Privacy Policy

This is the Privacy Policy for Corgi ("Corgi", "we", "us"), the SEO data fetch service operated by Corgi SEO. It explains what information we collect, why we collect it, and what we do with it.

Plain-English version: I am a dog. I store your provider credentials so I can fetch SEO data on your behalf. I do not sell your data. I do not put it in a marketing newsletter. I do not feed it to a recommendation engine.

1. Information we collect

We collect three categories of data:

• Account information. When you install Corgi for Slack or sign up for the dashboard, we receive your name, email, workspace ID, and basic OAuth profile from Slack or Google.
• Provider credentials. If you connect Google Search Console, DataForSEO, Ahrefs, SerpAPI, or any other supported provider, we store the necessary tokens or keys in our encrypted vault. We never store these in plaintext, never log them, and never expose them through our API.
• Usage data. We log which commands were run, how long they took, and whether they succeeded. We use this only to operate, debug, and improve the service.

2. How we use it

• To fetch the SEO data you ask for, on your behalf, against the providers you've connected.
• To bill the right account for the right plan.
• To respond when you contact support.
• To detect abuse, debug failures, and keep the service running.

That's it. We don't use your data to train models, profile users, or build advertising audiences.

3. Sharing

We share data only in narrow, expected circumstances:

• With the providers you've connected, exclusively to make the API calls you've asked for. Your queries flow to Google, DataForSEO, Ahrefs, etc., as part of normal service operation.
• With our infrastructure providers (hosting, payments, error monitoring) under standard data-processing agreements. Current sub-processors are listed below.
• When required by law, in response to a valid legal request.

4. Sub-processors

• Stripe — payments
• Vercel / Cloudflare — hosting and CDN
• Slack — bot transport
• Sentry — error monitoring
• PostgreSQL on managed cloud — application database

This list may evolve. Material changes are reflected by updating this page and bumping the "Last updated" date above.

5. Retention

Account and credential data are retained while your account is active. If you delete your account, credentials are purged within 7 days and account records within 30 days, except where retention is required for legal, tax, or fraud-prevention purposes.

Cached query results have short, automatic expiries (typically minutes to days, depending on the data type) to keep responses fast without holding more than necessary.

6. Your rights

You can: export your data, delete your account, rotate or revoke any credential, and request deletion of specific records. Email [email protected] and we'll handle it within 30 days. EU and UK users have additional rights under GDPR; California residents under CCPA. We honor all of them.

7. Children

Corgi is not intended for users under 16. We do not knowingly collect data from children.

8. International transfers

Corgi is operated from infrastructure located in the EU and the US. By using the service you consent to your data being processed in those jurisdictions, with appropriate safeguards under standard contractual clauses where required.

9. Security

We encrypt credentials at rest using KMS-managed keys, encrypt data in transit with TLS, scope access on a least-privilege basis, and rotate operator credentials on a regular schedule. We're a small team and we take security seriously, but no system is invulnerable. If you discover a vulnerability, please report it to [email protected].

10. Changes

We'll update this policy when our practices change. Material changes get communicated by email to active customers at least 14 days before they take effect.

11. Contact

Questions? Email [email protected]. A human will reply. *promise*