Privacy Policy

ASEOKA has two parts, and they handle data differently:

• The agent is software that normally runs on infrastructure you control (your server or container host). It scans your site, reads your repository and logs, and keeps its working data in a database on that infrastructure.
• The hub and dashboard are run by us. The hub coordinates agents and stores account data and the summaries and metrics agents report to it. The dashboard (app.aseoka.com) is the web interface you use to review the agent's work.

We also run agents on our own servers: one for our own website, and one that performs AI Visibility Audits. If we agree to host an agent for you, the data that agent handles is stored on our servers instead of yours, and is covered by this policy and the data processing section of our Terms of Service.

When the agent processes personal information that belongs to your organisation (for example visitor data in your server logs), you are the controller of that information and we act as your processor or service provider.

When you visit aseoka.com

• Cloudflare Web Analytics records usage data such as pages viewed, referring site, country, device and browser type. It does not set cookies or use local storage, and we see this data only as aggregated statistics.
• Our web servers record standard access logs: IP address, user agent, requested URL, referrer and time of request.
• If you sign in to the documentation, we set a session cookie that keeps you signed in.

When you use the AI Visibility Audit

• The website address you submit. We fetch that site's public pages to produce the audit, and we store the result (score, findings and signal breakdown) with the address.
• If you unlock the full report, your email address. The full report is shown in your browser, and we may email it to you and follow up about your audit and about ASEOKA. The full report includes an AI citation check, which sends a question about your site to our AI provider (see below).

When you have an ASEOKA account

• Your name, email address and organisation name, a hashed version of your password, and sign-in records (last sign-in time, failed attempts and password reset requests).
• Messages you send to the agent through the dashboard chat.
• Emails and support requests you send us.

What the agent reads on your infrastructure

Depending on how you configure it, the agent reads the following. It processes and stores this data on the infrastructure where it runs:

• The public pages of your website, which it crawls.
• Your Git repository, which it clones in order to understand your site and prepare code changes.
• Your web server access logs (for example nginx logs). These contain your visitors' IP addresses, user agents and requested URLs. The agent uses them to find broken links, redirects and search engine and AI crawler activity.
• Google Search Console data for your site (search queries, clicks, impressions and positions), using read-only credentials you provide (a Google service account you add to your property, or OAuth client credentials). Your top search queries may be used as the questions in AI citation checks.
• Google URL Inspection results (index status and last crawl time) for pages the agent recently changed, using the same read-only Search Console access.
• Settings you give it, such as a Slack webhook address for notifications.

What the agent sends to our hub

The agent sends us summaries, not your raw data. It is not designed to send us your repository, raw log lines or your visitors' IP addresses. It sends:

• Registration and health information about the agent itself.
• Scan summaries: pages crawled, number of issues found, fixes generated, duration and error counts.
• Issue history by type, category and severity, with counts of affected pages and files but not the page addresses or file paths themselves.
• Scores (such as the AI visibility score and which scoring signals were present), fix outcomes, weekly report summaries and links to the pull requests the agent opened.
• Measurement records used for your progress reports: a record of each change to your site (time, pull request link, commit, issue type and counts of pages and files touched, but not the page addresses or file paths), the baseline your progress is measured from, and AI citation check totals (mention and citation rates, cost). When the agent deletes a change record, it deletes our copy too.
• AI usage and cost figures for each agent.
• Daily traffic totals, where the agent can read your web server's access log: the number of requests per page path, grouped by visitor type (for example a person, a search engine crawler or a named AI crawler such as GPTBot) and response status. Paths are stripped of query strings and of anything that looks like an ID, token or email address. No IP addresses, user agent strings or referrers are sent. We may combine these totals across customers, without identifying any site, to understand how AI crawlers behave and improve ASEOKA for everyone.
• Operational logs from the agent. These can include page addresses, file paths and error messages from your site.
• Descriptions of successful fixes for the playbook (see "How we use information").

Your Search Console figures, URL Inspection results and the individual questions and answers from AI citation checks stay on the agent. They are shown in reports you open in the dashboard, but we do not store them on the hub.

When you use the dashboard, your requests and the agent's responses (for example issue details, proposed code changes and chat messages) pass through our hub on their way between your browser and the agent.

We use personal information only for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each is shown in brackets.

• To provide the service: scan your site, propose fixes, open pull requests, and show you results and progress in the dashboard (performance of our contract with you).
• To produce and deliver AI Visibility Audit reports you request (steps taken at your request before a contract, and our legitimate interest in offering the audit).
• To secure accounts, prevent abuse and keep the service running (legitimate interests).
• To track and control the cost of AI processing (legitimate interests).
• To contact you about your account, and about ASEOKA if you requested an audit or, for business contacts, as described under "Business contacts we reach out to". You can opt out of marketing emails at any time (legitimate interests, or consent where the law requires it).
• To measure use of our website with cookieless Cloudflare Web Analytics (legitimate interests).
• To improve fixes through a playbook of fix patterns (legitimate interests). When a fix succeeds, the agent may save its issue type, a written description and the steps taken to the playbook. It does not save your code changes. Because the description is written by AI, it may refer to details of your site, so entries your agents contribute are available only to your own agents. Across customers we use only aggregated, de-identified statistics, such as how often a type of fix succeeds. You can ask us to delete your playbook entries at any time.
• To comply with the law and enforce our terms (legal obligation, legitimate interests).

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects.

Sometimes we email a business we have not dealt with before, to tell it about a specific problem we found on its website and to tell it about ASEOKA. This section explains how we handle the personal information of the people we contact this way.

What we collect

• The business name and website address.
• The business email address, and any name and job role the business publishes on its own website.
• The page where we found the contact details, and the date we found them.
• Notes on what our audit check found about the business.
• Any replies we receive.

Where it comes from

The business's own public website. For the audit check we also look at public AI assistant answers and public directory listings.

Why we use it, and our legal basis

We use it to tell the business about a specific problem we found and to tell it about ASEOKA. Where the UK GDPR or EU GDPR applies, our legal basis is legitimate interests (Article 6(1)(f)). In Canada we rely on implied consent, because the address is conspicuously published and the message relates to the recipient's business role. We only email addresses that are not marked as refusing unsolicited email.

How long we keep it

• Prospect records: at most 12 months from our last contact, unless the business becomes a customer.
• Opt-out list: if you ask us to stop, we keep only your email address and its domain, the date and how you opted out, with no expiry, so that we never contact you again.

Your rights

You can object at any time. Reply "stop" to any of our emails, or email [email protected], and we will stop and add you to the opt-out list. You can also ask to see the information we hold about you, or to have it erased. You have the right to complain to the Information Commissioner's Office (UK), the Data Protection Commission (Ireland), or your local data protection authority. Our general Your rights and International transfers sections also apply to correction, restriction and transfers of this information.

Who we share it with

Apart from legal or business-transfer disclosures described below, only with service providers that process it for us: our email sending provider, our hosting provider, and an AI model provider that helps us draft the audit check. We do not sell this information.

These providers process data on our behalf or at your direction:

• Hetzner Online (hosting). Our hub, dashboard, database and website run on Hetzner servers located in the United States.
• Cloudflare (network, security and website analytics). Traffic to aseoka.com and app.aseoka.com passes through Cloudflare, which sees IP addresses and request details in order to deliver and protect the sites, and provides our cookieless website analytics.
• Anthropic (AI models, United States). To analyse issues and write fixes, the agent sends Anthropic page content, relevant excerpts of your code, issue details and your chat messages. AI citation checks (for the AI Visibility Audit and for your progress reports, which may use your top Search Console queries as questions) also run through Anthropic, including its web search tool. Depending on your plan, the agent uses either an API key we provide (Anthropic then processes the data on our behalf) or your own key (Anthropic then processes it under your agreement with them). Anthropic's commercial terms do not permit it to train its models on this data.
• GitHub (at your direction). With a token you provide, the agent creates branches and opens pull requests in your repository. You can revoke the token at any time in GitHub.
• Google. Search Console and URL Inspection (read-only access you grant for your site).
• Optional integrations (at your direction). If enabled, Brave Search receives search queries about SEO topics during analysis, and Slack receives the notifications you choose to send to your workspace.

We use Resend to deliver service email, such as audit notifications and alerts sent from [email protected]. For emails to business contacts (see "Business contacts we reach out to"), we use an email sending provider that acts as our processor. We will update this list before we add a new provider that processes personal information on our behalf.

We may also disclose information if required by law or to protect our rights, or to a buyer or successor as part of a merger, acquisition or sale of the business, who will be bound by this policy.

Our servers and main providers are in the United States, and Cloudflare operates worldwide. If you are outside the United States, your information will be transferred to and processed there, where data protection law may differ from yours. Where the GDPR or UK GDPR requires it, we rely on the standard contractual clauses (and the UK addendum) in our providers' data processing terms, or on another lawful transfer mechanism. Information processed in another country may be accessible to its courts and authorities.

• Account data, and the summaries, scores, metrics and logs agents report to the hub: while your account is active, and for 30 days after it closes. We then delete it or keep it only in de-identified form.
• AI Visibility Audit results and email addresses: 12 months.
• Web server access logs and agent operational logs: up to 90 days, unless we need them longer to investigate a security incident.
• Daily traffic totals: while your account is active, like the other summaries above. They are aggregate counts, not logs, so the 90-day log limit does not apply to them.
• Account activity records: 90 days.
• Backups: deleted data may remain in backups until they are overwritten on our regular rolling cycle.
• Website analytics: aggregated statistics kept by Cloudflare under its Web Analytics retention policy.

We may keep information longer where the law requires it, or to resolve a dispute. Data the agent stores on your infrastructure stays under your control: removing the agent and its data volume deletes it.

We use appropriate technical and organisational measures to protect personal information. These include hashing passwords with bcrypt, locking accounts after repeated failed sign-ins, encrypting API keys we store for you, encrypting traffic in transit, and keeping our database off the public internet. The agent never merges code on its own: a pull request is merged only when a person on your team merges it, either on GitHub or from the dashboard.

No system is perfectly secure. If a breach affects your personal information, we will notify you without undue delay, and notify the relevant regulator, where the law requires it.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to how we use it, and withdraw consent you have given. California residents also have the right to know what we collect and to not be discriminated against for exercising their rights.

To exercise any of these rights, email [email protected]. We may need to verify your identity first. We will respond within 30 days. If the request is about data an agent processes for one of our customers, we will pass it to that customer and help them respond.

You can opt out of marketing emails at any time: reply "stop", use the unsubscribe link if the email has one, or write to us.

• Sign-in cookies keep you signed in to the documentation and the dashboard. They are strictly necessary and are not used for tracking.

We do not use analytics or advertising cookies. Our website analytics (Cloudflare Web Analytics) works without cookies.

ASEOKA is a service for businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

If you have a concern, please contact us first at [email protected] and we will try to resolve it. Depending on where you live, you may also have the right to complain to your local data protection authority, and you have any other rights your local law gives you.

We may update this policy. We will change the effective date at the top of this page, and we will notify account holders of material changes by email before they take effect.