Privacy policy
Updated on 13 November 2026. The French version prevails.
1. Data controller
Bernard David Corroy, sole trader (French micro-entreprise), SIRET 131 571 135 00014, in Valenciennes (59300), France. The full postal address is on the French national business register and is sent on request. For any question about your data, write to contact@david-corroy.com.
For your account data (name, email, organisation, billing), SeoRound is the data controller. For what you bring into your workspace, in particular the statistics read from your Search Console and your Google Analytics, SeoRound acts as a processor, on your behalf and on your instructions: the terms are in annex 1 of the terms and conditions, as required by article 28 of the GDPR.
2. The data SeoRound uses
| Data | Where it comes from | What it is used for |
|---|---|---|
| Name, email address and password (stored in a form that cannot be read back) | Your sign-up | Create your account and sign you in |
| Name, email address and picture from your Google account | Signing in with Google, if you choose it | Create your account and sign you in |
| Your organisation name and the email addresses of the people you invite | Your settings | Share your projects with your team |
| Answers to the setup questions: who you work for, how many client sites, how you heard about SeoRound | You, if you answer | Adapt the setup, know how customers arrive |
| Where the sign-up came from: the app or an AI agent, and the campaign tags of the link you followed (utm) | The link that brought you | Know which links bring sign-ups. No advertising identifier is kept |
| IP address and browser of each session | Your browser | Protect your account |
| Plan, credits, payments and invoices | Your purchases | Bill you and apply your plan |
| Read-only access to your Search Console and your Google Analytics, and the statistics read there | Your approval, given inside Google | Show the clicks, impressions, positions and pages of your site |
| Your projects: sites, keywords, competitors, questions asked to AI assistants, audits, reports | You | Provide the service |
| The messages you write to the AI assistant | You | Answer your questions |
SeoRound uses no audience measurement and no advertising tool, and sells no data.
The statistics from Search Console and Google Analytics describe your site: queries, pages, clicks. Google provides them aggregated; they do not single out your visitors.
Data received from Google APIs. SeoRound's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. SeoRound only asks for permission to read your Search Console and your Google Analytics. It changes nothing in your Google accounts, does not use that data for advertising or to train AI models, and does not sell it. You can withdraw this access at any time, from SeoRound or from your Google account (myaccount.google.com/permissions).
3. Legal bases
| Use | Legal basis (article 6 of the GDPR) |
|---|---|
| Account, service, AI assistant, service emails (address confirmation, forgotten password, invitation, account deletion) | Performance of the contract |
| Invoices and accounting | Legal obligation |
| Security: captcha, limit on attempts per IP address, technical logs | Legitimate interest: protecting accounts and the service |
| Where sign-ups come from | Legitimate interest: knowing which links work |
| Product update emails | Consent, which you can withdraw in Settings or through the link in every email |
4. Who receives the data
Only David Corroy has access to SeoRound's administration. The providers below process data on his behalf, each for its own task.
| Provider | Role | Data received | Place |
|---|---|---|---|
| Cloudflare | Hosting of the app and the database, captcha, abuse protection, page fetching for audits | The application's data | Database in Western Europe. American company whose network runs through servers worldwide |
| Sign in with Google, Search Console, Google Analytics, business lookups for local SEO | What you authorise inside Google, the business names searched | United States | |
| Stripe | Card payment | Name, email, card details. SeoRound never sees the card number | United States |
| Autumn | Subscriptions and credits | Account identifier, name, email, plan | United States |
| Loops | Sending emails | Name, email, account identifier, product update choice | United States |
| OpenRouter, then the AI model it serves (OpenAI by default) | AI assistant, preparation of AI visibility questions | Your messages to the assistant and the project information needed to answer | United States |
| A search data provider | Positions in Google, search volumes, backlinks, answers from AI assistants | Keywords, domain names, questions. No personal data | European Union and United States |
When data leaves the European Union, the transfer relies on the EU-US Data Privacy Framework for the providers that adhere to it (Cloudflare, Google, Stripe), and on the European Commission's standard contractual clauses for the others. You can ask for the details at contact@david-corroy.com.
5. How long data is kept
| Data | Duration |
|---|---|
| Account and projects | As long as the account exists, including after a subscription ends: the account then moves to the free plan. An account left three years without a sign-in is deleted, after a warning email sent one month before |
| Account you ask to delete | Erased 14 days after the request. During that time you can change your mind by writing to contact@david-corroy.com |
| Automatic database backups | 30 days (Cloudflare D1 "Time Travel", paid Workers plan) |
| Access to your Search Console and your Google Analytics | Until you withdraw it, or until the account is deleted |
| IP address and browser of a session | Until the session ends, that is 7 days without a visit |
| Technical logs | 7 days (Cloudflare Workers logs retention) |
| Counters for the limit on attempts | About one minute |
| Invoices and accounting records | 10 years (article L123-22 of the French Commercial Code) |
6. Cookies
SeoRound only sets cookies that are needed to run the service, with no audience measurement and no advertising. They do not require your consent (article 82 of the French Data Protection Act).
| Cookie | Use | Duration |
|---|---|---|
| Session | Keep you signed in | Length of the session |
| Short session copy | Show pages faster | 5 minutes |
| Browser already used | Remember that this browser has been used for an account, to offer signing in | 13 months |
| Privacy choice | Remember your choices | 180 days |
| Sidebar | Remember whether it is open or closed | 7 days |
The captcha (Cloudflare Turnstile) looks at technical signals from your browser, such as its headers and characteristics, to tell a person from a robot. Cloudflare states that it sets no cookie and uses it neither to track people nor for advertising.
7. Your rights
You can access your data, have it corrected or erased, restrict its use, object to a use based on legitimate interest, receive a copy in a common format and withdraw your consent at any time. You can also leave instructions about what happens to your data after your death.
To exercise these rights, write to contact@david-corroy.com. You get an answer within one month. If there is doubt about your identity, proof may be requested. You can also delete your account yourself in Settings.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the authority of your own country.
8. Security
The connection to SeoRound is encrypted (HTTPS). Passwords are never stored in plain text. Signing in, signing up and the forgotten password form are protected by a captcha and by a limit on attempts. Access to your Google tools is read only. If a data breach puts you at risk, the CNIL is informed within 72 hours, and so are you when the law requires it.
9. Minors
SeoRound is for professionals and is not aimed at minors.
10. Changes
The update date is at the top of the page. For an important change, customers are told by email before it takes effect.