Privacy Policy

Overview

TODO — registered company name (“we”, “us”, “our”), company number TODO — company number, registered at TODO — registered address, operates OrganicUsers.ai and related services. This policy explains what data we collect, why we collect it, and how we handle it. By using our service you agree to this policy.

We are the controller of the data described under “What we collect” below. Where you use the service to process personal data about your own contacts and prospects — the leads you upload for a cold-email campaign, for example — you are the controller of that data and we process it on your instructions as your processor, under our Data Processing Addendum.

What we collect

We collect only what is necessary to deliver the service:

• Account information — email address and name when you sign up.
• Google Search Console data — with your explicit OAuth consent we read GSC performance data (queries, pages, impressions, clicks) for your connected property. We do not read or store any other Google account data.
• Usage data — pages visited, features used, and error logs for product improvement. This data is aggregated and not sold.
• Content you create — your brand and product context, drafts, campaigns, uploaded media, and the prospect lists you import.
• Payment information — name, billing email and address, and payment-method details, collected and processed by Stripe as our payment processor. Card numbers go to Stripe, not to us: we receive only the last four digits, card brand, expiry, and the result of the charge.

How we use your data

• To provide, maintain, and improve the OrganicUsers.ai service.
• To generate SEO and content recommendations based on your GSC data.
• To send product updates and transactional emails (you can unsubscribe from marketing emails at any time).
• To take payment and keep records we are required to keep.
• To detect and prevent fraud or abuse.

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

Legal basis for processing (UK and EU GDPR)

Where the UK GDPR or the EU GDPR applies, we rely on the following bases:

• Performance of a contract — operating your account, generating and publishing content, running the channels you have set up, and taking payment.
• Consent — connecting Google Search Console, which you grant through Google’s own OAuth screen and can withdraw at any time in your Google account or in our settings. Marketing email, where it needs consent.
• Legitimate interests — product analytics, error monitoring, security and fraud prevention, and service emails about your own account. We balance these against your interests and keep the data to what the purpose needs.
• Legal obligation — tax and accounting records relating to your payments.

Google API data

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google Search Console data retrieved via OAuth is used solely to generate recommendations within your OrganicUsers.ai account, and is never used to train models or sold to anyone.

Subprocessors

We use third-party providers to host the service and to do work it depends on — model providers that generate your drafts, SEO data providers, the platforms that send your email, and our payment processor. Each one receives only the data that its part of the service needs. The current list, with what each receives and a last-updated date, is at organicusers.ai/subprocessors; today it is 21 providers, including Google, Anthropic, OpenAI, Stripe, Render and Smartlead.

We stay responsible for what our subprocessors do with your data, and they are bound by contract to use it only to provide their service to us. If you have a Data Processing Addendum with us, we will give you notice before adding a new subprocessor so you can object — see the DPA for how that works.

International transfers

Most of our subprocessors are based in the United States, so running the service involves transferring personal data outside the UK and the EEA. Where we do that we rely on the UK and EU adequacy decisions where they apply, and otherwise on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus a transfer risk assessment and the technical measures described under “Security” below. You can ask us for a copy of the clauses we rely on for a given provider at privacy@organicusers.ai.

Data retention

• While your account is active — we keep your account data, content and channel history so the service works and so the feedback loop has history to learn from.
• After you cancel — your data stays available for 30 days, so that resubscribing picks up where you left off, and is then deleted or anonymised within a further 60 days. Ask us sooner and we will delete it sooner.
• Google Search Console tokens — revoked and deleted when you disconnect the property or close your account.
• Billing records — invoices and payment records are kept for as long as tax and company law requires, which is typically six years. These are financial records, not content, and are kept even after a deletion request.
• Backups and logs — operational backups roll off within 35 days and error logs within 90 days.

Your rights

Depending on your jurisdiction you may have the right to access, correct, export, restrict or object to, or delete your personal data, and to withdraw consent you have given. Under the UK and EU GDPR you also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office.

To request deletion, email privacy@organicusers.ai from the address on your account, or ask us from your account settings. We will confirm within 7 days and complete the deletion within 30 days, telling you what we had to keep and why. We pass the request on to our subprocessors where they hold a copy. Deletion is irreversible, so we will ask you to confirm before we start.

Cookies

We use only essential cookies and equivalent browser storage: your authentication session and your interface preferences. We set no advertising, tracking or third-party analytics cookies, which is why you see no cookie banner — essential cookies do not need one. If we ever add a non-essential cookie we will ask for your consent before setting it and update this policy first.

Security

Data is encrypted in transit (TLS) and at rest. OAuth tokens are stored encrypted. Access to production data is limited to staff who need it. We follow industry-standard practices and review our security posture regularly. If a breach affects your personal data we will notify you and the relevant supervisory authority as the law requires.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice at least 14 days before taking effect.

Contact

Questions about this policy? Email privacy@organicusers.ai.