This policy explains what data SEO First Web collects when you use this site, why we collect it, who we share it with, and how to ask for a copy or have it deleted. We try to keep it short and plain-English. If anything is unclear, email us at info@seofirstweb.co.uk and we'll explain.

Who we are

SEO First Web is a London-based web design and SEO business. For UK GDPR / Data Protection Act 2018 purposes, we are the data controller for personal data submitted through this site. Contact: info@seofirstweb.co.uk.

What data we collect

We collect personal data in three situations only:

Consultation enquiries. When you send us an enquiry by email, on WhatsApp or by phone, we collect the name, contact details and message you provide so we can reply. The enquiry forms on this site do not send anything themselves: they open your own email app with your message written out, and nothing reaches us until you press send there. Nothing you type into them is stored on this site.
Orders and payments. When you buy a service through our Pricing page, the payment is processed by Stripe. Stripe collects the details it needs to take the payment and prevent fraud (such as your name, email, billing address and card information). We never see or store your full card number: we receive a confirmation of the order with your name and email, so we can deliver the service and meet our tax and accounting obligations.
Site analytics. Anonymous, aggregated traffic data via Vercel Analytics and Umami: pages viewed, country, device class, referrer, and counts of actions such as opening an enquiry in your email app or using a tool. No cookies set for analytics. No personal identifiers stored.

We never receive uploaded files. Every PDF, image and link-audit tool on this site runs entirely in your browser. Files are not transmitted to us. You can verify in DevTools → Network while using any tool.

Why we collect it

Four lawful bases under UK GDPR:

Consent: for the consultation enquiry.
Legitimate interest: for the anonymous analytics, used to improve the site.
Contractual necessity: to process and fulfil any order you place, and to deliver the services you've engaged us for.
Legal obligation: to keep order and payment records for the period HMRC requires.

Who we share it with

We use a handful of trusted third parties to actually deliver this site and our tools. None of them sell your data. Each handles only the slice of data they need:

Stripe (United States and Ireland, GDPR-compliant, PCI-DSS certified payment processor), online payments. Sees: the payment and billing details you enter at checkout, plus your name and email. Stripe is the only party that handles your card details; we never receive them. Stripe's own privacy policy explains how it processes payment data.
Vercel (United States, GDPR-compliant data processor), hosting and analytics. Sees: requests to the site, IP for rate-limiting.
Umami (GDPR-compliant, cookieless), site analytics. Sees: pages viewed, referrer, country, device class and anonymous action counts. No cookies, no personal identifiers.
WhatsApp (Meta Platforms Ireland), messaging. If you choose to message us on WhatsApp, Meta processes the message under its own privacy policy and we see your name, number and what you send. Nothing on our website sends data to WhatsApp until you tap the button.
Upstash Redis (Ireland EU region), per-IP rate limiting on the free tools. Sees: your IP address (hashed for some tools) and a request count, kept only for the limit window (up to one day).
Serper.dev (United States, GDPR-compliant), Google SERP data for the SERP Checker, KD Estimator and Index Checker tools. Sees: the keywords or URLs you submit, no personal data.
Google Suggest (United States, Google's standard privacy terms apply), keyword suggestions for People Also Ask Finder and Keyword Suggestion Tool. Sees: the keywords you submit.
Google Gemini / Anthropic Claude (United States, GDPR-compliant when used via API). Powers the Title & Meta Generator, Content Brief Generator and Social Preview AI suggestions. Sees: the text you submit for processing.
Google PageSpeed Insights (United States), Lighthouse scores for the SEO Audit. Sees: the URL you submit.
Public data sources for the free tools: OpenPageRank, Google's Chrome UX Report, RDAP and WhoisXML domain records, Wikidata, Mozilla's HTTP Observatory, the Internet Archive's Wayback Machine and the W3C HTML validator (for the Ranking Diagnostic and the SEO Audit), and IndexNow (for the IndexNow tool). Sees: the web address or domain you check, no personal data.

We don't use a server email service. When you email us, or send an enquiry form from your own email app, the message goes straight from your email provider to our business inbox.

We never share enquiry data with anyone for marketing, advertising or any purpose unrelated to fulfilling your request.

How long we keep it

Consultation enquiries: kept for up to 24 months after our last contact, then deleted. Active client correspondence is kept for 6 years after the engagement ends (HMRC requirement).
Order and payment records: kept for 6 years after the transaction, as required by HMRC for tax and accounting. Card details are held by Stripe, never by us.
Analytics: anonymous, retained for 12 months by Vercel, then aggregated. Umami keeps its anonymous data for the retention period of our plan.

Your rights

Under UK GDPR you have the right to:

Request a copy of the personal data we hold about you
Ask us to correct anything inaccurate
Ask us to delete your data (the "right to be forgotten")
Withdraw consent for any of our processing
Object to legitimate-interest processing (analytics)
Lodge a complaint with the UK Information Commissioner's Office at ico.org.uk

To exercise any of these rights, email info@seofirstweb.co.uk. We respond within one month, as UK GDPR requires.

Cookies

This site does not set tracking cookies. The only browser storage we use is localStorage for tool preferences you explicitly set: your starred keyword suggestions, quiz results-in-progress, the broken-link-checker's "known-issue" markers. This data never leaves your device.

Children

This site and its services are intended for business owners, marketers and consultants, all adults working professionally. We don't knowingly collect data from anyone under 16. If you believe we hold data about a child, email us and we'll delete it.

Changes to this policy

If we change anything material, we'll update the "Last updated" date at the top of this page. Significant changes affecting how we use existing data will be notified to anyone we hold an email address for.

Contact

Any questions, requests or complaints: info@seofirstweb.co.uk.

Privacy Policy