Scope
This policy explains how seolok.com and the SEOLOK app process personal data. The detailed KVKK notice is in the KVKK Notice; for visitor data we process on behalf of customers' sites, the Data Processing Agreement (DPA) applies.
Data we collect
Account data (name, e-mail, language); site performance data retrieved through the read-only Search Console and (if you consent) Google Analytics 4 access you grant with your Google account — from GA4 only aggregated statistics (sessions, users, engagement and key-event counts by landing page, channel and device; no visitor identities) plus the property name and measurement ID; public ranking and performance data from a ranking data provider and Chrome UX Report; payment and billing details; usage and error logs. On customers' sites with the WordPress plugin, and only if the visitor allows it, a browser notification subscription (push endpoint and keys) is collected. For the free rank finder, the website, keyword, location and device entered are stored to provide and improve the service; the IP address of these queries is kept only as an irreversible hash. If you add passkey sign-in, we store only the passkey's public key, its credential ID, signature counter, transports, a device name derived from your browser (e.g. "Mac · Chrome") and the dates it was added and last used; your fingerprint, face data or device PIN never leave your device and never reach us. The site counts page views with its own counter: for each page opened it stores only the hour, the page path, the website the visitor came from (if any), any campaign tags in the link, the device class (phone, tablet or computer) and whether it was a robot. No cookie is set, nothing is stored on the visitor's device, and no IP address or browser string is stored; to count visitors once a day, the address and browser are turned into a one-way key that goes only into an approximate counter from which it cannot be read back.
How we use it
To provide the service (measurement, signal scores, action suggestions, reports, consulting services), billing, security and support. Your data is never sold or used for ad profiling. AI is only used to write text (title suggestions, report summaries) from your own data; your data is not used for model training.
Protection of Sensitive Data and Retention
The information we treat as sensitive: the access (OAuth) permissions you grant with your Google account and their access and refresh tokens, your Google Search Console data (search queries, page addresses, clicks, impressions and positions), if you consent aggregated Google Analytics statistics, your account details and payment records.
Protection in transit: All data transfer between your browser and SEOLOK, and between SEOLOK and Google and our sub-processors, is encrypted with TLS/HTTPS; our site is served over HTTPS only and browsers are told to use HTTPS through HSTS.
Protection in storage: Your Google access and refresh tokens and third-party API keys are stored in the database encrypted with AES-256-GCM; the decryption key is kept separate from the database. Data is stored on servers in the EU (Germany); the database is not directly reachable from the internet, only from the application's own network. We request read-only permissions from Google only; we never change anything in your Google account or on your site.
Access control: Each account's data is separate from every other account's; every data query in the application is restricted by account and site ID. Within an account, access is granted through owner, admin and member roles. Only named, authorized staff can enter the platform administration area; staff view this data only with your explicit consent (e.g. a support request), for security purposes or where required by law, and are bound by confidentiality.
Retention and deletion: Your daily Search Console performance data is kept while your account is open; query- and page-level detail data is deleted after 120 days. When you remove a site from the panel it is archived; when you ask for your account and all your data to be deleted at info@seolok.com, it is deleted (except invoice and payment records we are legally required to keep, which are kept for 10 years). You can revoke Google access at any time at https://myaccount.google.com/permissions; once access is revoked we pull no new data from Google. For safety, a database backup is taken every night and kept only on these servers, the latest 7 backups are retained, and deleted data disappears from backups within about 7 days at the latest. Other retention periods are described in the KVKK Notice.
Sharing
Data is shared only with the sub-processors needed to provide the service: Google (Search Console API, Google Analytics Admin/Data API and Chrome UX Report), a ranking and backlink data provider, an AI text service, an e-mail delivery service, payment institutions (iyzico, Stripe) and service providers used in service work. The current sub-processor list is available on request. Data is never sold.
Google user data
When you sign in with Google we request read-only access only: Google Search Console (webmasters.readonly) and, if you consent, Google Analytics (analytics.readonly). We use this data solely to show you your own sites' search performance, visitor statistics, reports and recommendations. We never change, delete or publish anything in your Google account or on your site. Your Google access tokens are stored encrypted and the data is kept on our EU servers; it is never sold, never used for advertising or profiling, and never transferred to third parties except as needed to provide the service, for security or to comply with the law. It is not used to train AI models. Our staff can view it only with your explicit consent (e.g. a support request), for security purposes or where required by law. SEOLOK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. You can revoke access at any time at https://myaccount.google.com/permissions and ask us to delete your account and data at info@seolok.com. How sensitive data is protected is described in the “Protection of Sensitive Data and Retention” section above.
Chrome extensions
The SEOLOK All-in-One and Does AI See You? Chrome extensions compute their scores in the user's browser. Only if the user allowed it on first use and opened the extension's panel on a page are that page's address (without its query string and # part), the scores and counts the extension computed, the user's chosen country or province, the browser language, time zone and an anonymous id created on install sent to SEOLOK. The IP address is not stored; only an irreversible hash is kept to limit abuse. Automatic score reporting never sends page text, forms, passwords, cookies or pages the panel is not opened on. User-initiated tests with selected text or a question are described below. This data is used to improve the service and to show the user a summary of the site, and it is never sold. Sending can be switched off in the extension's settings at any time.
What each extension reads
SEOLOK All-in-One reads the inspected page’s on-page and technical SEO signals, HTTP status and redirects, link status and live Core Web Vitals, and adds position and title-width labels to Google search results. Does AI See You? reads page signals and the site’s robots.txt, llms.txt, llms-full.txt and sitemap to assess whether AI systems can crawl, understand and cite the site. Its toolbar GEO score is calculated locally, including when the panel is closed. Both extensions are free and can be used without an account.
Browser permissions and local storage
The storage permission saves settings, the consent choice, chosen location and anonymous installation ID, and caches site files for the browser session. Scripting reads a tab that was already open before installation when the user opens the panel. Side panel access displays the analysis alongside the active tab. Web request access only observes navigation status, redirects and X-Robots-Tag headers; it does not block or modify requests. Host access lets the extensions read the inspected page and fetch the site files or link status needed for their checks. Does AI See You? also uses the context menu permission for its user-selected AI visibility test. All extension JavaScript is packaged with the extension; remote responses are data, not downloaded executable code.
User-initiated live AI tests
When you choose “Do AI answers mention this?” for selected text or launch a live test from the panel, the selected text or question is passed to SEOLOK’s free AI visibility checker for a live test with ChatGPT, Gemini and Google AI Mode. This is a separate action you initiate; the locally calculated score does not itself run that live test. For extension privacy questions or data requests, contact info@seolok.com.
Cookies
Only strictly necessary cookies are used (sign-in session, language). No advertising or third-party tracking cookies. The site's own visit counter (page views, no personal data) uses no cookie and stores nothing on your device.
Your rights
You can exercise your rights of access, rectification, erasure, objection and portability under KVKK art. 11 and, where applicable, the GDPR via info@seolok.com.
Contact
SECESTA Bilişim ve Ticaret Ltd. Şti. · Ayazağa Mah. Mimar Sinan Sk. B No: 21B İç Kapı No: 15, 34396 Sarıyer, İstanbul, 34396 Sarıyer, İstanbul, Türkiye · info@seolok.com