Privacy Policy

1. Who we are

Zerak is a search engine optimisation agency. We operate the website at seo.zerak.io, the client dashboard at seo.zerak.io/portal, and the tools that deliver our service. In this policy, "we" and "Zerak" mean the operator of that service, and "you" means whoever is reading — a visitor, a prospect who ran a free audit, or a client.

For any question about this policy or the data we hold, write to hello@zerak.io.

2. What we collect

If you run a free audit

The website address you submit, so we can analyse it.
Your email address, so we can send you the report and follow up about our services.
Publicly available information from the website you submitted — the same pages any visitor or search engine can read. We honour robots.txt and identify ourselves as ZerakBot.
A one-way fingerprint used only for rate limiting. Rather than storing your IP address, we store a salted hash of it that is truncated to eight bytes and rotates daily. It is enough to count how many audits came from one visitor in a day and is not reversible into an IP address.

If you become a client

Business details — company name, website, industry, target market and languages.
Contact details — the name and email of the people we work with.
Commercial details — your package and retainer amount.
Notes we write about the work, which are internal working notes about your SEO, not about you personally.
Data about your website — pages, titles, headings, structured data, keyword rankings and backlink summaries, gathered by crawling your public site and from the third-party SEO data sources listed below.
Login details for the client dashboard — name, email, and your password stored only as a salted PBKDF2 hash. We never store or see your password itself.
Content of your site that we publish for you. Everything we publish arrives on your site as a draft for you to approve.

If you work for Zerak

Team accounts store a name, email, role and a salted password hash. We also record which member of the team logged which hours against which client, so we can manage capacity.

What we do not collect

We do not collect payment card details — we never see them. We run no advertising pixels, no analytics scripts and no third-party trackers on this website. We do not buy personal data, and we do not build profiles of individuals.

3. Google account data

If you are a client, you may choose to connect your Google Search Console and Google Analytics accounts. This is optional, it is entirely your choice, and the service works without it — though the reporting is much weaker.

What we ask for

We request two read-only permissions and nothing else:

Scope	What it allows	Why we need it
`webmasters.readonly`	Read your Search Console data. It cannot change anything.	To see which searches bring you clicks, at what position, and to find pages losing traffic.
`analytics.readonly`	Read your Analytics data. It cannot change anything.	To report how many visitors search brings you and what they do.
`openid`, `email`	The email address of the Google account you connected.	So the dashboard can show you which account is connected.

We hold no permission to modify, publish or delete anything in your Google accounts, because we never ask for one.

What we store, and what we do not

We store a refresh token, which lets us read your data on the schedule you are paying us for.
We do not store access tokens. A short-lived one is created for each request and discarded.
We store the aggregate figures we read: by day, which search queries and pages produced how many clicks, impressions and what average position; and how many sessions, users and conversions arrived by channel.
We do not receive and cannot see personally identifying information about your website’s visitors. Google does not provide it through these APIs.

Limited Use commitment. Zerak’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

In plain terms: we use your Google data only to provide and improve the SEO service you asked us for. We do not use it for advertising. We do not sell it or transfer it to anyone, except where the law requires it. No human reads it other than to support you directly, to investigate abuse, or where the law requires it. And we do not send it to any artificial-intelligence model, or use it to train or improve any AI model — see the next section.

Disconnecting

Tell us and we will delete the refresh token and stop reading your accounts. You can also revoke our access yourself at any time from your Google account permissions, which takes effect immediately and does not require us to do anything.

4. How we use AI

We use AI models from Anthropic to do the analytical and drafting work behind our service — reading a technical audit and deciding what matters, grouping keywords into a strategy, drafting article briefs and first drafts. A person reviews and approves everything before it reaches you or your website.

What is sent to Anthropic: your business name, website, industry, target market and languages; the competitors you named; the technical findings and public page information from crawling your site; keyword data; and our internal working notes about the SEO work.

What is never sent to Anthropic: your Google Search Console data, your Google Analytics data, your Google refresh token, any password or password hash, and any contact details of your staff or customers. This is enforced in how our system is built, not merely as a matter of policy — the code that assembles what an AI model sees does not read from the tables holding Google data.

Anthropic processes this as a service provider on our behalf and, under its commercial terms, does not use it to train its models.

We do not sell your data. We do not share it for anyone else’s advertising. We use a small number of service providers to run the service:

Provider	Purpose	What it receives
Cloudflare	Hosting and database	Everything described in this policy is stored on Cloudflare infrastructure, in the European region.
DataForSEO	Search and keyword data	Website addresses and keywords. No personal contact details, and no Google account data.
Google	Search Console, Analytics, PageSpeed	Website addresses; and, if you connect them, requests to read your own accounts.
Anthropic	The AI models behind the analysis and drafting	As listed in section 4. Never Google account data.

We may also disclose information where the law requires it, to establish or defend legal claims, or to investigate abuse of the service. If our business is ever sold or merged, data may transfer as part of it, and this policy would continue to apply until you were told otherwise.

6. Cookies

We set two cookies, both strictly necessary, and no others:

Cookie	Purpose	Life
`zerak_seo_session`	Keeps a signed-in Zerak team member signed in.	12 hours
`zerak_seo_portal`	Keeps a signed-in client signed in to their dashboard.	7 days

Both are HttpOnly and SameSite=Lax, meaning they cannot be read by scripts and are not sent from other websites. Neither is used for tracking or advertising. We ask no cookie consent because we set no cookie that requires it.

7. How long we keep it

Free audits and the email you gave us: up to 24 months, so we can show you progress if you come back. Ask and we will delete them sooner.
Client data: for as long as we work together, and for up to 24 months afterwards, so we can answer questions and meet accounting obligations.
Google connection tokens: deleted when you disconnect, when you revoke access, or when our work together ends.
Rate-limiting hashes: a rolling window of a few days.

8. Your rights

Whatever jurisdiction you are in, we will honour these on request:

See it — a copy of what we hold about you.
Correct it — fix anything inaccurate.
Delete it — remove it, except where we must keep records by law.
Export it — a machine-readable copy.
Object — tell us to stop using it for a particular purpose, or to stop emailing you.

Email hello@zerak.io and we will respond within 30 days. We will never charge you for a reasonable request, and we do not require a particular form of words.

9. Security

Everything travels over HTTPS.
Passwords are stored only as salted PBKDF2 hashes. We cannot read them, and we cannot tell you what yours is.
Session tokens are signed, expire, and are held in cookies that scripts cannot read.
Client dashboard accounts are a separate system from team accounts, with separate credentials and separate session tokens, so a client account cannot reach agency tooling and an agency account cannot impersonate a client.
Clients can only ever see their own data. This is enforced on the server for every request, not by hiding things in the interface.
API credentials are stored as encrypted secrets and never written into our code.

No system is perfectly secure. If we ever discover a breach affecting your data, we will tell you promptly and tell you what actually happened.

10. Children

Zerak is a service sold to businesses. It is not directed at anyone under 18 and we do not knowingly collect their data. If you believe we have, tell us and we will delete it.

11. Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects how we handle data about you, we will email clients directly rather than relying on you noticing.

12. Contact

Questions, requests, or complaints: hello@zerak.io.

If you are unhappy with how we have handled a privacy request, you are entitled to complain to the data protection authority where you live.