Privacy Policy

1. Information we process

• Account and profile: email, display name, contact phone number (optional, used only so the support team can reach you when needed), avatar, authentication information, role in the organization, time zone, date format, and the SEO branding information you enter, including logo, business name, address and contact details.
• Websites and SEO work: domain names, URLs, page content, keywords, goals, automation settings, content created or edited, action history and analysis results. The target audience profile you provide may include products/services, customer groups, needs, service areas, languages and development priorities.
• Google Search Console (GSC, formerly Webmaster Tools): the list of properties you can access, the selected property, clicks, impressions, CTR, search position by date, queries and pages; URL inspection status and sitemap information for the corresponding features.
• Google Analytics 4 (GA4): the list of accounts, properties and web streams so you can select the right website; aggregated metrics on users, sessions, page views, engagement, traffic channels, landing pages, devices, estimated country/city, device language and new/returning visitors by date range. The current GA4 reports do not require the identity, email or individual profile of any visitor, and do not retrieve age or gender.
• Connection information: OAuth authorization codes, access tokens, refresh tokens, and the API keys or connection details you provide for Google, AI, SerpAPI, WordPress or REST API. Tokens are used to authenticate requests to the corresponding service.
• Operations and support: IP address, request time, browser information, error logs and the content you send when you ask for help. Do not send passwords or secret keys in support emails.
• IPv4 address on the invitation page: if the connection uses IPv6, the browser calls ipify to determine the public IPv4 address. This request carries no cookies, sign-in information, invitation token or referring page address. The country of the IPv4 address is looked up on the HST SEO server; the address reported by the browser is used for display only and does not determine registration limits.

Provide only the data needed for your SEO work. Do not put sensitive personal information, passwords or customer data into keywords, URLs or AI request content.

2. Google access permissions

Connecting Google is your choice. The authorization screen provided by Google shows the permissions requested; your Google password is never entered into HST SEO.

• analytics.readonly: reads the list of properties, checks the web stream matching the domain and retrieves GA4 metrics. It does not change settings, create events or modify the Analytics account.
• webmasters.readonly: reads search performance and checks URL status on the selected Search Console property.
• webmasters: requested additionally when you choose to grant permission to submit sitemaps. This is the scope Google provides for write operations on Search Console; HST SEO uses this permission for the sitemap submission function that you carry out.

The full name of each scope begins with https://www.googleapis.com/auth/. These connections do not request permission to read Gmail, Drive or Calendar. Granting Analytics or Search Console access does not grant permission to publish or edit website content; content operations use a separate CMS connection.

3. Purposes of use

HST SEO processes information to maintain your account, manage access permissions and perform the features you use or enable for a website:

• Display rankings, search performance and website traffic in the application; compare between time periods.
• Export PDF, CSV and HTML reports with your branding, contact information and date/time preferences.
• Inspect URLs, submit sitemaps when permission is granted, identify SEO opportunities and measure goal progress.
• Analyze strategy, plan content and carry out actions within the mode, permissions, schedule and limits you set.
• Handle support requests, fix errors, protect accounts, prevent abuse and meet applicable legal obligations.

The GA4 connection only reads data already collected at Google; it does not install the Analytics tag on your website or create data for the period before the tag was installed.

4. Data and AI features

When you use AI analysis or enable automated SEO workflows, HST SEO may include relevant keywords, URLs, page content, goals and GSC/GA4 metrics in the analysis request. For example, AI may combine search clicks with organic sessions to prioritize a page that needs improvement.

AI may also compare aggregated traffic groups with the audience profile you provide, to suggest continuing to develop, adjusting or testing suitable content. Location is an estimate and language reflects the device; they do not identify a person, their residence or their purchase intent. HST SEO does not combine GA4 and GSC data into profiles of individual visitors. When data is sparse or restricted by Google, the result states that there is not enough evidence; SEO actions still follow the permissions and mode you have set.

The party processing the request may be OpenAI through a ChatGPT connection or the OpenAI API, or the Hason AI service, depending on the account and the AI route configured in the system. A fallback route may be used when the primary source is unavailable. Data is sent in order to return results for your SEO features; Google tokens and connection passwords are not included in AI request content.

HST SEO does not use Google user data, including aggregated or derived data, to build, improve or train shared AI/ML models. Strategy history and SEO results are stored to evaluate the work on your website; this is not training of shared models.

Processing through AI providers must serve a feature you have permitted and comply with the Google data limits in section 5. For AI accounts you connect yourself, you must use a configuration and terms of service that do not allow Google data to be used to train shared models. Contact support to identify the processing route before enabling AI if you need to limit the recipients of data.

You can stop scheduled runs, turn off automated activity and not launch new analyses. Disconnecting Google stops the ability to fetch new data using the deleted connection information; to also delete historical data and the stored AI context, follow section 8.

5. Data sharing and Google use limits

HST SEO's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. This commitment also applies to aggregated or derived Google data.

• Information may be accessed by members with permission in your organization and appears in reports that you choose to export or share.
• The storage and security infrastructure and the AI request processing services described in section 4 receive only the information needed to operate the feature. Google receives API requests; SerpAPI receives ranking-check queries; the CMS you connect receives the corresponding content requests. GA4/GSC datasets are not transferred to SerpAPI for use as an advertising service.
• Google data is transferred to another party only when necessary to provide or improve user-facing features you have permitted, to protect safety, to comply with the law, or in a business transfer after your prior consent.

We do not sell Google data; we do not use it for personalized advertising, retargeting, data brokering, credit scoring or lending decisions. Personnel do not read Google data unless you expressly agree for a specific support case, it is needed for secure handling, or the law requires it; aggregated metrics may support internal operations to the extent Google permits.

Parties processing data on behalf of HST SEO are subject to appropriate confidentiality obligations and use limits. Data may be processed where HST SEO's or the providers' infrastructure is located, including outside your country; the use limits above still apply. This policy does not allow recipients to expand the purposes of use on their own.

6. Protecting information

The public website and the application use HTTPS. HST SEO encrypts the connection information stored in the database, authenticates users and controls access by organization, website and role. Operational access is limited to what the work requires.

You should protect your account, enable two-step verification where possible and grant access only to people you trust. No system guarantees absolute security. If you suspect a key has been exposed or unauthorized access has occurred, revoke the related connection information and report it immediately at lienhe@hasontech.vn.

7. Retention period

• Profile and website data: kept while the account or website is maintained, to provide the service, compare history and support the goals you set. When a plan expires, the account becomes view-only. By default the account is locked 7 days after expiry and deleted, together with its private data on HST SEO, 30 days after expiry. Administrators can adjust or turn off the automatic schedule; specific dates are shown in the application and in notification emails. Renewing before deletion cancels the automatic expiry process. Organizations, other users and content already published on external websites are not deleted along with this account.
• Connection information: kept while the connection is in use; the disconnect action deletes the corresponding credentials from the active database.
• Google metrics and derived results: synchronized metrics, reports stored in the system, goal progress, analysis history and strategy context may continue to exist after disconnection so you can review them, until deleted under section 8.
• Logs, support requests and operational copies, if any: kept only as long as necessary for security, incident handling or legal obligations. When resolving a deletion request, we also review the related data in these systems; the portion that must be retained is limited in access and purpose.

Data no longer needed for the stated purposes will be deleted or de-identified as appropriate. If a retention exception applies to your request, we will explain its scope and reason when handling the request.

8. Disconnecting and requesting data deletion

Stop Google access

1. Go to HST SEO → Website settings → Connections, and choose to disconnect GA4 or delete the GSC connection information for the corresponding website.
2. To revoke the permission granted on Google's side, open Third-party connections in your Google Account, find HST SEO and remove its access. For a Service Account or manually entered keys, also manage the corresponding permissions and keys in Google Cloud/Search Console.

These two actions have different scopes: deleting the connection in HST SEO does not automatically remove the consent on your Google Account; revoking at Google does not automatically delete data already stored in HST SEO.

Delete data or close the account

You can delete a website in HST SEO if you have sufficient permission. To request deletion of all related data, Google data, AI history or your account, email lienhe@hasontech.vn with the subject “HST SEO data deletion request”, your account email, the website and the scope you want deleted. Do not send passwords, tokens or API keys.

We verify ownership or authority to represent, confirm the scope, stop the related processing and delete the stored data and the derived data within the scope of the request. Where a party processing on our behalf holds a related copy, the deletion request is also forwarded to that party. You will receive a response on the result or on any portion that must be retained under legal obligations.

Deleting data at HST SEO does not delete the original data at Google, report files you have already downloaded, or content already published on a CMS. You manage those copies in the corresponding service or device. We recommend exporting any data you want to keep before requesting deletion.

9. Browser storage and your website's Analytics

The application uses browser storage to maintain your sign-in session and interface choices. You can sign out or clear site data in your browser; clearing local data does not delete your account or the data on the server.

Connecting GA4 to read reports does not mean HST SEO tracks visitors on your website itself. If you install Analytics on that website, you are responsible for disclosing how data is collected, managing consent where required and respecting visitors' privacy choices. See how Google uses information from sites or apps that use Google services.

10. Your rights and contact

You can edit your profile, export reports, request access to or correction of data, request deletion, restrict processing or withdraw permissions you have granted, in accordance with your rights and applicable regulations. Withdrawing permission may cause dependent features to stop working. For organization data, we verify the requester's authority to avoid unauthorized disclosure or deletion of data.

HST SEO is intended for website management and SEO activities and is not directed at children. If you believe a child's information has been provided inappropriately, please contact us so we can review and address it.

Hason Tech — HST SEO
Website: hasontech.vn
Email for support, security and data requests: lienhe@hasontech.vn.

11. Changes to this policy

The current version is published on this page with its update date. For important changes affecting privacy, we notify you in the application or by email. If we need to access additional Google data or use data for a new purpose, we will update the information and obtain appropriate consent before doing so; updating this page alone does not replace the permission request step.