BBL SEO Analytics
Sign In

Privacy Policy

Last updated: 8 September 2026

This Privacy Policy explains how BBL SEO Analytics (“the Service”, “we”, “us”), operated by Built by Leon, collects, uses, stores and shares information when you use our SEO analytics and reporting platform at seo.builtbyleon.com. It also describes the choices you have about your information.

1. Who this policy applies to

The Service is a business tool used by SEO agencies and businesses to track search rankings and report on website performance. Accounts are created by our administrators for clients. This policy applies to account holders (“administrators” and “clients”) and to anyone who connects a third-party data source such as Google Search Console or Google Analytics to a project.

2. Information we collect

2.1 Account information

  • Name and email address, used to sign you in and to identify project ownership.
  • An encrypted password hash. We never store your password in plain text.
  • Billing and subscription details (plan, status) where applicable. We do not store full card numbers.

2.2 Project and SEO data

  • The website domains, keywords, locations and competitors you choose to track.
  • Search-engine ranking data, keyword research data, backlink data and technical site-audit results, retrieved on your behalf from our SEO data provider (DataForSEO) for the domains and keywords in your projects.
  • Reports you generate and the email addresses you nominate to receive them.

2.3 Data from Google APIs (Search Console and Analytics)

If you connect a project to Google, we use OAuth 2.0 to request access from your Google Account. We only request the scopes needed for the feature you are enabling:

  • Google Search Console — webmasters.readonly. We read search-analytics data for the property you select: search queries, landing pages, clicks, impressions, click-through rate and average position, by date.
  • Google Analytics (optional) — read-only analytics scopes. We read aggregate traffic metrics (such as sessions, users and channel data) for the property you select.

When you authorise access, Google provides us with an access token and a refresh token. We store these tokens so the Service can refresh the connected data on a schedule without asking you to sign in again. Tokens are stored in our database and are used only to retrieve the data described above.

2.4 Technical information

  • A session cookie that keeps you signed in. It is strictly necessary for the Service to function.
  • Standard server logs (IP address, browser user-agent, timestamps, request paths) kept for security and debugging.

3. How we use information

  • To provide, operate and maintain the Service and your account.
  • To display rankings, keyword, backlink, audit, Search Console and Analytics data in your project dashboards.
  • To generate the reports you request and email them to your nominated recipients.
  • To refresh connected data on a recurring schedule.
  • To provide support, investigate issues and secure the Service against abuse.
  • To process billing where a paid plan applies.

We do not use your data to serve advertising, we do not sell or rent personal information, and we do not use it to train machine-learning or AI models.

4. Limited Use of Google user data

BBL SEO Analytics’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only use Google user data to provide and improve the user-facing features described in this policy (showing your Search Console and Analytics data in your dashboards and reports).
  • We do not transfer Google user data to third parties except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition.
  • We do not use Google user data for advertising.
  • We do not allow humans to read Google user data unless we have your consent for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations in line with applicable requirements.

5. How information is shared

We share information only with service providers who process it on our behalf so we can run the Service:

  • Vercel — application hosting.
  • Neon — managed PostgreSQL database hosting.
  • DataForSEO — SEO data provider. We send the domains and keywords you track in order to retrieve ranking, keyword, backlink and audit data. We do not send Google Search Console or Analytics data to DataForSEO.
  • Email delivery (Google Workspace / Resend) — to send report emails and account notifications.
  • Anthropic — where you use the optional “Ask AI” feature, the relevant project data is sent to Anthropic’s API to generate a response. Anthropic does not train its models on this data.

We may also disclose information if required by law, or to protect the rights, property or safety of our users or the public.

6. Data retention

  • Account and project data is retained for as long as your account is active.
  • Historical ranking and Search Console data is retained to provide trend charts and historical reports.
  • Google OAuth tokens are retained until you disconnect the integration, you revoke access from your Google Account, or your account is deleted.
  • When your account is deleted, we delete or anonymise your personal data and connected-service tokens within 30 days, except where we must retain records to comply with legal obligations.

7. Your choices and rights

  • Disconnect Google: remove a Search Console or Analytics connection at any time from the project’s settings. This deletes the stored tokens for that project.
  • Revoke at Google: you can also revoke our access from your Google Account at myaccount.google.com/permissions.
  • Access, correction and deletion: contact us to request a copy of your personal data, to correct it, or to delete your account and associated data.
  • Depending on where you live, you may have additional rights under laws such as the UK GDPR or GDPR. We will honour those rights.

8. Security

We protect data in transit with HTTPS/TLS. Passwords are stored only as salted hashes. Access to production systems is restricted. Sensitive credentials are stored as protected environment variables. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

9. International transfers

Our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for such transfers.

10. Children

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, notify account holders by email.

12. Contact us

For any privacy question or request, contact:
Built by Leon — BBL SEO Analytics
Email: leon@builtbyleon.com

← Back to home