Privacy Policy

1. Data controller and scope

SEO RAISER is operated by Raul Manuel da Silva Peixoto, entrepreneur individuel (EI), registered as Peixoto Raul, SIREN 928 982 909, 33 avenue Philippe-Auguste, 75011 Paris, France. Contact us about privacy at [email protected]. This policy applies to visitors and customers worldwide, whether acting as a business or as an individual.

We are the controller for personal data used to operate this website, our accounts, support, billing and services. When we host or maintain a customer's website, we may also process information on that website on the customer's instructions. In that case the customer is generally the controller for its website data and we act as its processor. This policy describes our own controller processing; the customer remains responsible for explaining its own website practices.

2. Information we use

Depending on how you use the site or services, we process contact and identity details such as your name and email address; account, authentication and preference data; company, billing address, country and tax details; orders, subscription and payment status, invoices and receipts; accepted quote and terms versions, records of any express consent or request for early performance, order delivery and cancellation evidence; support messages and files attached to account tickets; and service configuration and website identifiers needed to provide hosting or WP Raiser. We also process technical and security data such as IP addresses, user agents, session and login records, and information about requests made to our services.

Some information is needed to answer a request, create an account, provide a service or complete a purchase. If you do not provide required information, we may be unable to respond, set up the account or service, or process the transaction. Optional fields are identified where they appear.

3. Purposes and legal bases

• Requests, accounts and services: to answer requests, provide hosting and software services, manage accounts and subscriptions, and provide support. The legal basis is taking steps at your request before a contract and performing our contract with you (GDPR Article 6(1)(b)).
• Payments and billing: to take and reconcile payments, manage subscriptions, issue invoices, receipts and credit notes, and keep required transaction evidence. Contract performance applies to payment administration; legal obligations apply to records we must retain (Article 6(1)(b) and (c)).
• Security and service administration: to protect accounts and services, prevent abuse, maintain availability, troubleshoot and administer our systems. We rely on our legitimate interests in operating a secure service, balanced against your rights and expectations (Article 6(1)(f)).
• Enquiries and communications: to respond to contact messages and manage support conversations. We rely on our legitimate interest in handling and documenting enquiries, or on steps requested before entering a contract where the enquiry concerns a potential purchase (Article 6(1)(f) or (b)).
• Withdrawal requests: when you withdraw from a contract through our withdrawal form or by email, we record your name, email address, the invoice concerned, your statement, the date and time we received it, our decision and any refund. We use this to handle your withdrawal and refund, send you the acknowledgement the law requires, keep the supporting record for the refund in our accounts, and establish, exercise or defend legal claims. We rely on compliance with a legal obligation (Article 6(1)(c)) and our legitimate interest in defending legal claims (Article 6(1)(f)).
• Contract records and legal claims: to record the terms and quote accepted for an order, any separate express consent or early-performance request, delivery and cancellation, and to establish, exercise or defend legal claims. We rely on contract performance or pre-contractual steps (Article 6(1)(b)) and, where appropriate, our legitimate interests in establishing, exercising or defending legal claims (Article 6(1)(f)). Where a law requires retention, we rely on compliance with a legal obligation (Article 6(1)(c)). These records are not retained on the basis of GDPR consent.

When you contact us on behalf of a business, we rely on our legitimate interest in managing that business relationship for your professional contact information.

We do not use personal data for advertising or analytics tracking. We do not make decisions about you solely by automated means that produce legal effects or similarly significant effects.

4. Payment and location evidence

Payments and subscriptions may be processed by Stripe, PayPal or Revolut. For Revolut card subscriptions, Revolut stores your card and we initiate each renewal charge; Revolut also stores any card you choose to save for later purchases. An invoice may also offer a PayPal, Wise or Revolut payment link; if you pay through one, that provider handles the payment under its own terms. If you separately engage us through Upwork, that transaction is handled on Upwork under its own platform terms and privacy information; it is separate from purchases made through this website.

Payment details are transmitted through the chosen payment provider's secure payment flow. We do not ask you to send card numbers or security codes through contact forms or support tickets. Our platform receives payment references, status and the billing information needed to administer the purchase, rather than storing your full card number or security code.

For website purchases, we record the declared billing country and available transaction-location evidence, such as the purchase IP address and country and, for card payments where supplied by the provider, the card's issuing country. This evidence supports our tax obligations.

The legal basis is compliance with a legal obligation (GDPR art. 6(1)(c)), not consent or legitimate interest, so this particular data cannot be removed on request while the retention period below is running. It is never used for advertising, profiling, or scoring, and a country that does not match your billing address never blocks a purchase - travelling and using a VPN are entirely normal.

5. Service providers and international transfers

We share information with service providers only as needed for their role. These categories include hosting and infrastructure, transactional email delivery, platform backups, content delivery and security, and payment processing (Stripe, PayPal, Revolut and, for invoice payment links, Wise, as described above). Cloudflare provides content delivery and security services. We do not sell or rent personal data.

Our website, platform and platform backups are hosted in the European Economic Area (EEA). Customers using managed hosting can select from available hosting regions worldwide; the hosting and backup location for that service is agreed with the customer. Some providers, including Cloudflare, operate globally and may process information outside the EEA. Where personal data is transferred outside the EEA, the transfer is subject to applicable GDPR transfer requirements and safeguards, such as an adequacy decision or appropriate contractual safeguards. You can contact us for information about the safeguards relevant to a transfer.

Providers process information to deliver their services to us and may have their own legal obligations. Their processing is also governed by their applicable privacy information and, where relevant, our arrangements with them.

6. Retention

Account data and account support tickets are kept while your account exists. Public contact-form enquiries and their conversation history are automatically deleted after 90 days without a new message from you. Each new message from you restarts that period; replies from our team do not. Enquiries moved to trash may be deleted sooner.

Accepted quote and terms versions, records of any express consent or request for early performance, and evidence of order delivery or cancellation are retained only for the applicable lawful period needed to administer the contract, meet a legal retention duty, or establish, exercise or defend legal claims. Where a record is also a required accounting or tax document, the statutory retention periods below apply. These contract records are kept separately from public contact-form enquiries subject to the 90-day cleanup above.

Withdrawal requests, our replies and the related refund records are kept for ten years after the request, as supporting records for our accounts (Code de commerce, art. L123-22) and to handle any claim about the withdrawal. They are then deleted automatically.

After account closure, we delete or anonymize information no longer needed. Records required for accounting, an unresolved complaint or the establishment, exercise or defence of legal claims are retained separately for the applicable legal period, with access limited to those purposes.

Our platform backups are retained for up to 30 days. Deleted data may remain in those backups until they expire. Managed-hosting backup retention is agreed separately with each customer, up to 90 days.

Billing records - invoices, receipts, credit notes, and the location evidence described above - are retained for the periods French law requires: six years for documents the tax authority may demand (Livre des procédures fiscales, art. L102 B) and ten years for accounting records and supporting vouchers (Code de commerce, art. L123-22). The longer period applies where a record is both. Periods run from the end of the year in which the document was issued, and records are kept for as long as the contract they belong to is still running (an active service or subscription, an unpaid invoice, an open balance or a pending withdrawal). Once the period has run and nothing is ongoing, these records are deleted, together with the related order confirmations and payment records.

Application security and abuse-prevention records are removed after one year without further activity. Known login IP addresses are retained for up to 60 days. Expired sessions and verification tokens are cleaned up separately. Retention cleanup runs hourly. These operational records are separate from legally retained billing evidence. Provider, external mailbox, system, CDN and backup logs may follow the provider's own retention schedules.

When WP Raiser performance monitoring is enabled, performance history is retained for up to six months per site while its license is active. The site identifier, check date, scores and metrics are stored. We do not use this information to track individual visitors.

7. Your privacy rights

Depending on the circumstances and applicable law, you may ask us to access your personal data, correct it, erase it, or restrict how we use it. You may object to processing based on our legitimate interests. You may also request a copy of information you provided to us in a commonly used, machine-readable format where the right to data portability applies. These rights are subject to legal conditions and exceptions, including our obligation to retain certain billing records.

Where we rely on consent, you may withdraw it at any time. To exercise a right or ask a question, email [email protected] or use our contact page. We may ask for information to verify your identity. We acknowledge ordinary support requests within one business day; that is an acknowledgment target, not a guarantee that a privacy request will be resolved within that period. Under the GDPR, we normally respond to a rights request within one month, subject to permitted extensions and other legal requirements.

You may also lodge a complaint with the French data protection authority, the CNIL, or with the supervisory authority where you live or work in the EU, or where you believe a breach occurred.

8. Cookies and browser storage

We use no advertising or analytics trackers. The seoraiser_session cookie keeps you signed in for up to 14 days. The sr_currency cookie remembers the currency shown on public pages for up to one year. The sr_cookie_notice cookie remembers dismissal of our cookie information notice for one year; dismissal is not consent to tracking or acceptance of our service terms.

Browser local storage remembers your dashboard sidebar preference until cleared. Administrators also have a one-year currency-preference cookie. Cloudflare may use security cookies to protect the site. When enabled, Cloudflare Turnstile protects login, signup, password recovery and contact forms against spam and abuse. There are no analytics or advertising trackers.

You can remove cookies and browser storage in your browser settings. Removing authentication cookies signs you out; removing preference cookies resets those preferences.

9. WP Raiser performance monitoring

For a site with an active WP Raiser license, daily performance measurements are requested through our API.

We store the site identifier, check date, performance scores and performance metrics for up to six months per site while its license is active. The WP Raiser plugin retrieves these results from our API. These measurements describe the tested page's performance and are not visitor tracking.

This processing provides the site's performance-monitoring service; it is not used for advertising or tracking individual visitors across websites.