Privacy Policy

Last updated: 23 October 2026

This Privacy Policy is the personal data protection notice of AI SEO Malaysia ("we", "us" or "our") under the Personal Data Protection Act 2010 of Malaysia, as amended ("PDPA"). It explains how we process personal data when you use the website at https://checker.aiseo.com.my, the AI SEO web application at https://app.checker.aiseo.com.my, and the related MCP server, plugins and free tools (together, the "Service").

This notice is also provided in Bahasa Malaysia at the end of this page.

1. Who we are

AI SEO Malaysia is the data controller for the personal data described in this policy.

• Contact person: Jason
• Email: jason.aiseo@gmail.com
• WhatsApp: +60 14-933 6284 (username: aiseo.my)

2. Personal data we collect

Information you give us

• Account details: your name, email address, and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Organisation details: your organisation name, the team members you invite, and their roles.
• Project content: the websites, competitors, keywords, saved context, reports, prompts and AI assistant conversations you add to or generate in the Service.
• Billing and usage details: your plan, payment status, credit balances and usage history (which features used credits, how many, and when), billing name and address, and tax ID if you provide one. Card details are collected and stored by Stripe, not by us.
• Communications: messages you send us, and your email address if you sign up for our newsletter.

Information collected automatically

• Usage and device information: pages and features you use, the referring URL, browser type, device type, operating system, approximate location derived from your IP address, and the date and time of access.
• Logs and security data: IP addresses and request logs used to keep the Service secure, prevent abuse and enforce rate limits, and bot-protection signals from Cloudflare Turnstile.
• Product analytics: in the web app, including the sign-in and sign-up pages, PostHog records product analytics, error reports and, to help us fix bugs, session replays. Session replays mask form inputs and all on-screen text. This browser analytics starts only after you allow it, and you can change your choice at any time under Settings > Privacy and emails. Our servers still send PostHog a limited set of usage events linked to your account ID (for example, the features and agent tools you use, credits consumed and errors) so we can run billing, prevent abuse and fix problems.

Information from third parties

• Google: when you sign in with Google or connect Google services. See section 6.
• Referral partners: if you arrive through a partner link, a referral identifier so the partner can be credited.

Giving us your account details and, for paid plans, billing details is necessary to use the Service; without them we cannot create your account or process your subscription. Other information is optional, but some features will not work without it (for example, Search Console reports need a connected Google account).

3. Why we use your personal data

We use personal data to:

• create and secure your account and authenticate you;
• provide the features you request, including research, audits, rank tracking, reports, and AI assistant answers;
• process payments, manage subscriptions and usage credits, and prevent payment fraud;
• send service emails such as verification, password reset, invitations, billing and security notices;
• provide support and respond to your enquiries;
• monitor, debug and improve the Service, and understand how it is used;
• detect, prevent and investigate abuse, fraud and security incidents;
• send product updates and offers, unless you opt out; and
• comply with legal obligations and enforce our Terms.

We do not sell your personal data.

4. Who we disclose personal data to

We disclose personal data to these classes of third parties:

1. the service providers listed below, which process it to run the Service;
2. other members and admins of your organisation in the Service;
3. anyone you give a public share link to a report, until you revoke the link;
4. AI assistants and MCP clients you connect, which receive the data you request through them;
5. Google, when you sign in with Google or connect a Google integration;
6. referral partners, who receive a pseudonymous record that an account they referred signed up and paid, and the amount paid;
7. our professional advisers, such as lawyers, accountants and auditors; and
8. courts, regulators and government authorities where the law requires it, or a buyer or successor if our business is sold or restructured (who must protect it in line with this policy).

Our service providers are:

5. Transfers outside Malaysia

Several of our service providers store or process personal data outside Malaysia, including in the United States, the European Union and other countries where their infrastructure or the AI model providers they use are located. We transfer personal data outside Malaysia only as permitted by section 129 of the PDPA: where the destination has a law substantially similar to the PDPA or ensures a level of protection at least equivalent to it; where the transfer is necessary to perform our contract with you (such as hosting, payments and generating the results you request); where you have consented; or where we have taken all reasonable precautions and exercised due diligence, including contractual data protection and security commitments from our providers, to ensure the data will not be processed in a way that would breach the PDPA if it were processed in Malaysia.

6. Google user data

You may choose to sign in with Google, or to connect Google services such as Google Search Console and Google Analytics to the Service. When you do, the Service accesses Google user data through Google's APIs with your authorisation. This section describes how we handle that data, in addition to the rest of this policy.

What Google user data we access. If you sign in with Google, we receive your basic account information (name, email address, and profile picture) to create and authenticate your account. If you connect Google Search Console, we access search performance data for the sites you authorise, such as queries, pages, clicks, impressions, and average positions, as well as URL inspection results. If you connect Google Analytics, we access report data for the property you select, such as traffic and acquisition metrics, landing page and page performance, key events, ecommerce outcomes, site search terms, and audience breakdowns by device and country, along with property configuration details such as your list of properties, data streams, and measurement settings. We also receive the email address of the connected Google account so we can show you which account is linked. All Google API scopes we request for these integrations are read-only; we cannot modify data in your Google account.

How we use it. We use Google user data solely to provide the user-facing features of the Service that you request: showing connection status, generating SEO reports and insights, and returning data you ask for through the Service, including through AI assistants and MCP clients that you explicitly connect. We do not use Google user data for advertising, and we do not use it to develop, improve, or train generalized AI or machine learning models.

How we share it. We do not sell Google user data, and we do not transfer it to data brokers or advertisers. Google user data leaves our systems only in these cases: (a) when you connect the Service to an AI assistant or other MCP client and request data through it, the results are returned to that client, whose own privacy terms then apply; (b) when you use the in-app AI assistant, relevant data may be processed by an AI model accessed through OpenRouter in order to generate your response; (c) our infrastructure and database providers host the systems that process and store this data on our behalf; and (d) when you create a public share link to a saved report, anyone with the link can view that report, including any Search Console or Analytics figures in it, until you revoke the link. Session replays mask all on-screen text, so Google data is not included in them.

How we store and protect it. The OAuth tokens that grant access to your Google account are stored encrypted at rest, and all data is transferred over encrypted connections (TLS). We fetch Search Console and Google Analytics data from Google when you, or an agent you connect, ask for it. We keep copies only in these places: (1) a short-term cache of your Search Console query data used by the project dashboard, deleted within 7 days; (2) reports you save, which may include Search Console or Analytics figures; (3) your conversations with the in-app AI assistant, which include the data its tools returned; and (4) notes you or the assistant save to the project's context. These copies are visible only to members of your organisation, and to anyone you give a report share link.

Retention and deletion. Saved reports and project notes are kept until you delete them or your account is deleted. AI assistant conversations are kept until your account is deleted; archiving a conversation hides it but does not delete it. Disconnecting Search Console or Google Analytics from a project removes that project's connection and its details immediately. Your Google authorisation (the encrypted tokens) stays stored, so you can connect other projects, until you choose "Remove Google account" when picking a property; that deletes the tokens and every project connection that uses them. Removing the account in AI SEO does not cancel the permission at Google, so also revoke it at https://myaccount.google.com/permissions. If you ask us to delete your AI SEO account (see section 8), we revoke our access with Google and delete the stored tokens and the copies of Google data described above.

Limited Use. AI SEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Cookies and similar technologies

• Essential cookies keep you signed in and protect your account and sessions. The Service does not work without them.
• Public website analytics use Plausible, which does not set cookies.
• Referral cookie: if you arrive through a partner link and allow referral tracking, Dub sets a first-party cookie that stores a referral click identifier for up to 90 days.
• Product analytics in the web app use PostHog, which stores an identifier in your browser only after you allow analytics. You can change your choice at any time under Settings > Privacy and emails.

You can block or delete cookies in your browser settings, but parts of the Service may then stop working.

8. How long we keep personal data

We keep personal data only for as long as needed for the purposes in this policy:

• Account and project data are kept while your account is open. There is no self-serve delete button: to delete your account, email jason.aiseo@gmail.com from your account email. After verifying your request, we will within 30 days delete your account, organisation, projects, saved reports, AI assistant conversations, API keys and connected-agent authorisations, revoke our Google access, and delete your records at Loops, PostHog and Autumn. If other people belong to your organisation, we will first ask you to transfer ownership or remove them. Reports you created in an organisation that continues to exist stay with that organisation with your name removed.
• Short-term caches of SEO and Search Console data are deleted within 7 days. Logs and backups are deleted on their providers' normal schedules.
• Billing and transaction records are kept for 7 years from the end of the year they relate to, as Malaysian tax law requires, and then deleted.
• Newsletter data is kept until you unsubscribe.

9. How we protect personal data

We take practical security measures to protect personal data from loss, misuse, and unauthorised access, disclosure, alteration or destruction. These include encryption in transit (TLS), encryption of stored access tokens, hashed passwords, access controls, and choosing providers with strong security practices. No system is completely secure, so please keep your password and API keys safe. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and affected individuals as required by the PDPA.

10. Your rights and choices

Under the PDPA you have the right to:

• access the personal data we hold about you, and request a copy;
• correct personal data that is inaccurate, incomplete, misleading or out of date;
• withdraw consent to our processing, or ask us to limit processing, including for direct marketing;
• ask us to transmit your personal data to another data controller (data portability), to the extent the PDPA provides for it; and
• ask us to delete your account and associated data (see section 8).

To exercise these rights, email jason.aiseo@gmail.com. We may need to verify your identity first, and we will respond within the time required by the PDPA. We may charge a fee for access requests where the law allows it. If we refuse a request, we will tell you why.

You can also limit processing yourself: turn off browser analytics and session replay under Settings > Privacy and emails, unsubscribe from marketing emails using the link in each email, and disconnect Google integrations in your settings or at https://myaccount.google.com/permissions. We will still send service emails, such as security, billing and account notices.

If you are not satisfied with how we handled your request, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Links to other websites

The Service links to and integrates with other websites and services. We are not responsible for their privacy practices, and this policy does not apply to them. Please read their privacy policies.

13. Changes to this policy

We may update this policy from time to time. If we make a significant change, we will notify you by email or through the Service before it takes effect. The "Last updated" date at the top shows when this policy was last changed.

14. Contact us

For questions, requests or complaints about this policy or your personal data, contact:

AI SEO Malaysia

• Contact person: Jason
• Email: jason.aiseo@gmail.com
• WhatsApp: +60 14-933 6284 (username: aiseo.my)

Notis Perlindungan Data Peribadi (Bahasa Malaysia)

Notis ini dikeluarkan oleh AI SEO Malaysia di bawah Akta Perlindungan Data Peribadi 2010 ("APDP"). Sekiranya terdapat percanggahan antara versi Bahasa Malaysia dengan versi Bahasa Inggeris, versi Bahasa Inggeris akan diguna pakai setakat yang dibenarkan oleh undang-undang.

• Data yang kami kumpul: nama, alamat e-mel, kata laluan (disimpan dalam bentuk cincang), butiran organisasi, kandungan projek anda (laman web, kata kunci, laporan dan perbualan dengan pembantu AI), butiran pengebilan dan penggunaan kredit, data penggunaan dan peranti, alamat IP, serta data daripada perkhidmatan Google yang anda sambungkan.
• Sumber data: terus daripada anda; secara automatik semasa anda menggunakan Perkhidmatan (kuki, log, serta analitik produk dan rakaman sesi selepas anda membenarkannya); daripada Google apabila anda log masuk dengan Google atau menyambungkan Search Console atau Analytics; dan daripada rakan kongsi rujukan jika anda tiba melalui pautan rakan kongsi.
• Tujuan: untuk membuka dan melindungi akaun anda, menyediakan ciri-ciri Perkhidmatan, memproses pembayaran, menghantar e-mel perkhidmatan, memberi sokongan, menambah baik Perkhidmatan, mencegah penyalahgunaan, menghantar maklumat produk dan tawaran (kecuali jika anda memilih untuk berhenti menerimanya), dan mematuhi undang-undang.
• Pendedahan: kami mendedahkan data peribadi kepada pembekal perkhidmatan yang memprosesnya untuk menjalankan Perkhidmatan (seperti Cloudflare, PlanetScale, Autumn, Stripe, Loops, PostHog, Plausible, Dub, DataForSEO, OpenRouter, Context.dev dan Google); kepada ahli organisasi anda; kepada sesiapa yang anda berikan pautan perkongsian laporan; kepada pembantu AI dan klien MCP yang anda sambungkan; kepada rakan kongsi rujukan (rekod tanpa nama); kepada penasihat profesional kami; dan kepada mahkamah atau pihak berkuasa apabila dikehendaki oleh undang-undang. Kami tidak menjual data peribadi anda.
• Pemindahan ke luar Malaysia: sesetengah pembekal kami menyimpan atau memproses data di luar Malaysia, termasuk di Amerika Syarikat dan Kesatuan Eropah, dan kami hanya memindahkannya seperti yang dibenarkan oleh seksyen 129 APDP.
• Wajib atau sukarela: butiran akaun (dan butiran pengebilan bagi pelan berbayar) adalah wajib; tanpanya kami tidak dapat membuka akaun anda atau memproses langganan anda. Maklumat lain adalah sukarela, tetapi sesetengah ciri tidak akan berfungsi tanpanya.
• Hak anda: anda berhak untuk mengakses dan membetulkan data peribadi anda, menarik balik persetujuan, mengehadkan pemprosesan (termasuk bagi pemasaran langsung), meminta kami menghantar data peribadi anda kepada pengawal data lain (kemudahalihan data) setakat yang diperuntukkan oleh APDP, dan meminta akaun anda dipadamkan.
• Pilihan untuk mengehadkan pemprosesan: anda boleh menutup analitik pelayar dan rakaman sesi di Tetapan > Analitik, berhenti melanggan e-mel pemasaran melalui pautan dalam setiap e-mel, memutuskan sambungan integrasi Google dalam tetapan atau di https://myaccount.google.com/permissions, atau menghubungi kami melalui e-mel.
• Hubungi kami: untuk sebarang pertanyaan, permintaan atau aduan, hubungi Jason di jason.aiseo@gmail.com atau melalui WhatsApp di +60 14-933 6284. Anda juga boleh membuat aduan kepada Pesuruhjaya Perlindungan Data Peribadi Malaysia.