Privacy

Last updated: 25 September 2026

1. Who we are

HotSEO is provided by House of Devs BV, Frederiklaan 26, 2281 XN Rijswijk, the Netherlands (KvK 99680580). This policy explains how we handle personal data in the HotSEO app (app.hotseo.ai), on our website (hotseo.ai), and on pages shared from HotSEO. For privacy questions, contact info@hotseo.ai. This policy is available in Dutch and English. If they differ, the Dutch version prevails.

2. Our two roles

• Controller. We decide how and why we process data about our customers’ users, billing contacts, website visitors and prospects. This policy covers that data.
• Processor. Customers bring personal data into HotSEO: analytics from their sites, reviews, author names, and the content they write. For that data the customer is the controller and we act on their instructions, under our Data Processing Agreement. Questions about that data should go to the customer first.

3. What we collect and why

We do not sell personal data. We do not use it for advertising. We make no automated decisions about you that have legal or similarly significant effects.

4. People who are not HotSEO customers

• Authors and reviewers. When we crawl a customer’s site or read their review profiles, we may process names of authors on that site, and names and texts of public reviews. We do this for the customer, as processor. Our AI instructions tell the models not to name reviewers in generated content.
• Prospects. Before a business becomes a customer, we may run a performance scan of its public website. It covers search rankings, competitors, page speed and how AI assistants answer questions about the business. This is based on our legitimate interest in offering our services. It mostly concerns business data, but it may include names on the site. We share the resulting report with the business through a private link, valid for 90 days. We delete prospect data 12 months after the scan if no customer relationship follows. You can object at any time via info@hotseo.ai.
• People who receive a shared link or emailed report. We record that a shared report was viewed and when, not who viewed it. If a customer emails a report to you, we process your email address to send it.

5. Google user data

If you connect Google Analytics or Google Search Console, we request read-only access (analytics.readonly and webmasters.readonly). We read aggregated figures only: sessions, users, pageviews, engagement, clicks, impressions and positions per page, query and channel. We use them only to show you insights and to ground the content we generate for your site. This includes sending them to AI models for that purpose.

HotSEO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising. We do not sell it or use it to train AI models. People read it only with your consent, for security, or where the law requires it. You can revoke access at any time in HotSEO or in your Google account permissions.

6. AI processing

HotSEO generates content with large language models from third parties. We reach them through the AI provider listed in the annex. What we send depends on the task: your brand description and instructions, crawled page text, source figures, help chat questions or a voice recording. We send only what the task needs. We only use providers that do not train their models on the data we send. We keep a log of prompts and answers for 90 days to fix errors and control costs.

7. Who we share data with

We share personal data only with service providers who help us run HotSEO, under a data processing agreement. The current list is in the annex below. We also share data when the law requires it, or with a buyer in a merger or acquisition under the same protections. We tell customers about new subprocessors at least 30 days in advance.

8. Transfers outside the EEA

Some providers process data outside the European Economic Area, for example in the United States. We then rely on an adequacy decision (such as the EU-US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses, with extra measures where needed. You can ask us for a copy of the safeguards.

9. Security

All traffic is encrypted with TLS. Passwords are hashed. Access tokens for connected services and publishing credentials are encrypted in our database. We support two-factor authentication and passkeys. Staff access is limited to what their role needs, and support sessions are logged.

10. Your rights

You have the right to access, correct or delete your personal data, to restrict or object to processing, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time. Email info@hotseo.ai. We answer within one month. You can delete your user account yourself in your profile settings.

If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. Please contact us first so we can try to fix it.

11. Cookies

We use cookies that are needed to run HotSEO, and analytics cookies only if you agree. You can change your choice at any time with the “Cookie preferences” link.

We use Google Consent Mode. Advertising storage is always off. On hotseo.ai, Google Tag Manager loads on every page. Without your consent it sets no analytics cookies, but Google Consent Mode still sends limited signals without cookies to Google, such as that a page was viewed.

12. Children

HotSEO is a business service and is not meant for anyone under 16.

13. Changes

We may update this policy. We announce material changes by email and in the app before they take effect. The date at the top shows the latest version.

Annex: subprocessors