Privacy Policy

This Privacy Policy describes how we process personal data in connection with the use of the Engine SEO website and service available at engineseo.pl. We care about being clear — below we explain what data we collect, for what purpose and what rights you have.

Data controller

The controller of your personal data is NESTIC sp. z o.o., with its registered office in Warsaw:

• ul. Złota 7 lok. 28, 00-019 Warszawa, Poland
• Tax ID (NIP): 5253065452
• Company register (KRS): 0001200839
• Statistical number (REGON): 543034010

You can contact us about any personal data matter by email: biuro.engineseo@gmail.com.

What data we process

Depending on how you use the website and the service, we process the following categories of data:

• Account data — email address, first and last name or company name, and authentication credentials (sign-in is handled by our authentication provider).
• Billing data — the data needed to issue an invoice and handle subscription payments; card details are processed solely by the payment provider (Stripe), we do not store them.
• Data about the site connected to the service — the address and configuration of the site we generate content for, and the associated API key.
• Google Search Console data — if you connect GSC, we process your site's statistics and queries in order to select topics. We obtain access based on your authorisation and use it solely to provide the service.
• Technical data and logs — IP address, browser type and version, events and diagnostic data (among other things to detect errors and ensure security).
• Analytics data — information about how you use the website, collected on the basis of consent (see the section on cookies).
• Correspondence — the content of messages you send us (e.g. by email or through the contact form).

Purposes and legal bases for processing

We process data in accordance with the GDPR (EU Regulation 2016/679) for the following purposes:

• Providing the service and performing the contract — Art. 6(1)(b) GDPR (necessary to perform a contract).
• Settlements, invoices and tax obligations — Art. 6(1)(c) GDPR (legal obligation).
• Ensuring security, detecting abuse and diagnosing errors — Art. 6(1)(f) GDPR (our legitimate interest).
• Analytics and product development — Art. 6(1)(f) GDPR, and as regards analytics cookies — Art. 6(1)(a) GDPR (consent).
• Handling enquiries and correspondence — Art. 6(1)(f) GDPR.
• Marketing and newsletter — solely on the basis of separate consent, Art. 6(1)(a) GDPR. You may withdraw consent at any time.
• Pursuing or defending claims — Art. 6(1)(f) GDPR.

Data recipients and processors

We do not sell personal data. We entrust it only to trusted providers acting on our instructions, to the extent necessary to provide the service, including:

• hosting and infrastructure providers (servers and database located in the European Union),
• Stripe — payment provider (subscription and payment handling),
• Clerk — authentication system (sign-in and account management),
• providers of analytics and error-monitoring tools,
• the transactional email provider (system messages) and the notification system,
• Google (for the Google Search Console integration — after your authorisation).

Data may also be disclosed to the competent authorities where required by law.

Transfers outside the EEA

Some of our providers may process data outside the European Economic Area (e.g. in the USA). In such cases the transfer takes place on the basis of mechanisms ensuring an adequate level of protection, in particular standard contractual clauses approved by the European Commission or an adequacy decision (e.g. the Data Privacy Framework).

Retention period

We keep data for as long as it is necessary:

• account and configuration data — for the duration of the contract and until it is settled,
• billing data and invoices — for the period required by tax law (as a rule 5 years from the end of the tax year),
• data processed on the basis of consent — until consent is withdrawn,
• data needed for claims — until the limitation periods expire,
• logs and diagnostic data — for the period necessary to ensure security, usually no longer than 12 months.

If you delete a connected Site from the panel, we permanently and irreversibly erase all data associated with it within the service (including generated and imported articles, statistics, the topic queue and the configuration). The exception is invoices and billing data, which we have to retain for the period required by tax law (as a rule 5 years). Deletion does not cover content already published on your website (in a repository, a CMS or on a server) — that remains solely at your disposal and we have no access to it.

You may also request deletion of your entire account at any time. You submit the request from the panel (the “Account settings” section); the condition is that there are no active subscriptions (cancel them for all sites first). We carry out the request without undue delay, at the latest within 30 days — we then delete the account together with all sites and associated data, as well as your sign-in data held by the authentication provider. We retain only invoices and billing data (tax obligation, as a rule 5 years) and — to a minimal extent, on the basis of legitimate interest — the record that a trial period was used for a given domain, which allows us to prevent abuse (repeatedly opening free trials).

Your rights

In connection with the processing of data you have the right to:

• access your data and obtain a copy of it,
• rectify (correct) your data,
• erase your data (“the right to be forgotten”),
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

You can exercise some of these rights yourself from the panel — including permanently deleting the data of a connected Site and submitting a request to delete your entire account (the “Account settings” section). To exercise the remaining rights, write to biuro.engineseo@gmail.com. You also have the right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa); you may also lodge a complaint with the supervisory authority in your country of habitual residence.

Cookies and analytics

The website uses cookies and similar technologies:

• necessary — required for the website to work and to maintain your session (basis: our legitimate interest),
• analytics — they help us understand how you use the website and develop the product; installed only after consent is given.

You can manage your consents in the cookie banner and in your browser settings. Disabling some cookies may limit how the website works.

Automatically generated content

The Engine SEO service creates articles using artificial intelligence tools, based on your site's configuration and data about your niche. We process this data solely in order to provide the service (generating and publishing content) and do not use it for purposes unrelated to performing the contract.

Security

We apply appropriate technical and organisational measures protecting data against unauthorised access, loss or alteration (including transmission encryption, access control and monitoring). We make every effort to ensure that our providers maintain an equivalent level of protection.

Changes to this policy

We may update this Privacy Policy, for example in connection with changes to the service or to the law. We will announce material changes on the website or by email. The current version is always available on this page, together with the date it was last updated.

Contact

For matters concerning personal data and privacy, write to: biuro.engineseo@gmail.com or by post to our registered office: NESTIC sp. z o.o., ul. Złota 7 lok. 28, 00-019 Warszawa, Poland.