Privacy Policy — Lexio
Last updated: August 21, 2026
1. Data Controller
Daniel Friant
Trade name: Agence SEO Connect
Status: Sole trader (Auto-entrepreneur)
Country: France
Email: daniel.friant@agence-seo-connect.tech
Application: https://app.agence-seo-connect.tech
2. Data Collected and Purposes
2.1 Account Data
- Data: email address, name, Google identifier (if signing in with Google)
- Purpose: creation and management of your user account
- Legal basis: performance of contract (Terms of Service)
2.2 Third-Party Service Connection Data
Google Search Console & Google Analytics
When you connect your Google account to Lexio:
- Data accessed: website performance data (queries, positions, impressions, clicks) from Google Search Console; audience metrics from Google Analytics 4
- OAuth scopes used:
https://www.googleapis.com/auth/webmasters.readonly(GSC read-only)https://www.googleapis.com/auth/analytics.readonly(GA4 read-only)
- Purpose: SEO analysis, content opportunity detection, report generation
- Storage: access tokens encrypted (AES-256-GCM) in our secure database
- Sharing: no Google data is shared with third parties
- Legal basis: explicit consent (OAuth flow)
Facebook / Instagram (Meta)
When you connect your Facebook Page to Lexio (Meta OAuth), Lexio may also access the Instagram Business or Creator account linked to that Page, when applicable:
- Data accessed: connected Meta account display name, Meta user ID (
fbUserId), Facebook Page name and ID, OAuth tokens (user and Page); for linked Instagram: account ID (igUserId), username (@username), profile website link (read-only, bio field) - OAuth permissions:
pages_show_list,pages_read_engagement,pages_manage_posts,public_profile,instagram_basic,instagram_content_publish - Purpose: automated publishing to your Facebook Page and, when an Instagram Business/Creator account is linked, to that Instagram account; displaying connection status in Lexio
- Storage: encrypted tokens (AES-256-GCM); Page and Instagram identifiers; post IDs published via Lexio (
fbPostId,igPostId) on your articles - Sharing: no Meta data is shared with third parties or used for advertising
- Legal basis: explicit consent (Meta OAuth flow)
WordPress
- Data: site URL, encrypted WordPress application credentials
- Purpose: automated article publishing to your WordPress site
- Legal basis: performance of contract
2.3 Billing Data
- Processed by Stripe (data processor) — Lexio does not store any credit card data
- Stripe Privacy Policy: https://stripe.com/privacy
2.4 Usage Data
- Technical logs, action history (audit log), usage statistics
- Purpose: security, debugging, service improvement
- Retention: 12 months
3. Hosting and Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Hostinger | VPS Hosting | EU |
| Supabase | PostgreSQL database, file storage | EU |
| Anthropic | AI content generation (Claude) | USA |
| OpenAI | Image generation (GPT-image-2) | USA |
| Stripe | Billing | USA |
| Resend | Transactional email delivery | USA |
Transfers to sub-processors outside the EU are governed by the European Commission's Standard Contractual Clauses (SCCs).
4. Retention Periods
| Data | Retention |
|---|---|
| User account | Duration of subscription + 3 years |
| Google / Meta OAuth tokens (Facebook & Instagram) | Until disconnection or revocation |
| Audit logs | 12 months |
| Billing data | 10 years (legal obligation) |
5. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct your data
- Right to erasure: delete your account and data
- Right to data portability: receive your data in a structured format
- Right to object: object to certain processing activities
- Right to withdraw consent: revoke Google or Meta (Facebook / Instagram) OAuth access at any time
To exercise your rights: daniel.friant@agence-seo-connect.tech
If your request is not resolved, you may contact the CNIL (French data protection authority): https://www.cnil.fr
6. Revoking OAuth Access
Google Search Console / GA4
You can revoke Lexio's access at any time:
- From Lexio: Settings → Connections → Disconnect
- From Google: https://myaccount.google.com/permissions
Facebook / Instagram (Meta)
- From Lexio: Settings → Connections → Disconnect Facebook (also removes linked Instagram data stored in Lexio)
- From Facebook: Settings → Apps and Websites
- Public deletion instructions: https://app.agence-seo-connect.tech/data-deletion/en
7. Security
- All tokens and secrets are encrypted AES-256-GCM at rest
- HTTPS connections exclusively
- Data access strictly isolated per organization (multi-tenant)
- No secrets are exposed in logs
8. Cookies
Lexio uses only a secure session cookie (__Secure-next-auth.session-token) required for authentication. No advertising or tracking cookies are used.
9. Changes to This Policy
Any material changes to this policy will be notified by email to active users at least 30 days before taking effect.
10. Contact
Daniel Friant — Agence SEO Connect
daniel.friant@agence-seo-connect.tech
https://app.agence-seo-connect.tech