Data Processing Policy

Last updated: July 30, 2026

This Data Processing Policy describes how SEOLark processes personal data and user-submitted data when providing its website, accounts, tools, reports, subscriptions, support, security, and administration. SEOLark is an independently owned SaaS platform operated by Shafiq Ur Rehman as a sole proprietor in Lahore, Punjab, Pakistan. This policy should be read together with our Privacy Policy, Cookie Policy, and Terms and Conditions. It is a public policy statement, not a signed enterprise Data Processing Agreement — see Section 21 below if you need one.

1. Roles and Responsibilities

SEOLark determines how personal data is processed for its own website, accounts, security, support, subscriptions, administration, and platform operation. When you submit third-party data into a tool — for example, a client's website URL or a business's public listing — you are responsible for having lawful authority to submit and process that data. Depending on the context and the data involved, SEOLark's role in relation to a given piece of data may vary; we do not claim to act only as a controller or only as a processor in every situation.

2. Paddle and Payment Data

Paid transactions are currently processed through Paddle, which acts as the Merchant of Record. Paddle independently processes buyer, payment, tax, fraud-prevention, subscription, refund, and dispute data under its own privacy obligations. SEOLark may receive limited transaction and subscription metadata from Paddle where necessary to activate and manage your access. We do not directly store your complete payment card details when checkout is processed through Paddle. If business or technical requirements change, additional payment providers may be added in the future — we do not name or describe any provider that is not actually in use, and this policy will be updated before or when any new provider is introduced.

3. Categories of Data Processed

Account Data

Name, email address, password hash, account role, account status, profile and organisation details you provide, and login and email-verification timestamps.

Tool-Input Data

Data you submit to use a tool, which may include URLs, domains, keywords, text, uploaded images or video files, and YouTube or Google Business Profile identifiers, depending on the specific tool.

Tool-Output Data

Scores, findings, recommendations, reports, exported files, report share links, processing status, and related usage records.

Technical and Security Data

IP address, browser/user-agent information, session information, device-security data used to help detect unusual account activity, and authentication, security, and activity logs.

Support Data

Contact-form messages, emails, screenshots or attachments you send us, and related support history.

Billing and Subscription Metadata

Plan, billing cycle, transaction and subscription identifiers, amount, currency, payment status, and renewal, cancellation, refund, dispute, or chargeback status, as received from Paddle.

4. Purposes of Processing

Account creation and authentication
Providing tools and generating reports
Enforcing plan limits and fair usage
Subscription activation and synchronisation with Paddle
Customer support
Security, fraud prevention, and abuse detection
Error diagnosis and service reliability
Transactional communication
Legal, tax, accounting, dispute, and compliance obligations
Product and operational improvement based on how the platform is actually used

5. Legal Basis

Where applicable law requires a legal basis, we rely on one or more of: performance of a contract with you, our legitimate interests, your consent, compliance with a legal obligation, or the protection of legal rights, users, and platform security. We do not make jurisdiction-specific legal guarantees in this policy.

6. User Instructions and Submitted Data

SEOLark processes the data you submit in order to perform the tool operation you request. You must not submit data you do not have authority to use, and you remain responsible for the legality, accuracy, and appropriateness of any data you submit. We may reject, restrict, delete, or suspend processing of data or requests that violate our Terms, Acceptable Use Policy, Fair Usage Policy, or applicable law.

7. Third-Party Services and Subprocessors

Depending on the tool or feature you use, we may send relevant data to:

Paddle, for payment processing and subscription management
Hosting and infrastructure providers who operate our platform
An email-delivery provider we configure, for transactional email
Google APIs and OAuth, including the YouTube Data API and Google Business Profile / Google Places APIs, when you connect an account for a specific tool
A search or website-analysis data provider used by certain SEO tools
A configured AI processing provider (currently Google's Gemini API) for AI-powered tools

Each provider processes data under its own privacy policy and terms. We do not publish API keys, environment configuration, or other security-sensitive infrastructure details in this policy.

8. AI Processing

Not every tool uses AI. For tools that do — such as our AI writing, humanizing, paraphrasing, or content-detection tools — the text you submit may be sent to our configured AI processing provider (currently Google's Gemini API) to generate the requested output. We do not claim that your data is used to train external AI models, and we do not guarantee zero data retention by that provider, since that is governed by the provider's own terms.

9. International Data Processing

SEOLark operates from Pakistan. Our service providers and users may be located in other countries, so personal data may be processed outside your own country. Where required, we use appropriate contractual, technical, organisational, or legal safeguards for such processing. We do not claim a specific certified transfer mechanism unless one is actually in place.

10. Confidentiality and Access

Access to personal data is intended to be limited to authorised personnel and service providers who need it for the purposes described in this policy. You are responsible for maintaining the security of your own account and login credentials.

11. Security Measures

We apply reasonable technical and organisational measures, including HTTPS, password hashing, authentication controls, role-based access, CSRF protection, session security, and security-event logging. No method of transmission or storage is completely secure, and we do not claim absolute security. We do not hold, and do not claim, certifications such as ISO 27001, SOC 2, PCI DSS, or HIPAA, and we do not claim a specific encryption-at-rest standard; any certifications Paddle holds belong to Paddle, not to SEOLark.

12. Data Retention

We retain different categories of data for different reasons rather than a single fixed period:

Account data is retained while your account remains active
Reports expire and are automatically removed according to your plan's retention rules
Uploaded files and generated media (such as video-tool outputs) have their own tool-specific expiry and automatic cleanup rules
Security, authentication, audit, billing, tax, fraud-prevention, and dispute-related records may be retained where reasonably necessary, including after account deletion
Support records are retained while reasonably necessary to resolve and document requests
Backups may retain deleted data until removed by our normal backup rotation cycle

13. Account Deletion

Account deletion and subscription cancellation are separate actions. You can permanently delete your own account from your account settings after confirming your password; this immediately removes your primary account record. Certain billing, security, fraud-prevention, legal, audit, tax, and dispute-related records may remain after account deletion where necessary, and we do not guarantee immediate removal from every backup copy.

14. Data Subject Requests

You may contact support@seolark.com to request, where applicable, access, correction, deletion, restriction, objection, portability, or withdrawal of consent regarding your personal data. We may require reasonable identity verification before acting on a request. These rights may be limited by legal, security, fraud-prevention, accounting, dispute, or contractual obligations. We do not currently offer a dedicated automated privacy-request portal — requests are handled by our support team.

15. Data Breach and Incident Response

If we become aware of a security incident affecting personal data, we will investigate, contain, and mitigate it, and document what occurred. Notifications will be provided where legally required. We do not commit to a fixed notification deadline beyond what applicable law requires.

16. Business and Agency Accounts

Agency users may provide information about team members or clients when using agency features. The account owner or organisation is responsible for having authority to provide that information to us. Please do not upload unnecessary personal or confidential data. We do not offer a formal enterprise Data Processing Agreement workflow through the platform itself — see Section 21.

17. Public Sharing

Some reports can be shared using a link you choose to generate and enable; anyone who has that link can view the shared report. You are responsible for deciding what you make accessible this way, and you should disable sharing once it is no longer needed.

18. Sensitive Data

Please do not submit passwords, complete payment card details, government identification numbers, medical records, or other highly confidential personal information, or any data you are not authorised to process, through our tools or support channels. We cannot guarantee that our systems will automatically detect or block every type of sensitive data.

19. Changes to This Policy

We may update this policy as our services, providers, payment setup, data practices, or legal obligations change. Our currently active payment setup uses Paddle only; if we add another payment gateway, we will update this policy before or when it is introduced. The date of the most recent update is shown at the top of this page. Nothing in this policy overrides any mandatory legal rights you may have.

20. Data Processing Agreement Requests

We do not offer a standard Data Processing Agreement automatically. Business customers who need one, or who have specific data-processing requirements, may contact support@seolark.com to discuss them. Any DPA or additional contractual terms must be separately agreed in writing, and we do not commit in advance to accepting every requested term.

21. Related Policies

22. Contact

Support: support@seolark.com