Privacy Policy

Who we are

SEOHero (seohero.app) is operated by Fourwrd V.O.F., De Nieuwe Erven 3, 5431 NV Cuijk, the Netherlands (Chamber of Commerce 42087615, VAT NL869652308B01). We are the controller for the personal data described in this policy. Questions? Contact contact@fourwrd.nl.

What data we collect

We collect account data (name, e-mail address, password hash and, if you provide them, billing details such as company name, address and VAT number), data about the websites you add and the audits we run on them, the articles and instructions you create, and — only with your permission via Google OAuth — read-only Google Search Console and Google Ads data, which you can revoke at any time. Your name, e-mail address and password are required to create an account, and your country is required to start a subscription because it determines the VAT; without them we cannot provide the service. Business customers must also provide a company name and address, which the law requires on their invoices. Payments are handled by Mollie; we never store full card or bank details. For every login session we store the browser's user-agent string, so you can recognise and sign out your devices under Settings. We only use functional cookies (see the table below) — no tracking or advertising cookies, so no cookie banner is needed. For visitor statistics we run our own Plausible instance (stats.fourwrd.nl): it counts page views without cookies and without profiling individual visitors. If you use our contact form or the cancellation form, we store your name, e-mail address, message and IP address (the latter to stop spam).

Cookies

No cookie is set on a first visit. The cookies below are only placed after an action of yours (logging in, choosing a language, and so on) and are strictly functional, so they need no consent:

Why we process your data and on what basis

We process your data for the following purposes, each with its legal basis under the GDPR. To provide the service — audits, reports, article generation, publishing and the other AI features such as the AI assistant: performance of the contract (art. 6(1)(b)). To bill your subscription and keep our accounts: performance of the contract and our legal obligations under Dutch tax law (art. 6(1)(b) and (c)). To secure the platform, prevent abuse and improve our help content: our legitimate interest (art. 6(1)(f)). To send you service messages, getting-started tips and reports: performance of the contract and our legitimate interest in informing existing customers; you can turn tips and reports off at any time under Settings or via the link in every e-mail. To read your Google Search Console and Ads data: your consent via Google OAuth (art. 6(1)(a)), which you can withdraw at any time. Questions you ask the AI assistant and messages sent through our contact form (their text, without your name or e-mail address) also help us improve our help articles and our own blog. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell personal data or use it for third-party advertising.

Retention

We keep your data for as long as your account exists. When you delete your account (under Settings, or by e-mailing us), your account, website, audit and article data are removed immediately; copies can remain in our back-ups for up to 14 days before being overwritten. Invoices and credit notes are kept for 7 years, as Dutch tax law requires; they contain only the details needed for the invoice. Security logs such as login attempts and rate-limit records are deleted automatically after 30 days. Questions you ask the AI assistant, with their answers, are deleted automatically after 180 days. Messages sent through our contact form and cancellation requests submitted through the cancellation form are deleted automatically after one year.

Sharing & subprocessors

We share data only with the processors we need to run the service: Hetzner Online GmbH (hosting and back-ups; data centres in Germany and Finland), Mollie B.V. (payments; Netherlands), Resend (transactional e-mail; USA), Anthropic (the AI features; USA — receives only what a feature needs: the website name, keywords, brand and article instructions and article text for articles and the quality check; search queries from Search Console for keyword research and competitor discovery; article titles, search statistics and audit results for monthly reports; your first name, company name, plan and website details for onboarding e-mails; your question, the earlier questions in that conversation and the dashboard page you are on for the AI assistant; and the text of assistant questions and contact messages, without name or e-mail address, for suggestions for our own blog — never your password, e-mail address or payment details), OpenAI (article images; USA — receives only the article title and keyword) and Google (Search Console, Ads and Google sign-in, only when you connect them). Google also receives the address of your homepage when we measure its speed with PageSpeed Insights, and the EU VIES service receives your VAT number when we validate it. A copy of every invoice and credit note goes to our internal administration system (werkportaal.fourwrd.nl, operated by Fourwrd V.O.F. itself) for bookkeeping. Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses. All processors are bound by data processing agreements; the full list with locations is in our data processing agreement.

Prospects (businesses we may approach)

To find new customers, our sales team uses a tool that looks up businesses in a sector and region through public web search and their own websites. We store the company name, domain, city, the public contact page, the legal form as far as it is public, a short note on why the business might benefit from SEOHero and an automated check of the homepage. Source: publicly available websites and search engines. If the business is a sole trader, this can be personal data; our legal basis is our legitimate interest in direct marketing (art. 6(1)(f)). We do not collect names or personal e-mail addresses of individuals, nothing is sent automatically, and every first e-mail names this source and offers an easy way to object. We delete prospect data 12 months after the last change. You can object at any time via contact@fourwrd.nl; we then stop and delete the data.

Data breaches

If a personal data breach occurs, we assess and contain it immediately. Where the breach is likely to result in a risk to your rights and freedoms, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of discovery. Where the breach is likely to result in a high risk to you, we inform you as soon as possible, with what happened and what you can do. Business customers for whom we act as processor are informed without undue delay so they can meet their own obligations (see the data processing agreement).

Your GDPR rights

You can request access, correction, deletion or export of your personal data, and object to or restrict processing. Email contact@fourwrd.nl and we will respond within 30 days. You can also lodge a complaint with a supervisory authority: in the Netherlands the Autoriteit Persoonsgegevens, in Belgium the Gegevensbeschermingsautoriteit / Autorité de protection des données, or the data protection authority of your own country.

Contact

For any privacy questions or requests, contact us at contact@fourwrd.nl. We aim to reply within a few business days.

Data processing agreement (DPA)

For business customers, SEOHero acts as a processor for the website and visitor data we analyse on your behalf; you remain the controller. Our standard data processing agreement (GDPR article 28), including the list of subprocessors, is published on this website and forms part of the agreement; no separate signature is needed.

Read the data processing agreement