Privacy Policy

Last updated: July 2026

Data Controller

BySys di Enrico Fratipietro

Applicable site: byseo.it

1. Introduction

This policy describes how personal data of users who access and use the BySEO platform — a SaaS service for website SEO optimization — is processed. Processing complies with EU Regulation 2016/679 (GDPR).

2. Types of data processed and purposes

2.1 Registration and access

Data: Email, password (encrypted), Google OAuth data.

Purpose: Account creation, authentication, transactional emails.

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

Retention: Duration of contract; logs for 24 months.

2.2 Subscriptions and payments

Data: Payment data (Stripe), subscription history, wallet credits.

Purpose: Payment processing, subscription management, electronic invoicing.

Legal basis: Contract performance and legal obligation (Art. 6(1)(b)(c) GDPR).

Retention: 10 years for tax obligations.

2.3 Billing profile

Data: Name, company name, tax code, VAT number, address, phone, billing email, SDI/PEC.

Purpose: Electronic invoice issuance (Fiscozen), tax compliance.

Legal basis: Contract performance and legal obligation (Art. 6(1)(b)(c) GDPR).

Retention: 10 years; anonymization upon account deletion.

2.4 Use of the SEO platform

Data: Managed site URLs, GSC data, keywords, autofix logs, AI-generated articles.

Purpose: SaaS service delivery, SEO analysis, content generation.

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

Retention: Subscription duration; 6 months after cancellation.

2.5 Google integration (OAuth, GSC, GA4)

Data: Google access tokens, GSC properties, GA4 analytics data.

Purpose: Google APIs for SEO features (sitemap, property verification, rankings).

Legal basis: Data subject consent (Art. 6(1)(a) GDPR) expressed during OAuth.

Retention: Tokens revoked on disconnection; analytics data: 24 months.

2.6 Navigation and security data

Data: IP addresses, access logs, browser technical data.

Purpose: IT security, fraud prevention, maintenance.

Legal basis: Legitimate interest in security (Art. 6(1)(f) GDPR).

Retention: 24 months.

3. Use of Google API data

BySEO's use of information received from Google APIs, and its transfer to any other app, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, BySEO uses data obtained via Google Search Console, Google Analytics, the Site Verification API and the Indexing API solely to provide and improve the SEO/GEO features of the platform that the user requested (ranking analysis, reporting, automated fixes, site ownership verification, crawl requests). This data is never sold, never used for advertising, and never transferred to third parties other than the sub-processors listed below, strictly necessary to deliver the service.

3.1 Google permissions requested and their use

Search Console (webmasters): Read search queries, clicks, impressions, positions and index status of ONLY the sites the user connects, to display reports and generate SEO suggestions.
Site Verification (siteverification): Automatic verification of site ownership on Search Console during onboarding, without manual steps.
Analytics — read (analytics.readonly): Read GA4 metrics (users, sessions, traffic sources) for the Analytics dashboard.
Analytics — configuration (analytics.edit): Guided creation of the GA4 property and data stream ONLY when the user explicitly starts the Analytics setup from the app. No change happens without a user action.
Indexing API (indexing): Submitting page indexing requests to Google, exclusively when the user presses the dedicated buttons.

3.2 No use for advertising or AI training

Data obtained through Google APIs is never used for advertising purposes and is never used to develop, improve or train generalized artificial intelligence or machine learning models. Some platform features, when requested by the user (e.g. SEO suggestions, content generation, GEO analysis), send portions of data to AI model providers (Google Gemini, OpenAI, Perplexity) for the sole purpose of generating the requested output at that moment: such data is not used by BySEO to train any model, and the providers are contractually bound not to use data sent via API to train their own models.

3.3 Revoking Google access

The user can revoke BySEO's access to their Google account at any time: from within the platform (by disconnecting the site's Google integration) or directly from their Google account security settings at myaccount.google.com/permissions. Upon revocation, access tokens are deleted.

4. Data processors (sub-processors)

Provider	Purpose	Location
Stripe Inc.	Payment and subscription processing	USA (EU-US DPF)
Google LLC	OAuth, Search Console, Analytics, Indexing, Site Verification, Gemini AI (on-demand content generation/analysis)	USA (EU-US DPF)
Supabase Inc.	Database and authentication (EU servers)	USA/EU
OpenAI LLC	AI visibility analysis (GEO) at user request	USA (DPF/SCCs)
Perplexity AI Inc.	AI visibility analysis (GEO) at user request	USA (SCCs)
GitHub Inc.	Publishing SEO files to the user's repository (explicit action only)	USA (EU-US DPF)
Resend Inc.	Transactional email sending	USA (SCCs)
Fiscozen S.p.A.	Electronic invoicing	Italia
Cloudflare Inc.	CDN / Security	USA (EU-US DPF)
DataForSEO	Keyword and SERP data	EU
Apify Technologies	Social media scraping	EU (CZ)

5. Security measures

Pursuant to Art. 32 GDPR, BySEO adopts appropriate technical and organizational measures to protect personal data:

All communications occur exclusively over encrypted HTTPS/TLS connections.
Google and GitHub OAuth tokens are stored in the database with server-side restricted access and are never exposed to the browser or third parties.
The database resides on Supabase infrastructure with at-rest encryption and access restricted via keys with separated privileges.
Authentication is via Google OAuth (no plaintext passwords held); two-factor authentication (2FA) is available.
Access to production data is limited to the data controller only; access logs are retained for security purposes.
Data requested from Google is limited to the minimum necessary (data minimization): only data for sites the user explicitly connects is read.

6. Data subject rights

Access (Art. 15): Obtain a copy of personal data being processed.
Rectification (Art. 16): Correct inaccurate or incomplete data.
Erasure (Art. 17): Delete data — available in account settings. Fiscal data is anonymized as required by law.
Portability (Art. 20): Download all your data in JSON format — available in account settings.
Restriction (Art. 18): Request suspension of processing in certain cases.
Objection (Art. 21): Object to processing based on legitimate interest.
Complaint (Art. 77): Lodge a complaint with the supervisory authority (garanteprivacy.it).

To exercise your rights: info@bysys.it

7. Cookie

For more information on cookie usage see our Cookie Policy.

Cookie Policy Terms of Service