SEO & Chill is built on a simple promise: your content flows directly between your server and the AI provider you choose. We are never in that path. This page shows exactly what data goes where, who our subprocessors are, and how the platform is secured. Everything an agency, DPO or EU buyer needs, public and linkable.
Only when you run an AI action, directly from your server, under your own API agreement:
SEO & Chill servers are not a proxy. We never receive:
The license API receives only what it needs to check a license: the site’s connection token, the activated domain and the plugin version. Like any web request, it also sees your server’s IP address, which we keep with the activation. Details per provider are in each provider’s own policy. You choose who you trust with your content.
API keys are encrypted at rest with libsodium in your own database, using a key derived from your site’s own WordPress salts. Decryption happens only on your server.
Every admin action is guarded by WordPress capability checks and nonces; database interactions use prepared statements; file integrity is verified on update.
Your site checks its plan with our server about once a week and remembers the answer in between. If our server can’t be reached, the plugin keeps working with the plan it last confirmed for up to 30 days, and tells you well before then if checks keep failing. Your SEO never depends on our uptime.
The website and the customer portal run as separate projects. The portal is the only system with customer data, and its database accepts encrypted connections only.
The customer database can be restored to any moment in the last 7 days. We have tested a restore.
On our own website, analytics only if a visitor accepts it, and two ad pixels, Meta’s for our own ads on Facebook and Instagram and OpenAI’s for our own ads in ChatGPT, only with Accept; nothing loads from Google, Meta or OpenAI before they choose. Our account emails count opens and clicks (see the Privacy Policy). A license API that receives a connection token, a domain and a version number. Not your content.
| Subprocessor | Purpose | Location | Data involved |
|---|---|---|---|
| Vercel | Hosting of the website and the customer portal | USA | IP addresses and request details; account data passes through the portal |
| Neon | Database of the customer portal | USA | Account details (name, email address, password hash, profile photo if added), licenses and activated domains, onboarding answers, the email address and site address entered before checkout with the plan chosen (for 24 hours, or 30 days if a yes to emails went on to Klaviyo) and a key derived from the IP address for 24 hours, IP addresses for sign-in security and, for 24 hours, of contact and refund form submissions and of questions in the question box under our FAQs; those questions and the answers to them for 30 days, without IP address; and, for visitors who accepted analytics, Google Analytics’ two random IDs for their browser and visit beside a checkout, until the payment is confirmed or for at most 24 hours; for visitors who chose Accept, the same for the two IDs of Meta’s pixel and of OpenAI’s pixel and their browser string |
| Stripe | Payments, billing, invoicing, tax | USA / EU | Card data never touches our servers |
| Postmark | Account and billing email (sign-up confirmation, password reset, receipts, and up to three setup emails after a purchase, once per account), and messages from our contact and refund forms to our support inbox | USA | Your email address and the email itself, and whether it was opened and which links were clicked, with the time, IP address and email program |
| Klaviyo | Our newsletter, for people who subscribe and confirm it; setup tips and a few notes from our founder for people who ask for them before checkout or in the setup after signing up; a review request and two emails after a plan ends, for customers who left the question at checkout on yes; and keeping customers out of our sales email | USA | Your email address; your first and last name for the newsletter, and your first name for the emails before checkout and in the setup after signing up. For the newsletter: when and how you subscribed and confirmed; your IP address reaches Klaviyo with the sign-up. If you tick the box in the setup after signing up: that you said yes, your first name, and that you created an account, with your email address or with Google. If you tick the box before checkout: that you said yes, and the plan, billing period and price you chose, the address of your site and a link back to the checkout step. For customers: the plan, interval and status of the subscription, since when, the number of sites using the plugin and the address of the most recent one, and for a purchase the amount excluding tax and the answer to the question about emails as a customer. Never payment details |
| Google Workspace | Our email, including support | USA | What you write to us |
| Sentry | Error monitoring for the customer portal | EU | Error reports without cookies or email addresses; IP addresses not stored |
| Have I Been Pwned | Checks new passwords against known data breaches | Global | The first five characters of a password hash; for the check in your browser, also your IP address |
| Anthropic | Answers in the question box under the FAQs on our website | USA | The question a visitor types; no IP address or account data |
| Google Analytics | Visitor statistics for our website (seoandchill.com), and the sign-ups, checkouts, purchases and sales or partnership questions that follow a visit, only for visitors who accept it. No Google script on the customer portal; nothing from previews | USA | Pages viewed, referrer and approximate location, tied to a cookie that expires after 13 months. On the website your IP address reaches Google with the connection, is used for a rough location and is then discarded rather than logged; what the customer portal reports goes from our server, so your IP address does not reach Google with it. For a purchase: the plan, amount, currency and order number. Never a name or email address. The data is not shared with Google’s advertising products |
| Fastlane | Visitor statistics for our website (seoandchill.com), only for visitors who accept analytics. No Fastlane script on the customer portal; nothing from previews | Australia; servers of Convex in the USA or Ireland | Pages viewed, referrer, screen size, language, campaign tags, scroll depth and time on page, tied to a random visitor ID and session ID in local storage. Your IP address reaches Fastlane’s servers with the connection. No name, no email address, no sign-ups or purchases |
| Meta Platforms Ireland | Our own ads on Facebook and Instagram, only for visitors who choose Accept on our website. Not our processor: joint controller with us for collecting the data and passing it on, and a controller of its own for what it does with it, under its Business Tools Terms. No Meta script on the customer portal; nothing from previews | Ireland; may transfer onward to the USA (Data Privacy Framework) | Pages viewed on our website and a view of the pricing page, with the page address and referrer, a random browser ID and a reference to the ad click in cookies, the browser, the IP address and, if the browser sends them, Meta’s own facebook.com cookies. From the customer portal: sign-ups, sales or partnership questions, checkouts and purchases (plan, amount, currency), with our own reference to each (the account number for a sign-up, Stripe’s session ID for a checkout or purchase) and the email address hashed only for a sign-up or a signed-in account. Never a name or an email address in clear |
| OpenAI Ireland | Our own ads in ChatGPT, only for visitors who choose Accept on our website. Not our processor: OpenAI uses the data as a controller of its own, under its Conversion Terms. No OpenAI script on the customer portal; nothing from previews | Ireland; may transfer onward to the USA | Pages viewed on our website, with the page address and referrer, a random browser ID and a reference to the ad click in cookies, the browser, the IP address and, if the browser sends them, OpenAI’s own openai.com cookies, and an email address or name typed into a form on our website, hashed in the browser. From the customer portal: sign-ups, checkouts and purchases (plan, amount, currency), with the email address hashed only for a sign-up or a signed-in account. Never a name or an email address in clear |
| Cloudways | Hosting of the live demo (servers at DigitalOcean) | USA | IP addresses of demo visitors in server logs; no customer data |
AI providers you connect yourself in the plugin (OpenAI, Anthropic, Google, and the rest of the ten) are your own processors under your own agreements. Not our subprocessors: Anthropic is listed above only for the question box on our website, and Google only for the analytics a visitor consented to, on the website and for the sign-ups, checkouts, purchases and sales or partnership questions that follow from it. Meta Platforms Ireland and OpenAI Ireland are listed only for our own ads on Facebook, Instagram and in ChatGPT, for visitors who chose Accept, and not as our processors. If you sign in with Google, that is a separate relationship: Google shares your name and email address with us under Google’s own terms, as the identity provider rather than as our processor. We announce subprocessor changes on this page before they take effect.
Our Data Processing Addendum is public and automatically forms part of your agreement the moment you purchase. Electronic acceptance is how Art. 28 GDPR contracts work for SaaS. For audits or client files, the public DPA together with your order confirmation is all the evidence you need.
Your content goes directly from your server to the AI provider you connected, under your own API agreement with that provider. We are never in that data path. Whether a provider trains on API traffic is governed by their terms; most major providers do not train on API data by default, but verify this in your provider’s policy.
No. Keys are stored in your own WordPress database, encrypted with libsodium, and are only ever sent to the provider they belong to. They are never transmitted to SEO & Chill servers. We wrote up the detail on a separate page, including what that encryption protects against and what it does not.
The minimum needed to validate a license: your site’s connection token, the domain it’s activated on and the plugin version. Like any web request, it also sees your server’s IP address, which we keep with the activation. No site content, no analytics, no personal data of your visitors.
There is nothing to sign. And nothing missing. The Data Processing Addendum is public and automatically forms part of the Terms for every customer, which satisfies Art. 28 GDPR. If your auditor or client asks, point them to the public DPA plus your order confirmation.
Everything the plugin created. Meta, redirects, schema settings. Lives in your WordPress database and stays there. On our side, license and billing records are retained only as long as legally required, then deleted.
Everything on this page is one link. Send it to your DPO and get back to ranking.
Get started →
