Privacy Policy

Last updated: 2026-09-03

Important Notice: We take the protection of your personal data very seriously. This privacy policy informs you about how we process your personal data when using our website and services. Processing is carried out in accordance with the General Data Protection Regulation (GDPR).

1. Data Controller

The controller within the meaning of the GDPR is:

Antonio Blago
Email: info@antonioblago.com
Website: www.antonioblago.com

If you have any questions about data protection, you can contact us at any time at the above email address.

2. General Information on Data Processing

2.1 Scope of Processing

We only process personal data of our users to the extent necessary to provide a functional website and our services. Processing is generally only carried out with the user's consent or where processing is permitted by law.

2.2 Legal Basis

The processing of personal data is based on the following legal bases of the GDPR:

  • Art. 6(1)(a) GDPR: User consent
  • Art. 6(1)(b) GDPR: Contract performance or pre-contractual measures
  • Art. 6(1)(c) GDPR: Legal obligations
  • Art. 6(1)(f) GDPR: Legitimate interests of the controller

2.3 Data Deletion and Storage Period

Personal data is deleted as soon as the purpose of storage no longer applies. Storage may continue if required by law (e.g., tax retention periods of 6-10 years).

3. Collection and Processing of Personal Data

3.1 Registration and User Account

Data collected:

  • Email address (required)
  • Password (stored encrypted)
  • Registration date
  • Login history (timestamp, IP address)

Purpose: Provision of user account, authentication, security

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Storage period: Until account deletion plus 30 days backup period

3.2 Subscriptions and Payment Data

Data collected:

  • Payment information (processed via Stripe)
  • Billing address (if provided)
  • Transaction history
  • Subscription status and duration
  • Purchased credits and usage

Purpose: Payment processing, invoicing, contract management

Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (legal obligations)

Storage period: 10 years (tax retention requirement)

Payment Processing: Payment processing is handled exclusively through Stripe. We do not store complete credit card data. Stripe's privacy policy also applies: stripe.com/privacy

3.3 Usage Data and Analytics

Data collected:

  • Analyzed websites and domains (entered by you)
  • EEAT analyses and projects
  • Keyword research
  • Backlink analyses
  • SEO Copilot conversations (temporary for session management)
  • Credit usage and API usage

Purpose: Provision of SEO services, platform optimization

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Storage period: As long as the account is active; 30 days after account deletion

3.4 AI Bot Log Analyzer (upload of your own server logs)

The AI Bot Log Analyzer is a free tool that lets you analyze an access log from your own web server. Because such logs typically contain IP addresses, timestamps, requested URLs, referrers and user agents, separate rules apply here.

Processing of the uploaded file:

  • The file is read and parsed in memory only. It is never written to disk and is discarded once the analysis completes.
  • No individual IP addresses are taken from the log. IP addresses only enter the result as a count of distinct addresses per bot.
  • Raw log lines are neither stored nor passed on to third parties. In particular, no data is sent to any AI provider; the analysis runs entirely in our own code on our own server.

What is stored from the analysis:

  • Aggregated metrics (total requests, requests per bot, status codes, time series, AI visibility score)
  • The most frequently requested URLs of the analyzed domain
  • The analyzed domain, where provided or inferable from the log
  • The IP address of the upload (not the IP addresses contained in the log) for rate limiting and abuse detection
  • Your email address, if you choose to have the report sent to you

Purpose: Providing the analysis, abuse prevention, providing shareable reports

Legal basis: Art. 6(1)(b) GDPR (performing the service you requested), Art. 6(1)(f) GDPR (legitimate interest in system security and abuse prevention)

Storage period: The uploaded file is not stored. The aggregated analysis result is deleted automatically after 90 days. A share link you create expires after 30 days.

Storage location: Servers of our hosting provider PythonAnywhere within the European Union (see section 5.6)

Roles and data processing agreement: If the log you upload contains personal data of third parties (such as the IP addresses of your website visitors), you are the controller for that data under the GDPR and we process it on your behalf. We provide a data processing agreement pursuant to Art. 28 GDPR on request at info@antonioblago.com.
Recommendation: The analysis does not require the IP addresses in your log. If you truncate or strip the IP column before uploading, every bot activity metric remains fully intact. Only the "distinct IP addresses per bot" figure is lost.

Shareable reports:

On your explicit action you can create a link that makes the aggregated result accessible without login. Anyone who has the link can view the report. The link expires automatically after 30 days and the page is set to "noindex" for search engines. If you do not create a link, the result is not accessible from outside. On request we delete any report earlier at any time.

4. Cookies and Tracking

4.1 Use of Cookies

Our website uses cookies. Cookies are small text files stored on your device that contain certain information for exchange with our system.

4.2 Types of Cookies

Cookie Type Purpose Storage Period
Session Cookies Authentication, login status Until browser session ends
Functional Cookies Language settings, preferences Up to 1 year
Security Cookies CSRF protection, abuse detection Session or 24 hours

4.3 No Third-Party Tracking Tools

Important: We currently do not use third-party tracking tools such as Google Analytics, Facebook Pixel, or similar. No tracking for advertising purposes takes place.

5. Integration of Third-Party Services

Sub-processors List: A complete list of all data processors (sub-processors) with DPA status, location, and processed data can be found at: www.antonioblago.com/sub-processors

5.1 Stripe (Payment Processing)

For payment processing, we use Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, USA.

Data transferred: Email, payment information, transaction data

Purpose: Secure payment processing, fraud prevention

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Privacy Policy: stripe.com/privacy

5.2 DataForSEO (SEO Data API)

For SEO analyses (keywords, backlinks, traffic), we use the DataForSEO API.

Data transferred: Analyzed domains and websites (entered by you)

Purpose: Provision of SEO analysis data

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Important: No personal data about you is transferred to DataForSEO, only the websites to be analyzed.

5.3 Anthropic Claude (AI Analyses)

For AI-powered EEAT analyses and the SEO Copilot, we use the Claude API from Anthropic.

Data transferred: Website content (for analysis), chat queries

Purpose: AI-based SEO analyses and recommendations

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Privacy Policy: anthropic.com/privacy

Training Opt-Out (Anthropic):
  • We use the Anthropic API in business mode
  • No Training: Your data is NOT used to train AI models
  • Retention: Anthropic stores API requests for a maximum of 30 days for abuse detection
  • We have concluded a Data Processing Agreement (DPA) with Anthropic (GDPR Art. 28)

5.4 OpenAI (Fallback AI System)

As a fallback system for AI analyses, we use the OpenAI API (GPT-4).

Data transferred: Website content (for analysis), chat queries (only when fallback is activated)

Purpose: AI-based SEO analyses as backup when primary system is unavailable

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Privacy Policy: openai.com/privacy

Training Opt-Out (OpenAI):
  • API Usage: When using the OpenAI API, your data is NOT used by default to train AI models
  • No Training: We have activated the training opt-out - your prompts and outputs are not used for model training
  • DPA Concluded: We have concluded a Data Processing Addendum (DPA) with OpenAI pursuant to GDPR Art. 28
  • Retention: OpenAI stores API requests for a maximum of 30 days for abuse detection and then automatically deletes them
  • EU-US Data Privacy Framework: OpenAI is certified under the EU-US Data Privacy Framework

5.5 Google Search Console & Analytics API (OAuth Integration)

For extended SEO analyses, we offer an optional integration with the Google Search Console API and Google Analytics Data API (GA4). This feature requires your explicit consent via Google OAuth 2.0.

Data collected upon connection:

  • Google account email address
  • List of verified Search Console properties (websites)
  • Search performance data (clicks, impressions, CTR, position)
  • Keyword data and search queries
  • Indexing status and crawling statistics
  • Google Analytics 4 properties (if available)
  • Analytics data: Sessions, users, page views, traffic sources

Purpose: Provision of detailed SEO analyses based on your actual Google search data and website statistics

Legal basis: Art. 6(1)(a) GDPR (explicit consent)

Storage period: OAuth tokens are stored encrypted with Fernet (AES-128-CBC) until you disconnect. Retrieved analysis data is cached for a maximum of 30 days.

Revocation of Google Authorization: You can revoke the granted permissions at any time at: myaccount.google.com/permissions. After revocation, all associated data in our system will be deleted within 24 hours.

5.6 Hosting (PythonAnywhere)

Our website is hosted on servers of PythonAnywhere LLP, Kenilworth House, 77-85 Hagley Road, Edgbaston, Birmingham B16 8QG, UK.

Data transferred: All data collected on the website

Purpose: Provision of website infrastructure

Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

6. Data Transfer to Third Countries

Some of the services used (Stripe, Anthropic, OpenAI) are based in the USA or process data in the USA. The USA is not considered a safe third country from the EU's perspective under GDPR.

Data transfer is based on:

  • Standard Contractual Clauses (SCC): Stripe, Anthropic, OpenAI
  • Adequacy Decision: Where applicable (EU-US Data Privacy Framework)
  • Your Consent: Art. 6(1)(a) GDPR in conjunction with Art. 49(1)(a) GDPR

7. Your Rights as a Data Subject

You have the following rights under GDPR:

  • Right of Access (Art. 15 GDPR): You can request information about your data stored with us
  • Right to Rectification (Art. 16 GDPR): You can request correction of inaccurate data
  • Right to Erasure (Art. 17 GDPR): You can request deletion of your data ("right to be forgotten")
  • Right to Restriction (Art. 18 GDPR): You can request restriction of processing
  • Right to Data Portability (Art. 20 GDPR): You can receive your data in a structured format
  • Right to Object (Art. 21 GDPR): You can object to processing on grounds relating to your particular situation
  • Right to Withdraw Consent (Art. 7(3) GDPR): Consent given can be withdrawn at any time

7.1 Exercising Your Rights

To exercise your rights, please contact:

Email: info@antonioblago.com

We will respond to your request within 30 days.

7.2 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

8. Data Security

8.1 Technical Measures

We implement the following security measures:

  • SSL/TLS Encryption: All data transfers are encrypted (HTTPS)
  • Password Hashing: Passwords are hashed with bcrypt, not stored in plain text
  • Access Control: Strict permission management for database access
  • Firewall: Protection against unauthorized access
  • Regular Backups: Daily database backups
  • Security Updates: Regular updates of all systems

8.2 Encryption of Sensitive Data (Encryption at Rest)

Encryption Standard: Sensitive user data is stored encrypted with Fernet (AES-128-CBC with HMAC-SHA256). This meets current industry standards for symmetric encryption.

Encrypted data categories:

Data Category Encryption Method Key Derivation
Google OAuth Tokens Fernet (AES-128-CBC) Individual per user
Revenue Analysis Data Fernet (AES-128-CBC) Individual per user
API Credentials Fernet (AES-128-CBC) Individual per user

Detailed Technical Documentation: A comprehensive description of our encryption procedures can be found on our Data Encryption page.

9. AI Transparency and EU AI Act Compliance

Transparency Notice pursuant to EU AI Act: This application uses AI systems to support SEO analyses and text creation. The AI does not make independent decisions - all recommendations are for informational purposes only.

9.1 AI Systems Used

We use the following AI models:

  • Anthropic Claude (Primary): Claude 3.5 Sonnet / Claude 3 Opus for EEAT analyses and SEO Copilot
  • OpenAI GPT-4 (Fallback): As backup system when primary system is unavailable

9.2 Risk Classification

Our AI applications fall under the "limited risk" category pursuant to EU AI Act (Art. 52), as they:

  • Do not make automated decisions with legal effect
  • Are exclusively for analysis and information purposes
  • Provide transparent labeling of AI-generated content
  • Ensure human control (human-in-the-loop)

9.3 Transparency Requirements

We fulfill the following transparency requirements:

  • Labeling: AI-generated content is labeled as such
  • No Training: User data is NOT used to train AI models
  • Data Processing: Clear documentation of what data is transmitted to AI systems
  • Retention Periods: Defined deletion periods (max. 30 days with third-party providers)

9.4 Data Processing Agreements (DPA)

We have concluded Data Processing Agreements (DPA) pursuant to GDPR Art. 28 with all AI providers:

Provider DPA Status Training Opt-Out Retention
OpenAI Concluded Activated (API) 30 days
Anthropic Concluded Activated (Business) 30 days

9.5 Human Control (Human-in-the-Loop)

All AI-generated analyses and recommendations are designed as decision support. The final assessment and implementation is always up to the user. The AI:

  • Does not make automated decisions
  • Does not perform independent actions
  • Does not change data without explicit user approval
  • Only provides recommendations and analyses

9.6 Your Rights Regarding AI Processing

You have the right to:

  • Know when AI is used in processing your requests
  • Decline AI use (alternative manual analysis on request)
  • Receive information about data transmitted to AI systems
  • Request deletion of data stored with AI providers

10. Protection of Minors

Our services are intended exclusively for persons aged 18 and over. We do not knowingly collect data from minors. If we become aware that data from minors has been stored, it will be deleted immediately.

11. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to reflect changes in the legal situation or changes to our services. The current version can always be found on this page.

Last updated: 2026-09-03

Privacy Contact

Controller:
Antonio Blago
Email: info@antonioblago.com
Website: www.antonioblago.com

If you have any questions about data protection or wish to exercise your rights, you can contact us at any time. We will respond to your inquiry within 30 days.

Last updated: 2026-09-03 | Antonio Blago