer URL, and screen resolution. Where you submit a request to one of our free tools, the IP address that submission came from is also stored on the submission record itself; see section 7 for what we keep and for how long.
• Abuse-prevention signals: submissions to our free public tools are screened by Google reCAPTCHA, which processes device and usage signals, including your IP address, to distinguish people from automated abuse.
• Performance data: error traces, API response times, and crash reports collected via server-side logging.

2.3 Data from third-party integrations

• Google Search Console and Google Analytics 4: search query data, click data, and audience metrics you authorise us to read on your behalf.
• Google Ads reporting: account, campaign and keyword reporting data retrieved through the connector you authorise. Google Tag Manager account permissions and tag/container data paths remain unverified in this review.
• DataForSEO: keyword volume, SERP data, and backlink metrics retrieved using your search inputs.

3. How we use your data

We use your personal data to:

• Provide, operate, and improve the SearchChamp platform and its AI agents (including Keyword Research, Content Writer, Site Auditor, AI Visibility Tracker, GTM Assistant, GA4 Insights, and llms.txt Generator).
• Process payments, issue invoices, and manage subscriptions.
• Send necessary account, security and billing messages, and deliver reports or notifications you request. Optional promotional messages require the applicable marketing permission and include opt-out controls. Unsubscribing from marketing does not prevent necessary contractual or security notices. Lifecycle messages are reviewed by their purpose and content, not merely by their template label.
• Run AI agent jobs and chat requests on your behalf using the AI model providers listed in section 5. Data submitted to these models is processed as described there.
• Send link-outreach emails from your connected email account at your direction, and deliver notifications to your connected Slack channel, where you have set these up.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with applicable legal obligations, including relevant UAE requirements.
• Analyse how the platform is used to understand feature adoption and improve our product, using aggregated or pseudonymised data wherever possible.

4. Legal basis for processing

Where the GDPR applies to our processing of your data (for example, where you are based in the European Economic Area or the United Kingdom), we rely on the following legal bases:

• Contract performance (Art. 6(1)(b)): processing necessary to provide the services you have signed up for, including account management, AI agent execution, and payment processing.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, product analytics, and customer support. We balance these interests against your rights before relying on this basis.
• Consent (Art. 6(1)(a)): marketing emails, and the optional analytics and advertising cookies used on our public marketing pages. Those cookies are set only after you accept them in our consent banner; the default in every region is denied (see our Cookie Policy). You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): retaining invoices and billing records as required by UAE commercial law.

The legal basis is assessed under the law applicable to each processing activity. Under the UAE PDPL, consent or an applicable statutory exception is required; the GDPR concept of legitimate interests is not assumed to be a general UAE exception. Optional cookie consent, marketing permission and contractual acceptance are separate choices. New purposes requiring consent require a fresh choice.

5. Data sharing and sub-processors

We do not exchange personal data for money. With the relevant consent, advertising recipients may receive identifiers and conversion information; some laws treat this as sharing or a sale even without payment. See section 10 and our Cookie Policy for choices. Other recipients and purposes include:

• Infrastructure: Amazon Web Services (AWS) eu-west-1 region hosts our application servers, RDS database, and object storage. The AWS standard service terms include a DPA; the applicable contracting entity, account terms and transfer annexes must be established for each processing arrangement.
• AI model providers: Anthropic (Claude API), OpenAI, and Google (Gemini API) process the content and instructions you submit to AI agent jobs, chat requests, and image generation. Some AI tasks are routed through OpenRouter, a gateway that dispatches requests to a fixed allowlist of model hosts; every such request is sent with training denied (data_collection: deny), to restrict provider data collection on that route. This setting does not itself establish zero retention for every provider or path. Published commercial API terms for Anthropic and OpenAI, and paid Gemini terms, contain training restrictions; the applicable product and account terms matter. We do not use customer content to train our own models. Additional AI engines used by the AI Visibility feature are listed at /legal/sub-processors.
• SEO data: DataForSEO OÜ (Estonia, EU) provides keyword, SERP, and backlink data. Queries include keywords and URLs you submit.
• Payment processing: Stripe processes all payment card transactions. Stripe is PCI-DSS Level 1 certified.
• Google reporting integrations (optional): the reviewed Search Console, Google Analytics 4 and Google Ads connectors retrieve reporting data using OAuth tokens you authorise. Search Console and GA4 request read-only scopes; Google Ads requests the broader adwords scope. Reviewed reporting operations do not establish that every granted permission is read-only. Google Tag Manager permissions and data paths remain unverified in this review. You can revoke access through Google; revocation does not itself delete previously stored information. See section 5.1 for the proposed restrictions on Google API information.
• Email sending (optional): when you connect a Gmail or Outlook account for link outreach, the messages you approve are sent through Google or Microsoft from your own account. Sending access is the default. Optional bounce detection separately requests read access and retrieves candidate message contents to classify delivery failures. You can disconnect the integration or revoke access at Google or Microsoft; revocation stops future access but does not itself erase records already retained.
• Slack (optional): when you connect Slack, the notifications you configure are delivered to your chosen channel through Slack.
• Cloudflare (optional): when you connect Cloudflare, the scoped API token you provide is used solely to read bot-access information for your own zone.
• Abuse prevention: Google reCAPTCHA protects our free public tools and processes device and usage signals, including IP addresses, under Google’s own terms.
• Authentication: AWS Cognito manages identity and MFA. Tokens are stored client-side in your browser and are never stored on our servers.

A full list of sub-processors, their purposes, and data-transfer mechanisms is maintained at /legal/sub-processors and updated whenever a material change occurs.

5.1 Google API data and Limited Use

Proposed commitment in this non-effective review draft: SearchChamp’s use and transfer of Google API information will follow the Google API Services User Data Policy, including Limited Use requirements. This statement is not confirmation that the operational review is complete or that Google has approved SearchChamp.

For data covered by Limited Use, including derived or aggregated information, the proposed restriction is use for prominent, user-facing features. Transfers and human access must stay within the exceptions permitted by the applicable Google policy, including the specific consent required for a user-facing transfer or access to particular data. General advertising consent does not permit using or transferring this data for advertising, retargeting, data brokering or lending. General AI-provider disclosures do not authorise a prohibited use of Google API information.

Optional Gmail features are also subject to the Google Workspace user data and developer policy, including its restrictions on general AI/model training. The applicable requirements depend on the product and scopes; not every Google API has the same scope classification or assessment requirement.

Reviewed content-optimisation code can include query-derived inputs in requests to external AI providers, including Anthropic/OpenRouter and OpenAI paths. The required feature-specific disclosure, consent and provider restrictions for these transfers remain unverified. This draft does not authorise those transfers merely by listing a provider.

Before this draft takes effect, the review must establish the actual granted permissions, feature purposes, downstream AI/provider transfers and consent, human access, retained copies and deletion controls. Connected reporting and optional mailbox processing are separate from SearchChamp’s own website analytics. Use the controls at Google to revoke permission, and contact security@searchchamp.com about access or deletion of retained information; section 7 describes the current retention limits. Any newly required purpose or permission must be disclosed and authorised before it is used.

6. International transfers

Our primary regional AWS application infrastructure is hosted in Ireland (eu-west-1). Our operating team accesses customer data from the United Arab Emirates. Delivery networks, connected services and other providers can process information in other countries. Primary hosting in Ireland is not a promise that all data, backups, logs or support processing stays there.

Provider locations and contracting entities are distinct from the location of their headquarters. Our recipient list distinguishes documented routes from unverified locations and account terms. The existence of a provider’s standard DPA or SCC template does not establish that every SearchChamp transfer is covered. The transfer assessment for UAE access, provider onward processing and any required UK or EU safeguards remains to be completed before this draft becomes effective.

Contact security@searchchamp.com for information about a processing location or applicable transfer safeguard. We do not infer a New Zealand data transfer solely from the parent company’s registration.

7. Data retention

Retention varies by category. The following describes policy targets and configured controls, with current verification limits. Active records, backups, billing-provider records and minimal abuse/deletion tombstones have different lifecycles. Optional bounce processing can retain raw message material; its deletion must be included in an erasure assessment. We will identify any lawful exception and outstanding deletion when responding to a request, rather than certify erasure solely because an account is closed.

• Account data: retained while your account remains open. Self-service deletion starts a 30-day restoration period. The account lifecycle also schedules closure after cancellation and later purge, but successful erasure of all stores is not established by scheduling alone. Contact security@searchchamp.com for a deletion request and confirmation of the data actually removed or retained.
• AI agent job outputs (keyword lists, content drafts, audit results, reports): retained with your account and subject to the account deletion lifecycle and exceptions described here. Self-service export requires access to an available workspace. If it is unavailable, including after cancellation, contact security@searchchamp.com to request access to or a copy of data we still hold, subject to applicable rights, identity checks and other people’s rights. Cancellation does not itself waive access or portability rights, and an export cannot recover data already erased.
• Agent job working data (task inputs, model prompts, and intermediate messages): scheduled for short operational retention, with a 30-day policy target and a 7-day job cleanup configuration. Enabled sweepers and actual deletion must be verified by store; this draft does not certify completed deletion.
• Outreach campaign data (prospect contacts, pitches, and replies to your own pitches): retained with your account and subject to the account deletion lifecycle and its exceptions. Temporary export files use a two-day storage expiration rule. Storage deletion is asynchronous; this is not a guarantee that every copy is erased within exactly 48 hours.
• Billing records: subject to a 7-year record-keeping policy, with the applicable legal requirement and record category determining retention. Cancellation does not itself erase Stripe-held records. A parent company’s jurisdiction is not by itself the basis for retaining every customer record.
• Support tickets: a 3-year retention target from resolution; mailbox-provider enforcement remains under review.
• Operational and audit logs: retention varies by category. Production CloudWatch log groups use a 90-day minimum-retention control, while audit records may be retained longer. Contact security@searchchamp.com for the category applicable to a request.
• Free-tool submissions (email address, submitted inputs, and IP address): when you request a report from one of our free tools at searchchamp.com (for example the competitor comparison, rank checker, SERP checker, or mini site audit), we store the email address you enter, the inputs you submitted, and the IP address the request came from. The IP address is stored in raw, unhashed form and is used to detect and prevent abuse of these free tools; the email address is used to send you the report you requested and, where you consented, occasional SearchChamp emails. The IP address is retained for up to 6 months from your submission and then automatically deleted; the email address and submitted inputs are retained until you ask us to delete them. Email security@searchchamp.com at any time to request earlier deletion. Unsubscribing from our emails stops further email but does not by itself delete the stored submission record. This is a separate data flow from the verified-bot crawler records described below, where raw IP addresses are never stored.
• Verified-bot crawler visit records (hashed IP + verification verdict): retained on a rolling 90-day window, then purged. Raw crawler IPs are never persisted (see our Security page).

8. Your rights

Depending on applicable law and its conditions, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
• Portability: receive your data in a structured, machine-readable format (JSON or CSV).
• Restriction: request that we restrict processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.

Where the self-service controls are available, you can export account data as a JSON file or request account deletion from your account page. The export download link is valid for 24 hours. The export identifies included categories and omissions: it does not include integration credentials, raw provider answer archives, raw email MIME or Stripe-held billing records. Shared workspace content is limited to owner-authorized scope. Contact security@searchchamp.com for data omitted from an export, unavailable self-service controls or a fuller access request, subject to identity checks, applicable rights and other people’s rights. Account deletion starts the separate restoration and erasure lifecycle described above.

To exercise any of these rights, email security@searchchamp.com. We will respond within the deadline applicable to your request. For example, GDPR generally requires action within one month; where the New Zealand Privacy Act applies, access decisions generally have a 20-working-day deadline. We will explain any lawful extension or refusal and available complaint rights. This is not a universal 30-day deadline. You also have the right to lodge a complaint with your local data-protection authority.

9. Children

The SearchChamp platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data about a child, please contact security@searchchamp.com and we will delete it promptly.

10. Cookies

We use strictly necessary cookies and similar technologies to operate the platform, keep you signed in, and secure payment flows. Our public-page tag loader defaults optional analytics and advertising consent to denied and waits for an optional consent grant before loading Google Tag Manager. You can change or withdraw your saved choice through Cookie preferences. The Cookie Policy describes the intended service inventory and the limits of the current verification: listing a service does not establish that it is enabled, that an analytics-only choice isolates every tag, or that every provider has stopped processing after withdrawal. A separate Cloudflare Web Analytics script was observed during DEV review while consent was denied; its purpose, collection, retention and consent treatment remain unverified, as does its production configuration. This observation concerns SearchChamp’s own site analytics, separately from a customer’s optional Cloudflare account connection. Those configuration and provider controls remain subject to verification before this draft takes effect.

11. Security

We maintain technical and organisational measures including AWS-managed encryption at rest for reviewed storage services, HTTPS on public endpoints, application access controls, and category-specific logging. Our Security page describes the current evidence boundaries and readiness work.

Despite these measures, no internet transmission is 100% secure. If you discover a potential security vulnerability, please disclose it responsibly to security@searchchamp.com.

12. Changes to this policy

We may update this Privacy Policy and identify the revised version and effective date. Material changes will be brought to affected users’ attention before they take effect where required. A notice or continued use does not grant consent to a new optional purpose, waive data rights, or retrospectively authorise processing. Any new processing requiring consent will wait for that consent.

13. Contact

For privacy-related enquiries or to exercise your data-subject rights: