Legal
Privacy Policy
Last updated October 15, 2026 · Questions: support@kittoseo.com
This policy explains what Kitto collects, why, who processes it and how to remove it. The data controller is Vladislava Zapechelniuk, an individual based in Georgia. Contact: privacy@kittoseo.com.
1. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Account: email, name, password hash or Google sign-in ID | You, at sign-up | Log you in, send service emails |
| Search Console data: queries, pages, impressions, clicks, positions, per day | Google Search Console API, read-only, for the properties you connect | Build the opportunity map, plan content, report results |
| Google OAuth token for Search Console | Google, when you connect | Fetch the data above daily; stored encrypted |
| Site content: page URLs, titles, headings, text and internal links | Our crawler, reading your public pages | Understand what your site already covers; internal linking |
| CMS connection: site URL, application password or API token | You, when you set up publishing | Publish and update articles on your site; stored encrypted |
| Billing: plan, invoices, last four digits of the card, country | Creem, acting as Merchant of Record | Show your subscription status. We never receive full card numbers |
| Usage and technical: pages you open in the app, IP address, browser, error reports | Your browser and our servers | Security, debugging, keeping the service working |
| Support messages | You, by email | Answer you |
We do not collect data about your visitors. We read your Search Console reports and your public pages, not your site’s analytics or user accounts.
2. Legal basis
We process data to perform the contract with you (account, Search Console data, site content, publishing, billing), to comply with legal obligations (invoices and tax records kept by Creem), and for our legitimate interest in keeping the service secure and working (technical logs, abuse prevention such as one Start month per site). We do not use your data for advertising and do not sell it.
3. Who processes your data
We use a small number of providers. Each receives only what its job needs, under a contract that limits use to our instructions.
| Provider | What it receives | Purpose |
|---|---|---|
| Google (Search Console API, sign-in) | OAuth requests for your connected properties | Source of your search data |
| Creem, Armitage Labs OÜ (Rotermanni 14, Tallinn 10111, Estonia), acting as Merchant of Record | Email, country, payment details you enter at checkout | Payments, invoices, taxes, refunds |
| OpenAI (API) | Titles and text of your public pages | Embeddings for internal linking and topic matching |
| DeepSeek (API) | Briefs built from your site content and aggregated search queries | Drafting and checking articles |
| DataForSEO | Search queries, without any account data | Public search results used by the quality gate |
| Google Analytics 4, through Google Tag Manager | Page views and interface events on our website, only after you accept them | Seeing which pages help people, so we can improve them |
| Sentry | Error reports, which may include your account ID and IP address | Finding and fixing bugs |
| Hosting provider (cloud servers and database) | Everything above, at rest | Running the service |
Payments are processed by Creem (Armitage Labs OÜ, Rotermanni 14, Tallinn 10111, Estonia), which acts as the Merchant of Record and contractual reseller for all purchases; the buyer facing terms shown at checkout apply to the payment. We never receive your full card number.
AI providers are used through their business APIs, whose terms prohibit using our inputs to train their models. We send them content and query data, never your credentials, tokens or payment details. Providers may be located outside your country; transfers rely on standard contractual clauses or equivalent safeguards.
4. Google user data and Limited Use
Kitto requests the read-only Search Console scope (webmasters.readonly) and nothing else. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms:
- Search Console data is used only to provide Kitto’s features to you, the owner of the connected property.
- It is not sold, not used for advertising, and not shared with other customers or with anyone except the processors above, and only for those purposes.
- Humans at Kitto do not read your data except with your permission, for security, or to comply with the law.
- You can disconnect at any time in Kitto or at myaccount.google.com/permissions. We delete the token immediately and the imported data as described in section 6.
5. Security
Google tokens and CMS credentials are encrypted at the field level with a key that is not stored in the database. Connections use TLS. Access to production systems is limited to the operator. Payment card data is handled entirely by Creem, which is PCI-DSS compliant. If a breach affects your data, we notify you without undue delay and, where required, the supervisory authority.
6. How long we keep data
- Working data (article drafts, the notes our quality checks keep, AI request logs and your Search Console rows): 3 months. After that it is deleted permanently and cannot be restored. Your published articles stay on your site. If you cancel, your drafts stay available to download for 30 days after your paid period ends, even if they are older than 3 months.
- Account and site data (your account, site settings, the list of articles we made for you, credits and link placements): while your account exists. When you close it, we delete Search Console data, crawled content, tokens and CMS credentials within 30 days; backups roll off within a further 30 days.
- Disconnected property: the token is deleted immediately; its imported data within 30 days.
- Invoices and billing records: kept by Creem for the period required by tax law.
- Technical logs and error reports: 90 days.
- Website analytics (only if you accepted it): 14 months in Google Analytics.
- Abuse-prevention records (a hash of the property and email, used to enforce one Start month per site): 24 months.
7. Your rights
Wherever you live, you can ask us to access, correct, export or delete your personal data, to restrict or object to processing, and to withdraw consent where processing is based on it. Write to privacy@kittoseo.com; we respond within 30 days. If you are in the EU, EEA, UK or Switzerland, you can also complain to your local data protection authority. Closing your account in Settings deletes your data without needing to email us.
8. Cookies and website analytics
The app itself uses strictly necessary cookies only: a session cookie to keep you logged in and a security cookie during the Google connection flow. These are needed for the service to work and are not used for measurement.
On our website we use Google Analytics 4, loaded through Google Tag Manager, and only after you choose Accept analytics in the cookie bar. Until you do, Google Consent Mode holds analytics storage in the denied state: no analytics cookies are set and no measurement is sent. Advertising storage, ad user data and ad personalisation stay denied at all times, because we run no advertising tags at all.
Once you accept, we see:
- Pages you open on kittoseo.com and the page that referred you.
- Quiz steps and form events as plain counters, so we can tell where the flow is confusing. Your website address and your email are never sent with them.
- Device type, browser, language and a rough location that Google derives from your IP address. Google Analytics does not log or store the address itself, and we never see it.
Google acts as our processor for this data. Retention of user level and event level data in the property is set to 14 months so that we can compare quarters and seasons. Google’s terms for this data are described in how Google uses information from sites that use its services and in the Google Privacy Policy.
You may change your mind at any time. The Cookie settings link at the bottom of any page reopens the bar, and choosing Decline stops analytics from that moment. Your choice is kept in your own browser storage, so clearing site data asks the question again.
If you arrived from a Google ad, we also keep the ad click id and campaign name in a small cookie named kitto_attr for 90 days, so that a sale later can be matched back to the ad that paid for it. This cookie is set only after you accept analytics above, holds no name or email, and disappears on its own after 90 days.
9. Children
Kitto is for site owners and businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
10. Changes
We update this policy when our processors or practices change. Material changes are emailed to account holders at least 14 days before they take effect; the date at the top shows the current version. Terms of use are in the Terms of Service.
11. Contact
Vladislava Zapechelniuk, an individual based in Georgia. Privacy questions: privacy@kittoseo.com. Everything else: support@kittoseo.com.