Privacy Policy

1. General

This Privacy Policy describes how the operator collects, uses and protects personal information of users of the SEO Control service available at surfup.dev and related service pages.

Operator and privacy contact: Daniil Shastovsky, INN 781631339830, 192076, Saint Petersburg, Zavodskaya Street, 17, +79581754099, shastovsckiy@gmail.com. This Policy is an information notice and does not itself record consent; where consent is required by law, the separate consent flow must be completed before that processing is enabled.

2. What information we collect

2.1. Account data

To create a unified account and authenticate you, we use Google Firebase. We collect:

• Email address.
• Profile name (if provided).
• A unique user identifier (UID), authentication metadata and account activity needed to secure the session.
• Basic browser storage and Firebase Analytics events, where enabled, for security, reliability and service statistics.

2.2. Third-party API data (Google and Yandex)

To operate the SEO Control service, we request access to the following data:

• Google Search Console: the list of verified sites, sitemap files, performance statistics (clicks, impressions, CTR, positions) and URL diagnostics data.
• Yandex Webmaster and Metrica: the list of sites, traffic statistics, indexing data, and error diagnostics.

We only request read-only access — we never make changes to your sites through these APIs.

3. Purpose of data processing

We use the collected data to:

• Provide access to your dashboard and the service's features.
• Build analytical reports and traffic trend charts.
• Automatically detect technical errors on your sites.
• Send notifications about critical changes (e.g. a traffic drop).
• Run AI Control and AI Readiness analyses, maintain usage and credit records, prevent abuse and provide support.
• Process payments or payment requests when the payment flow is legally and technically activated.

5. Sharing data with third parties

We do not sell or share your personal data with third parties for marketing or advertising purposes.

Data may only be shared with technical partners that keep the service running:

• Google Firebase: authentication and, where enabled, analytics.
• Google and Yandex APIs: read-only SEO data requested by the user.
• Bright Data: AI Control collection requests and their results when the user starts a capture.
• JSONSEO: search and AI-answer collection for Yandex/competitor discovery and related AI Readiness checks requested by the user.
• Telegram: notifications and bug reports when the user enables them.
• Hosting and database providers: operating the service and storing its data.

We do not sell personal data or use it for unrelated advertising. Some providers may process data outside the user’s country; transfers are limited to the stated purposes and must be configured by the operator in accordance with applicable law.

6. Data retention and deletion

We retain account and project data for as long as the account and related service purposes require it. Technical, security, payment and dispute records may be retained for the period required to protect the service and comply with legal obligations. At any time you can:

• Revoke access to your Google/Yandex account in that service's security settings.
• Remove a project from the dashboard (its check history is deleted immediately).
• Request full account deletion by emailing us.
• Request access, correction, restriction or clarification of your personal data, or withdraw consent where processing is based on consent.

7. Contact

Service owner and data controller: Daniil Shastovsky, INN 781631339830, 192076, Saint Petersburg, Zavodskaya Street, 17, +79581754099, shastovsckiy@gmail.com.
For any privacy-related questions, contact us at: shastovsckiy@gmail.com