Privacy Policy

Last updated: October 25, 2026

Effective date: October 14, 2026 for new users; November 13, 2026 for existing users

Code4Genius Limited (the “Company”) is committed to maintaining robust privacy protections for its users. Our Privacy Policy (“Privacy Policy”) is designed to help you understand how we collect, use, and safeguard the information you provide to us and to assist you in making informed decisions when using our Service.

For purposes of this Privacy Policy,

• “Site” refers to the Company’s website, which can be accessed at https://openseo.so/.
• “Service” refers to the Company’s hosted GeniusRank product accessed via the Site.
• The terms “we,” “us,” and “our” refer to the Company.
• “You” refers to you, as a user of our Site or our Service.

This Privacy Policy describes how Code4Genius Limited handles personal information in connection with the GeniusRank website and hosted service. We obtain consent separately where required for particular processing. The Terms and Conditions govern use of the hosted service.

If you operate or use a self-hosted deployment of GeniusRank that is not run by Code4Genius Limited, the operator of that deployment controls the information processed there. This Privacy Policy applies to information collected by Code4Genius Limited through the Site and Every App-operated hosted services.

If you are a business customer and you submit personal information about your personnel, clients, or other individuals, you are the controller of that information and we process it as your processor, solely on your instructions and subject to any processing agreement required by applicable law. This Privacy Policy does not replace a required data-processing agreement. We are the controller of account, billing, security, Site analytics, and our own marketing data. Information about our own website visitors, account administration, billing, security, and marketing is processed for our own purposes as described below.

I. INFORMATION WE COLLECT

We collect personal information and information that has been aggregated or de-identified. Personal information may include your name, email address, account credentials or authentication information, organization and billing identifiers, communications, device and network identifiers, approximate location derived from IP address, and information you submit to or generate through the Site or Service. Usage information, including IP addresses, may be personal information even when it does not identify a person by name.

1. Information collected via Technology

To receive marketing communications from us, you only need to submit your email address. To use the hosted version of the Service thereafter, you may need to submit further Personal Information, such as your name, email address, password, organization information, billing or customer identifiers, and other information you choose to provide through the Service. However, in an effort to improve the quality of the Service, we track information provided to us by your browser or by our software application when you view or use the Service, such as the website you came from (known as the “referring URL”), the pages you visit, the type of browser you use, the device from which you connected to the Service, your operating system, approximate location derived from IP address, the time and date of access, and other information related to how you use the Site or Service. In the authenticated hosted Service, PostHog may also collect session replay recordings to help us diagnose bugs and improve usability; form inputs and designated sensitive text are masked before recording.

We may collect site addresses, keywords, organization & project data, reports, prompts, search and audit queries, outputs, and information retrieved from authorized integrations or SEO data providers when you use those features. Some of this information may relate to other individuals, including your clients’ personnel or website visitors. We also collect messages and attachments you provide to support. The categories available to us depend on the features you use and the data you choose to submit.

Advertising and referral measurement. We may deploy pixels, cookies, SDKs, tags or server-side event connections to measure ad views, clicks, referrals, sign-ups and purchases, attribute conversions, and, where enabled, deliver or measure targeted advertising. When deployed, these tools may disclose device and online identifiers, IP addresses, page and event information, referral identifiers, and relevant transaction events to advertising or referral partners. Advertising partners may use the information under their own terms, including for cross-context advertising where applicable. Planned partners may include Meta or Reddit; naming them here does not mean their tools are currently enabled. Other advertising platforms may be added subject to the disclosures and choices described here. We identify the partners actually deployed and their purposes in the notice or preference interface provided with the tools; a reference to a category of future partners does not authorize an undisclosed new use. Advertising/conversion choices are distinct from product analytics and session replay. We obtain consent before collection where required and honor applicable sale/sharing or targeted-advertising opt-outs, including qualifying preference signals. Google API user data, support content, and Organization & Project content are not used for advertising or sent to advertising pixels.

We use technologies necessary for authentication and security. We may use a cookieless public-site analytics provider, including Plausible Analytics, to measure website visits and use. We may also use referral-attribution technologies and, within the hosted service, PostHog analytics and session replay. These technologies have different data practices and may require different notices or choices. We describe the providers actually in use and the choices actually available in the current notice presented with the relevant feature.

2. Information you provide us by registering for an account

In addition to the information provided automatically by your browser when you visit the Site, to use the hosted version of the Service you may need to create a personal profile. You can create a profile by registering with the Service and entering your name, email address, and password. If you provide your email address to receive marketing communications from us without creating an account, we collect and use that email address for that purpose. Registering or subscribing does not itself opt you in to promotional email where separate permission is required.

3. Children’s Privacy

The Site and the Service are not directed to anyone under the age of 13. As stated in our Terms of Use, you must be at least 18 years old to use the Site or Service. The Site does not knowingly collect or solicit information from anyone under the age of 13 or allow anyone under the age of 13 to sign up for the Service. In the event that we learn that we have gathered personal information from anyone under the age of 13 without the consent of a parent or guardian, we will delete that information as soon as possible. If you believe we have collected such information, please contact us at privacy@openseo.so. We do not knowingly sell or share the personal information of minors for targeted advertising.

4. Partner program

If you apply to or join the GeniusRank partner (affiliate) program, we and Dub, which runs the program for us, collect the information you provide in your application and partner profile, such as your name, email address, country, company, website and social media profiles, and your answers to application questions. We also receive the clicks, sign-ups, purchases, and commissions attributed to your partner links. Payouts, tax forms, and optional identity verification are handled by Dub and its payment and verification providers. We use this information to review applications, prevent fraud and self-referrals, calculate and pay commissions, keep tax and accounting records, and communicate with you about the program. Dub may screen applications automatically to reject spam or applications that clearly don’t meet the program criteria; you can ask for a person to review a rejected application by emailing privacy@openseo.so. Your Dub partner account is also subject to Dub’s own terms and privacy policy.

II. HOW WE USE AND SHARE INFORMATION

Personal Information

We use personal information to operate and secure accounts; deliver requested SEO, reporting, integration, and AI-assisted features; process payments; respond to support inquiries; detect misuse; measure and improve the Service; communicate about the Service; and, subject to applicable choices, send promotional messages. We do not sell personal information in exchange for money. Advertising and referral disclosures are described in Section I and are subject to the consent and opt-out requirements applicable to the particular use. They may qualify as sale, sharing or targeted advertising under applicable law even when no money is paid for the information.

We disclose information to providers that help us operate the Site and hosted Service, including providers of email communications, website and hosted-service analytics, referral attribution, billing and payments, infrastructure, SEO data, and requested AI features. Depending on the features you use and the providers then in use, these may include Loops, Plausible Analytics, PostHog, Dub, Autumn, Stripe, Cloudflare, DataForSEO, OpenRouter, and OpenAI. Each provider receives information relevant to its role. Providers and their roles may change; we update this notice when required for a material change. An AI assistant or MCP client you independently connect may receive results at your direction and process them under its own terms. Our providers handle the information needed to perform their respective services under their applicable agreements and settings. Before sending a new provider customer data, we review the information it will receive and its relevant use, retention, sharing, and security practices.

For support requests, authorized personnel may use AI-assisted tools supplied by OpenAI or Anthropic to help prepare responses. Information you include in a support request may be processed by the provider of the tool used. Authorized personnel and AI-assisted support agents supplied by OpenAI or Anthropic may process the support information and relevant Organization & Project data reasonably needed to address your request, subject to access controls and applicable provider agreements. This does not authorize unrestricted access to all connected-account data. We use no-training configurations for this processing. Access to Google API user data remains subject to Section III, including its user-directed use, transfer and human-access restrictions; a support request or acceptance of the Terms does not itself authorize unrestricted Google-data access. Do not include passwords, payment credentials, government identifiers or unnecessary sensitive information in support requests.

In general, the Personal Information you provide to us is used to help us communicate with you and operate the Service. For example, we use Personal Information to create and secure accounts, authenticate users, provide technical support, process billing, send administrative or transactional emails, contact users in response to questions, solicit feedback from users, and inform users about product updates and promotional offers. We request marketing permission separately where required and honor applicable unsubscribe requests; an agreement to the Terms is not a marketing opt-in.

We may share Personal Information with outside parties if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to meet any applicable legal process or enforceable governmental request; to enforce applicable Terms of Service, including investigation of potential violations; address fraud, security or technical concerns; or to protect against harm to the rights, property, or safety of our users or the public as required or permitted by law.

Non-Personal Information

Aggregated and de-identified information. We may use and share information that is aggregated or de-identified so that it cannot reasonably be linked to an individual, subject to applicable law. Where required, we will maintain such information in de-identified form and will not attempt to reidentify it except as permitted by law.

In the event we undergo a business transaction such as a merger, acquisition by another company, or sale of all or a portion of our assets, your Personal Information may be among the assets transferred. Any transfer remains subject to applicable law, and we will provide notice or choices if required for a materially different use.

III. GOOGLE USER DATA

You may choose to connect Google services, such as Google Search Console and Google Analytics, to the hosted Service, or to sign in with your Google account. When you do, the Service accesses Google user data through Google's APIs with your authorization. This section describes how we handle that data, in addition to the other terms of this Privacy Policy. Self-hosted deployments of GeniusRank connect to Google using the operator's own credentials, and this section does not apply to them.

What Google user data we access. If you sign in with Google, we receive your basic account information (name, email address, and profile picture) to create and authenticate your account. If you connect Google Search Console, we access search performance data for the sites you authorize, such as queries, pages, clicks, impressions, and average positions, as well as URL inspection results. If you connect Google Analytics, we access report data for the property you select, such as traffic and acquisition metrics, landing page and page performance, key events, ecommerce outcomes, site search terms, and audience breakdowns by device and country, along with property configuration details such as your list of properties, data streams, and measurement settings. We also receive the email address of the connected Google account so we can show you which account is linked. All Google API scopes we request for these integrations are read-only; we cannot modify data in your Google account.

How we use it. We use Google user data solely to provide the user-facing features of the Service that you request: showing connection status, generating SEO reports and insights, and returning data you ask for through the Service, including through AI assistants and MCP clients that you explicitly connect. We do not use Google user data for advertising, and we do not use it to develop, improve, or train generalized AI or machine learning models. Support personnel will not submit Google user data to support AI tools except where separately authorized and permitted under applicable Google requirements.

How we share it. We do not sell Google user data, and we do not transfer it to data brokers or advertisers. Google user data leaves our systems only in these cases below and the limited support processing expressly described in this section: (a) when you connect the Service to an AI assistant or other MCP client and request data through it, the results are returned to that client, whose own privacy terms then apply; (b) when you use the in-app AI assistant, relevant data may be processed by an AI model accessed through providers such as OpenRouter or OpenAI in order to generate your response; and (c) our infrastructure provider, Cloudflare, hosts the systems that process this data on our behalf. We transfer Google user data only as expressly described in this section, including (a) back to an AI assistant or MCP client that you connect and ask to retrieve it, (b) to OpenRouter or OpenAI, under a no-training setting, solely to generate the response you requested in the Service, and (c) to Cloudflare to host that processing. OpenAI or Anthropic support agents may receive Google API user data only where that specific support use and transfer is permitted by the Google API Services User Data Policy and any required user authorization has been obtained; they do not receive blanket access to connected accounts. Transfers remain limited to the permitted user-facing or user-directed purpose and no-training settings. We do not use Google user data to train generalized models, for advertising, or for human review except to comply with law or with your specific request. Google report data may be retained in in-app agent chat sessions or other Organization & Project data even where the retrieval flow does not write report payloads to our databases. Retained reports, prompts, chat histories and generated outputs are subject to the deletion periods below. New historical-data features will be disclosed before activation, with any consent required for a changed Google-data use.

How we protect it. The OAuth tokens that grant access to your Google account are stored encrypted at rest, and all data is transferred over encrypted connections (TLS). We retrieve authorized Google report data to provide the features you request. Report data may also be included in and retained with in-app agent chat sessions. Related reports, prompts, and generated outputs may be retained where the hosted service saves them. We do not use Google user data for advertising or to train generalized AI models. OpenRouter and OpenAI process relevant in-product prompts using the no-training settings we have enabled; other transfers occur only as described here and subject to applicable Google API requirements.

Retention and deletion. Google report data retained in chat histories or Organization & Project data is kept until deletion or account closure, then removed from active systems within 30 days, subject to lawful retention exceptions and backup overwriting within 35 days. Disconnecting an integration does not by itself delete previously retained chat or report content. While an integration is connected, we retain the OAuth tokens and connection details (such as the selected site or property and the connected account email). Disconnecting an integration in your settings removes that connection and its details immediately, and the stored tokens for the Google account are deleted once none of your projects use it. You can also revoke GeniusRank's access at any time from your Google account's security settings at https://myaccount.google.com/permissions. Deleting your GeniusRank account disables its Google connections and initiates deletion of associated data from active systems, subject to lawful retention obligations and backup processes described below.

Limited Use. GeniusRank's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

IV. HOW WE PROTECT INFORMATION

We implement security measures designed to protect your information from unauthorized access. Your account is protected by your account password, and we urge you to take steps to keep your personal information safe by not disclosing your password and by logging out of your account after each use. We use administrative, technical, and organizational safeguards designed for the nature of the information and associated risks, including appropriate access restrictions and encryption where deployed. No method of transmission or storage is completely secure. If you operate a self-hosted deployment of GeniusRank, you are responsible for the security measures and privacy practices of that deployment.

Retention. We retain information as reasonably needed to provide the requested Service, maintain accounts and saved work, respond to support requests, prevent fraud, meet legal and accounting duties, and address disputes. Retention criteria differ for account and billing records, saved organization & project data, support communications, session replay, security logs, connection details, and backups. Following account deletion or a valid deletion request, we remove information from active systems subject to applicable exceptions; backup copies may persist temporarily until their normal deletion cycle and will be protected against ordinary use. This general statement does not override the specific Google-data commitments above.

V. YOUR RIGHTS REGARDING THE USE OF YOUR PERSONAL INFORMATION

You have the right at any time to prevent us from contacting you for marketing purposes. When we send a promotional communication to a user, the user can opt out of further promotional communications by following the unsubscribe instructions provided in each promotional e-mail. You can also indicate that you do not wish to receive marketing communications from us by contacting us at privacy@openseo.so. Please note that notwithstanding the promotional preferences you indicate by either unsubscribing or contacting us, we may continue to send you administrative or transactional emails including, for example, account verification, password reset, billing, security, support, and periodic updates to our Privacy Policy.

You may also manage available cookie choices through our preference center where offered, disconnect linked accounts using available settings, and request deletion of your hosted account.

VI. U.S. PRIVACY RIGHTS AND DISCLOSURES

This section applies when a U.S. privacy law grants you a right with respect to our processing. Rights, exceptions, thresholds, and response periods depend on the applicable law and on whether we process information for our own purposes or for a business customer. This section does not represent that every state privacy law applies to every GeniusRank activity.

Categories, sources, purposes, and recipients. The table describes categories we may process when the relevant features are used. It is not a statement that every category is collected about every person. The purposes, providers, and retention criteria in Sections I–IV also apply.

Sensitive information. We do not request sensitive personal information as a condition of ordinary SEO use, other than account log-in credentials used solely to authenticate you. Customer-submitted materials, support requests, or connected services may nevertheless contain sensitive information. Do not provide sensitive or regulated information (such as health, financial-account, government-identifier, precise-geolocation, or children’s information) unless it is needed for an authorized feature or separately agreed. We do not sell or share sensitive personal information, and we do not use or disclose it to infer characteristics about you or for any purpose that would give rise to a right to limit under the CCPA. Where a law requires opt-in consent before processing sensitive data, we will obtain it first. We do not collect “consumer health data” as defined in the Washington My Health My Data Act or similar laws.

Your requests. Subject to applicable law, you may request to: (a) know or access the personal information we hold about you, including the categories and specific pieces of information, sources, purposes, and categories of recipients (and, where a law provides, a list of the specific third parties to which we disclosed it); (b) correct inaccurate information; (c) delete information; (d) obtain a portable copy; (e) opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; (f) limit specified uses of sensitive personal information; (g) withdraw consent where consent is the applicable basis; (h) appeal a denial; and (i) use an authorized agent. We do not use automated decision-making technology to make significant decisions about you, and we do not offer financial incentives tied to personal information. Rights that do not apply to our practices or your circumstances are not implied by this list. We will not discriminate or retaliate against anyone for exercising applicable rights.

How to submit and verify a request. To submit a privacy-rights request, email privacy@openseo.so with “Privacy Request” in the subject line. If we offer another request method, we will identify it where that method is available. We will request only information reasonably necessary to verify your identity or an agent’s authority (for example, confirming control of your account email address), and may be unable to fulfill a request we cannot verify. An authorized agent may need to provide your signed permission, and we may ask you to verify your identity directly. Please do not send identity documents unless we ask for them through an appropriate channel. Where required, we will confirm receipt within 10 business days and respond within 45 days, extendable once by up to 45 additional days with notice to you. Requests are free, except that we may charge a reasonable fee or decline requests that are manifestly unfounded, excessive, or repetitive where permitted. If we process the information on a business customer’s behalf, we may direct you to that customer and assist it as required by contract and law.

Appeals. If an applicable law gives you the right to appeal our response, email privacy@openseo.so with “Privacy Appeal” in the subject line. We will provide information about the applicable appeal process and respond within the time required by that law. If you disagree with our decision, you may contact your state Attorney General or, in California, the California Privacy Protection Agency.

Advertising and preference signals. We do not sell personal information for money. Referral attribution, conversion measurement, or optional analytics tools may constitute a “sale,” “sharing,” or “targeted advertising” under some State Privacy Laws. Where applicable law gives you a right to opt out of a use of personal information described in this section, you may contact privacy@openseo.so. We will describe any additional website choice method when it is available. Where applicable, we honor qualifying opt-out preference signals, including Global Privacy Control, for sale/sharing or targeted advertising. Opting out of advertising does not necessarily turn off separately permitted product analytics or necessary security functions. A cookie banner or marketing unsubscribe is not by itself a substitute for a statutory opt-out. Because users must be at least 18, we do not knowingly sell or share personal information of consumers under 18 or use it for targeted advertising.

Session replay. In the authenticated hosted Service, PostHog session replay may record interactions such as clicks, page views, and form activity to help us diagnose issues and improve the Service. Password and payment fields are masked. Where consent is required, optional analytics and session replay do not start until you opt in. You may withdraw consent through account settings or the relevant preference controls. Advertising and conversion tracking have separate choices; enabling product analytics does not by itself enable advertising tracking.

Other U.S. notices. California residents may request information about disclosures of personal information to third parties for their direct-marketing purposes under California Civil Code § 1798.83; we do not make such disclosures. Nevada residents may submit a request under Nev. Rev. Stat. Chapter 603A to opt out of the sale of covered information by emailing privacy@openseo.so, although we do not currently sell covered information. If a security incident affects your personal information, we will provide notice as required by applicable federal and state breach-notification laws. We review and update this section at least once every 12 months.

VII. INTERNATIONAL USERS AND DATA TRANSFERS

The Company is based in the United States, and if you use the Site or Service from outside the United States, your personal information will be collected by us in, and transferred to, the United States. Our service providers may also process it in other countries, including through Cloudflare’s global network, which may handle requests at a data center near you. Our primary data storage is located in the United States. Those countries may have data-protection laws that differ from the laws of your country and authorities there may be able to access information under local law. This section applies in addition to the rest of this Privacy Policy where the laws described below apply to you.

Sanctions compliance. Use of the Site and hosted Service must comply with applicable sanctions and export-control laws. We may restrict access when needed for legal compliance. This notice does not represent that we technically block access from every restricted location or that no information is collected from such locations.

EEA, UK, and Swiss Users — Legal Bases. If you are in the European Economic Area, the United Kingdom, or Switzerland, Code4Genius Limited is the controller of personal information processed under this Privacy Policy, except where we act as a processor for a business customer. We process personal information on the following legal bases: performance of a contract (to provide the Service and your account, and to run the partner program for partners); legitimate interests (to secure, maintain, and improve the Service, prevent fraud and misuse, and communicate with business contacts), balanced against your rights; consent (for optional cookies, analytics, session replay, and marketing where consent is required, which you may withdraw at any time without affecting prior processing); and compliance with legal obligations. Providing information needed for your account is a contractual requirement; without it we cannot provide the Service. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Your Rights. Subject to the GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection, you have the right to access, rectify, erase, restrict, and object to the processing of your personal information (including an absolute right to object to direct marketing), to data portability, and to withdraw consent. You may exercise these rights by emailing privacy@openseo.so; we will respond within one month, extendable by two further months where permitted. If we process your information as a processor for a business customer, we may refer your request to that customer and will assist it. You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or place of the alleged infringement, including the UK Information Commissioner’s Office or the Swiss Federal Data Protection and Information Commissioner.

International Transfers. When you provide personal information to us directly from the EEA, the UK, or Switzerland, we receive it in the United States and protect it as described in this Privacy Policy. Where required, we assess the laws of the destination country and apply supplementary measures, such as encryption in transit and at rest and access controls. You may request a copy of the relevant safeguards, with commercially sensitive terms redacted, by contacting privacy@openseo.so.

Retention. We retain personal information only as long as necessary for the purposes described in this Privacy Policy, as described in Section IV, and then delete or anonymize it.

Other Countries. If you are in Canada, Brazil, Japan, Australia, India, South Korea, or another country with a data-protection law that applies to our processing, you may have rights to access, correct, delete, or port your personal information, withdraw consent, and complain to your local data-protection authority. Your personal information will be transferred to and processed in the United States and in other countries where our service providers operate, as described in this Section. Where your law requires a specific transfer mechanism, notice, or consent, we will use that mechanism or obtain that consent before the transfer. By using the Service from such a country, you are informed that your personal information will be transferred to and processed in the United States as described above; where your law requires consent for such a transfer, we will request it. Requests may be sent to privacy@openseo.so, and we will respond within the time required by your local law.

VIII. LINKS TO OTHER WEBSITES

As part of the Service, we may provide links to or compatibility with other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Site and the Service. Therefore, this Privacy Policy does not apply to your use of a third-party website accessed by selecting a link on our Site or via our Service. To the extent that you access or use the Service through or on another website or application, then the privacy policy of that other website or application will apply to your access or use of that site or application. We encourage our users to read the privacy statements of other websites before proceeding to use them. Our own disclosure obligations regarding providers acting for us are not displaced by this section.

IX. CHANGES TO OUR PRIVACY POLICY

The Company reserves the right to change this policy and our Terms of Service at any time. We will notify you of significant changes to our Privacy Policy by sending a notice to the primary email address specified in your account or by placing a prominent notice on our site. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. You should periodically check the Site and this privacy page for updates.

X. CONTACT US

Privacy requests and appeals: privacy@openseo.so. Other questions: hello@code4genius.com. Mail: Code4Genius Limited, 34 Harding Street, Cambridge, Massachusetts 02141.