Privacy policy

1Data controller

The controller of your personal data within the meaning of Art. 4 point 7 of the GDPR is:

Visomedia Konrad Grodecki
ul. Trzebowiańska 9, 54-153 Wrocław
Tax ID (NIP): PL89427870
Email: info@sempuls.com
Phone: +48 518 080 457

Hereinafter referred to in this Policy as the "Controller" or "Sempuls". Sempuls is a SaaS platform for do-it-yourself SEO and AEO (Answer Engine Optimization), available at sempuls.com.

2GDPR contact

For matters related to the processing of personal data, you can contact the Controller by writing to info@sempuls.com with "GDPR" in the subject line, or by mail to the registered office address. We respond within 30 days of receiving your request.

3What data we collect

We collect the following categories of personal data:

• Account data: login (username), e-mail address, password (stored only as an irreversible bcrypt hash), first and last name or company name, optionally a phone number and avatar.
• SEO project data: domains whose SEO you monitor, keywords, page URLs, content analyzed by the AEO module, data from your Google Business Profile, including location, business category and reviews.
• Integration data: Google OAuth tokens (Search Console, Business Profile, Analytics) — these tokens are encrypted in the database and used solely to retrieve data from your accounts at your request.
• Technical data: IP address, browser and operating system type, login history, session identifier, time spent in the app.
• Billing data: for a paid subscription — invoice details (company name, tax ID, address), payment history and statuses. Payment card data is not stored by Sempuls — it is handled by our payment provider.
• Correspondence data: the content of messages sent to us, including through contact forms and e-mail.

4Purposes and legal bases for processing

We process data for the following purposes and on the following legal bases (GDPR):

5Who we share data with (processors)

To provide the service, we use the providers (sub-processors) listed below, to whom we entrust the processing of your data. Each provider is bound by data processing agreements (DPAs) that ensure GDPR compliance:

We do not sell your data. We do not share it with third parties for marketing purposes.

6Transfers of data outside the European Economic Area

Some providers (Google, DataForSEO, Anthropic, OpenAI) are based in the USA. Data is transferred to these entities on the basis of the Standard Contractual Clauses adopted by European Commission decision 2021/914, and in Google's case additionally on the basis of the Data Privacy Framework (EC decision of July 10, 2023). We apply additional technical measures (encryption in transit with TLS 1.3) and organizational measures (data minimization).

7Your rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — you can obtain a copy of your data.
• Right to rectification (Art. 16) — you can correct outdated data directly in the dashboard or by contacting us.
• Right to erasure (Art. 17, "right to be forgotten") — you can request deletion of your data after closing your account, except for data we are required by law to retain (e.g., invoices — 5 years).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — you can download your data in a machine-readable format (JSON/CSV).
• Right to object (Art. 21) — to processing based on legitimate interest.
• Right to withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal).
• Right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise these rights, write to info@sempuls.com. We respond within 30 days.

8Cookies and similar technologies

Sempuls uses cookies and similar technologies (localStorage, sessionStorage). We divide them into three categories:

• Necessary (always active) — the logged-in user's session (ai_share_sess), CSRF token, remembered selected project. The application does not work without them. Legal basis: legitimate interest — operating the service.
• Analytics (optional) — anonymous feature usage metrics (e.g., which modules are opened most often). Collected only with your consent. We use our own analytics mechanism without profiling.
• Marketing (optional) — if remarketing campaigns are launched (Google Ads, Facebook Pixel). Active only with your consent. Currently, we do not use any advertising pixels.

You can change your consents at any time in the site footer ("Cookie settings") or in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

9Automated decisions and profiling

Sempuls uses AI algorithms (including Claude models from Anthropic and Gemini from Google) to generate SEO content suggestions, AEO audits, Google Business Profile descriptions, and recommendations. These processes do not make decisions that produce legal effects concerning you or significantly affect your rights — they are only suggestions that you decide to implement or reject. We do not use automated profiling within the meaning of Art. 22 of the GDPR.

10Data security

We apply the following protection measures:

• Full transmission encryption (HTTPS / TLS 1.3) on all pages.
• Passwords stored as bcrypt hashes with an individual salt.
• OAuth tokens (Google) encrypted in the database.
• Restricted access for employees and contractors — only to the data necessary to perform their tasks, under agreements with a confidentiality clause.
• Regular backups and abuse monitoring (rate limiting, detection of anomalies in logins).
• Security updates for the server and PHP/JS libraries.

Despite exercising due care, no system is 100% secure. In the event of a personal data breach, we will report it to the President of the UODO within 72 hours and notify the affected individuals if the breach may result in a high risk.

11Is providing data mandatory

Providing data when registering an account is voluntary, but necessary to create an account and use Sempuls. Without an email address and password, we cannot create an account. Without invoice details, we cannot issue a billing document required by tax law.

12Data from Google services (Google API Services)

Sempuls connects to your Google accounts only at your explicit request, using the OAuth 2.0 protocol. We never ask for your Google account password and have no access to it. You can disconnect the integration at any time.

What permissions we request and why

We only request the permissions necessary for the features you use. Integrations are independent — you can connect only the services you choose.

Limited Use of data

Sempuls's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not sell data obtained from Google APIs, nor do we share it with data brokers, advertising networks, or credit-scoring companies.
• We do not use it to serve ads or to build marketing profiles.
• We do not use it to train or improve generalized artificial intelligence models. If data from your Google services is processed by our AI providers (listed in the "Who we share data with" section), this happens solely to generate recommendations, content, and analyses for your project, under agreements that prohibit using this data to train models.
• We do not allow humans to read this data, except where: you have given your consent (e.g., by reporting an issue to technical support), it is necessary for security or abuse-prevention reasons, applicable law requires it, or the data has been previously aggregated and anonymized for diagnostics and statistics.
• Data from your Google accounts is visible only to you and to people you have personally granted access to your project in Sempuls.

Data storage, disconnection, and deletion

We store OAuth tokens in the database in encrypted form and use them solely to regularly fetch data for your projects. We save data retrieved from Search Console and Analytics so we can show changes over time (ranking history, traffic trends).

You can disconnect an integration at any time in your project settings in the Sempuls dashboard — the token is then revoked and data fetching stops immediately. Independently of this, you can revoke the app's access directly in your Google account at myaccount.google.com/permissions.

We delete historical data retrieved from Google services when you delete the project or account in Sempuls, no later than within 30 days. You can request account deletion at any time by contacting us at the address given in the "GDPR contact" section.

13Changes to the Privacy Policy

We may update the Policy in the event of legal or technical changes, or changes to the service we provide. We will announce any material change by e-mail to registered users at least 14 days in advance. The current publication date is shown at the top of this page.