Privacy Policy

For account data, Esoft Arena Ltd is the controller. For the website and marketing data we process on a client's behalf, the client is the controller and we act as their processor under a service agreement.

Account data. Name, email address, organisation name, role, and a one-way hash of your password. We never store your password itself and cannot recover it.

Website data. For each site you connect: its public pages and their content, technical SEO attributes, and changes we propose or apply.

Connected marketing accounts. With your explicit consent via Google OAuth, we read Search Console performance data, Google Analytics 4 metrics, and Google Business Profile listings, posts and reviews. We request only the scopes needed for those features and store access tokens encrypted.

Activity records. An append-only audit log of credentialed actions — who changed what, and when — which we keep for security and accountability.

We do not use advertising cookies or third-party trackers, and we do not sell personal data.

To provide the service: auditing sites, planning and drafting content, tracking rankings, preparing reports, and drafting outreach and Business Profile content for your approval. We also use it to secure accounts, and to bill for the service.

Our lawful bases are performance of a contract (providing the service you signed up for), legitimate interests (securing and improving the service), and consent (connecting a Google account, which you can withdraw at any time).

The service uses Anthropic's Claude models to analyse sites and draft content. Relevant site context is sent to Anthropic's API to produce that output. We do not send your password, payment details, or OAuth tokens. Content and outreach drafts are never published or sent without a human approving them.

We use a small number of processors, each only for the purpose named:

• Anthropic — model inference for audits, analysis and content drafting.
• Google — Search Console, Analytics 4, Business Profile and PageSpeed Insights, accessed under your OAuth consent.
• DataForSEO — keyword, ranking and backlink data.
• Resend — transactional email such as account invitations, password resets and weekly reports.
• Hetzner — hosting and data storage.

We do not share your data with advertisers. We may disclose data where legally required.

Data is stored on servers in the European Union. Some processors listed above operate outside the UK and EEA; transfers rely on the UK International Data Transfer Addendum or Standard Contractual Clauses.

Account and site data is kept while your account is active. On request, or after an account is closed, we delete it within 90 days, except audit-log records and anything we must keep for legal or accounting reasons.

Traffic is encrypted in transit. Passwords are hashed, and OAuth and site tokens are encrypted at rest. Access is scoped per organisation, and administrative actions taken on a client's behalf are recorded against the individual who performed them.

Under UK GDPR you can request access to your data, correction, deletion, restriction or objection to processing, and portability, and you can withdraw consent for connected accounts at any time — from the Integrations screen, or in your Google account settings.

Email privacy@esoftarena.com and we will respond within one month. If you are unhappy with our response you can complain to the UK Information Commissioner's Office (ico.org.uk).

We will update this page when the service changes and revise the date above. Material changes will be notified by email.