Privacy Policy — BoostSEO

Last updated: October 2026

Summary

We collect only what we need to run your account, your audits and your subscription.
We never sell personal data and we never use the websites you audit for advertising.
Payments are handled by our payment providers; we never see or store full card numbers.
You can export or delete your data at any time from your account.

Who we are

BoostSEO (seo.toolcmb.com) is operated by the ToolCMB team. Contact: contact form. For the purposes of the GDPR we are the controller of the personal data described here.

Data we process

Data	Purpose	Legal basis
E-mail, name, password hash, sign-in provider ID	Create and secure your account	Contract
Websites you audit, crawl facts, reports, projects, AI Studio outputs	Provide the service and your history	Contract
Subscription status, invoices and payment references	Billing, tax and accounting	Contract, legal obligation
IP address (hashed for rate limits), browser type, security events	Prevent abuse and protect accounts	Legitimate interest
Cookies for analytics and ads on public pages	Measure traffic, fund the free plan	Consent

Processors

Depending on the features you use, data is shared with: our hosting provider; payment providers (Paddle, Lemon Squeezy, Stripe or PayPal — whichever you choose at checkout); Google (Search Console if you connect it, PageSpeed Insights, Autocomplete); keyword data providers (such as DataForSEO, Serper or SerpApi) — only keywords and the market, never your account details; and AI providers (OpenAI, Google, Anthropic) — only the text you send from AI Studio. Some processors are located outside the EEA/UK; transfers rely on adequacy decisions or Standard Contractual Clauses.

Retention

Guest audits are deleted after a short time. Account data is kept while your account exists; audit history follows your plan's history limit. Billing records are kept as long as tax law requires. Security logs are kept for up to 12 months.

Your rights

You can access, correct, export and delete your data, object to processing, and withdraw consent at any time. Deleting your account (Account › Danger zone) erases your projects, audits and AI outputs immediately. EU/UK residents can complain to their data protection authority. California residents have the rights described in the CCPA/CPRA; we do not sell or share personal information for cross-context behavioural advertising inside the app.

Security

Passwords are hashed with Argon2id, sessions are stored server-side, sensitive keys are encrypted, all traffic uses HTTPS, and two-step verification is available for every account.