Last updated 24 August 2026. What we collect, why, and how to get rid of it.
[Legal entity name], [Registered address], is the data controller. Privacy questions and deletion requests go to hello@swoopseo.com.
When you request a free audit: your email address, business name, website, and optionally a phone number and Google Business Profile link. We crawl the public pages of the website you submit.
When you create an account: your name, email address, business name, and a password. We never store the password itself — only a scrypt hash of it, which cannot be reversed back into your password.
When you subscribe: Stripe collects and processes your payment details. Card numbers never reach our servers. We keep your Stripe customer identifier, your plan, and your subscription status.
Automatically: marketing attribution parameters (utm_*, gclid) if you arrived from an ad, and standard server logs. Log entries about email addresses are stored as a one-way hash, not the address itself, so our operational logs cannot be mined for contact details.
To run the audit you asked for and email you the report; to provide and support your subscription; to take payment; to send the transactional email the service depends on; and to meet our tax and accounting obligations. Our lawful bases are performance of a contract, our legitimate interest in operating and securing the service, and consent where you have given it.
Requesting an audit does not sign you up to a mailing list. Transactional messages — your confirmation link, your report, your monthly report, account and billing notices — are part of the service and are sent regardless. Any marketing email is separate, is only sent with your consent, and every one carries an unsubscribe link.
We keep this list short on purpose. Each of these is a processor acting on our instructions:
We do not sell personal data, and we never have.
Audit requests and their reports: 24 months, so you can compare against earlier months. Account records: for as long as the account exists, then 30 days. Billing records: seven years, because tax law requires it. Server logs: 90 days.
You can ask us for a copy of your data, to correct it, to delete it, or to stop processing it. Email us and we will act within 30 days. Deleting your account removes your personal data other than the billing records we are legally required to retain.
If you are in the UK or EU you may complain to your data protection authority. If you are in California, you have the right to know, to delete, and to opt out of sale — and as above, we do not sell data.
Two kinds, and only two. A strictly necessary cookie holds your sign-in session; without it you cannot stay signed in. Analytics and advertising cookies are optional and are only set if you consent to them.
Cloudflare Turnstile runs on our audit form to tell humans from bots. It is designed not to track you across sites and does not use cookies for advertising.
Traffic is encrypted in transit. Passwords are stored as scrypt hashes. Session tokens are stored only as hashes, so a copy of our database cannot be replayed as a login. Audit reports are reachable only with a signed link or a signed-in account that owns them.
This is a service for businesses. It is not directed at anyone under 16 and we do not knowingly collect their data.
If we change this policy materially, we will email account holders before the change takes effect. The date at the top always reflects the current version.
See also our Terms of Service.
