Privacy Policy — Lexio
Last updated: October 24, 2026
Single Lexio privacy policy — canonical URL: https://app.agence-seo-connect.tech/privacy/en
1. Data Controller
ASC (Agence SEO Connect)
SIREN: 385 312 376
Legal representative: Friant Daniel Joseph
Status: Individual entrepreneur (EI)
Country: France
Email: contact@agence-seo-connect.tech
Application: https://app.agence-seo-connect.tech
2. Data Collected and Purposes
2.1 Account Data
- Data: email address, name, Google identifier (if signing in with Google)
- Sign-in with Google (openid, email, profile scopes): Google identifier, email address, name and profile photo, used only to create your account and sign you in.
- Purpose: creation and management of your user account
- Legal basis: performance of contract (Terms of Service)
2.2 Third-Party Service Connection Data
Google Search Console & Google Analytics
When you connect your Google account to Lexio:
- Data accessed: website performance data (queries, positions, impressions, clicks) from Google Search Console; audience metrics from Google Analytics 4
- OAuth scopes used: openid, email, profile (sign-in);
https://www.googleapis.com/auth/webmasters.readonly(Search Console read-only);https://www.googleapis.com/auth/analytics.readonly(GA4 read-only);https://www.googleapis.com/auth/userinfo.email(email of the Google account connected to Search Console, shown in Settings → Connections). - Purpose: SEO analysis, content opportunity detection, report generation
- Storage: access tokens encrypted (AES-256-GCM). Search Console data: Lexio stores detected SEO opportunities (query, page, impressions, clicks, position) and periodic performance snapshots of your pages to display tracking in the SEO & Analytics tab. GA4 data: per-page metrics are read live and are not stored; only three aggregated 28-day totals (page views, sessions, pages tracked, with no URL and no visitor data) are saved for CSV export.
- Sharing: Google data is not sold, rented, or used for advertising. No Search Console or GA4 metrics and no tokens are sent to our AI providers (Anthropic, OpenAI) for content generation. Exception — only if you enable GEO tracking from Search Console (disabled by default): the text of certain queries from your Search Console opportunities is sent to Perplexity, OpenAI, and Google (Gemini) to check whether your domain is cited in their answers. No metrics (clicks, impressions, positions), account URLs, or tokens are transmitted. You can disable this tracking at any time.
- Legal basis: explicit consent (OAuth flow)
Facebook / Instagram (Meta)
When you connect your Facebook Page to Lexio (Meta OAuth), Lexio may also access the Instagram Business or Creator account linked to that Page, when applicable:
- Data accessed: connected Meta account display name, Meta user ID (
fbUserId), Facebook Page name and ID, OAuth tokens (user and Page); for linked Instagram: account ID (igUserId), username (@username), profile website link (read-only, bio field) - OAuth permissions:
pages_show_list,pages_read_engagement,pages_manage_posts,public_profile,instagram_basic,instagram_content_publish - Purpose: automated publishing to your Facebook Page and, when an Instagram Business/Creator account is linked, to that Instagram account; displaying connection status in Lexio
- Storage: encrypted tokens (AES-256-GCM); Page and Instagram identifiers; post IDs published via Lexio (
fbPostId,igPostId) on your articles - Sharing: no Meta data is shared with third parties or used for advertising
- Legal basis: explicit consent (Meta OAuth flow)
WordPress
- Data: site URL, encrypted WordPress application credentials
- Purpose: automated article publishing to your WordPress site
- Legal basis: performance of contract
2.3 Billing Data
- Processed by Stripe (data processor) — Lexio does not store any credit card data
- Stripe Privacy Policy: https://stripe.com/privacy
2.4 Usage Data
- Technical logs, action history (audit log), usage statistics
- Purpose: security, debugging, service improvement
- Retention: 12 months
3. Hosting and Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Hostinger | VPS Hosting | EU |
| Supabase | PostgreSQL database, file storage | EU |
| Anthropic | AI content generation (Claude) | USA |
| OpenAI | Image generation; optional GEO tracking (query text) | USA |
| Perplexity AI | Optional GEO tracking (query text) | USA |
| Google (Gemini API) | Optional GEO tracking (query text) | USA |
| Stripe | Billing | USA |
| Resend | Transactional email delivery | USA |
Transfers to sub-processors outside the EU are governed by the European Commission's Standard Contractual Clauses (SCCs).
4. Retention Periods
| Data | Retention |
|---|---|
| User account | Duration of subscription + 3 years |
| Google / Meta OAuth tokens (Facebook & Instagram) | Until disconnection or revocation |
| Aggregated GA4 totals (page views, sessions, pages tracked over 28 days) | Until the account is deleted, or immediately if you choose to erase them when disconnecting Google. That erasure is permanent: reconnecting does not rebuild the CSV history. |
| SEO opportunities and performance snapshots (derived from Search Console) | Until the Lexio account is deleted |
| GEO tracking results | Until GEO tracking is disabled or the account is deleted |
| Audit logs | 12 months |
| Billing data | 10 years (legal obligation) |
5. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct your data
- Right to erasure: delete your account and data
- Right to data portability: receive your data in a structured format
- Right to object: object to certain processing activities
- Right to withdraw consent: revoke Google or Meta (Facebook / Instagram) OAuth access at any time
To exercise your rights: contact@agence-seo-connect.tech
If your request is not resolved, you may contact the CNIL (French data protection authority): https://www.cnil.fr
6. Revoking OAuth Access
Google Search Console / GA4
You can revoke Lexio's access at any time:
From Lexio, disconnecting removes OAuth tokens and the Google email shown in Settings → Connections. Lexio asks whether you want to keep or erase the history of aggregated GA4 totals already saved (CSV export). SEO opportunities and Search Console performance snapshots already stored in your account are not automatically deleted on disconnect: they remain until the account is deleted or upon request to contact@agence-seo-connect.tech. Days spent disconnected stay at zero in the GA4 CSV history if you choose erasure.
- From Lexio: Settings → Connections → Disconnect
- From Google: https://myaccount.google.com/permissions
Facebook / Instagram (Meta)
- From Lexio: Settings → Connections → Disconnect Facebook (also removes linked Instagram data stored in Lexio)
- From Facebook: Settings → Apps and Websites
- Public deletion instructions: https://app.agence-seo-connect.tech/data-deletion/en
7. Security
- All tokens and secrets are encrypted AES-256-GCM at rest
- HTTPS connections exclusively
- Data access strictly isolated per organization (multi-tenant)
- No secrets are exposed in logs
8. Cookies
Lexio uses only a secure session cookie (__Secure-next-auth.session-token) required for authentication. No advertising or tracking cookies are used.
9. Google Data — Limited Use Policy
Lexio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, Lexio commits to:
- use Google user data (Search Console, Analytics, OAuth email address) only to provide or improve user-facing features you request (SEO, analytics, connection status, GEO tracking when enabled);
- not use Google user data for advertising, remarketing, or advertising profiling;
- not sell, rent, or transfer Google user data to third parties except (i) hosting subprocessors necessary to operate the service, (ii) query text sent to the AI engines listed above when you enable GEO tracking, (iii) for security reasons, or (iv) when required by law;
- not allow humans to read Google user data except with your explicit consent, for security reasons (abuse, incidents), to comply with law, or when data is aggregated and anonymized for internal operations.
- not use Google user data, or data derived from it, to develop, improve, or train generalized artificial intelligence or machine learning models.
10. Changes to This Policy
Any material changes to this policy will be notified by email to active users at least 30 days before taking effect.
11. Contact
ASC — Agence SEO Connect
SIREN: 385 312 376
contact@agence-seo-connect.tech
https://app.agence-seo-connect.tech