Version 2026-10, effective 6 October 2026. This is a translation; if it differs from the Dutch version, the Dutch version applies.
This policy explains which personal data Seylio processes, why, for how long and with whom we share it. It applies to the website seylio.com and to the application app.seylio.com.
Who we are
Seylio is a service of [legal company name], [address], registered with the Dutch Chamber of Commerce under number [KvK number]. For privacy questions, contact us at [email].
We are the controller for the data in this policy. For data you process in Seylio as a customer, such as the content of the websites you have analysed, you are the controller and we are the processor. See "Data from your websites" below.
What we process and why
Visiting seylio.com
- Technical data, such as IP address, browser and pages visited, in the server's log files. We use these to keep the site secure and available. Legal basis: legitimate interest.
- Statistics. Through Google Tag Manager we use Google Analytics to measure how the site is used. Analytics is configured privacy-friendly: IP addresses are shortened, we do not share data with Google for other purposes and a data processing agreement is in place. No consent is therefore required. Legal basis: legitimate interest.
- Marketing. We only use marketing and advertising cookies if you allow them in the cookie notice. Legal basis: consent.
Cookies
We use three kinds of cookies and similar techniques:
- Necessary: to make the site work and remember your cookie choice.
- Analytics: privacy-friendly statistics, as described above.
- Marketing: only with your consent.
You can change your choice at any time through "Cookie settings" at the bottom of every page.
Your Seylio account
- Account data: name, email address, password (stored only in hashed form), the secret key and recovery codes of the mandatory two-factor authentication, and your role within an account.
- When you accepted the terms of service, and which version.
- Use of the service, such as sign-in times, so we can detect misuse and keep the service secure.
Legal basis: performance of the contract, and our legitimate interest for security.
Payments and invoices
- Billing details: company name, address, country and, if provided, VAT number. VAT numbers from other EU countries are checked against VIES, the European Commission's VAT register.
- Payments are handled by Mollie. You enter card or bank details with Mollie; we never receive them. We store the payment status, amount and Mollie reference.
- Address lookup. If you enter a Dutch postcode and house number, we look up the street and city through an address service. Only the postcode and house number are sent.
Legal basis: performance of the contract and the statutory obligation to keep accounting records.
Google connections
When you connect Google Search Console or Google Analytics 4, we read performance data for your own website, such as clicks, impressions and sessions. The connection is read-only. Access tokens are stored encrypted. You can revoke access at any time in your Google account.
Data from your websites
Seylio analyses public pages of the websites you add, and the search and analytics data you connect. If these contain personal data, we process it on your behalf and on your instructions. The terms for this are in our data processing agreement, available on request.
Who we share data with
We never sell personal data. We only share it with service providers we need to deliver Seylio, and only as far as necessary. Each of them is bound by agreements on security and confidentiality.
- Hosting in the Netherlands, to run the application and the website.
- Payment provider: Mollie, to process payments.
- Email service, for confirmation links, invitations, reports and invoices.
- Google, for the Search Console and Analytics connections you set up yourself, and for statistics on seylio.com.
- Analysis services, including AI models, to analyse public pages and measure visibility in AI answers. Page content and search questions are sent, no account data.
- Address service, to look up street and city for a Dutch postcode.
Some service providers are outside the European Economic Area, mainly in the United States. In that case we rely on appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
If you are a customer and we process data on your behalf, the current list of sub-processors is in our data processing agreement.
How long we keep data
- Account data: as long as your account exists, and 30 days after that, so an account closed by mistake can be restored.
- Audit and analysis data: as long as the project is in your account.
- Invoices and payment records: seven years, as required by law.
- Server log files: 30 days.
Security
Two-factor authentication is mandatory for every user. Connections are encrypted, passwords and access tokens are stored encrypted, and staff only have access to what they need for their work.
Your rights
You have the right to access, correct or delete your data, to restrict or object to its processing, and to take your data to another party. Where you gave consent, you can withdraw it at any time. Send your request to [email]; we respond within one month.
If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
We update this policy when our service or the law changes. We tell you about important changes by email or in the application. The date at the top shows which version applies.