Legal

Privacy Policy

How VASEO collects, uses, stores and shares personal information and Google user data, in plain words.

Last updated: 13 October 2026

1. Who is responsible

In this policy, "VASEO", "I" and "me" mean Vasso Vassiliades, an independent SEO and AEO consultant trading as VASEO.
VASEO is based in Cape Town, South Africa, and is the responsible party for personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).
Contact for anything in this policy: [email protected].

The website at vaseo.co.za, including the brief form and private proposal pages.
Client engagements: SEO, AEO, analytics, CRM and the related work described on this site.
The VASEO Google Ads connector, a private read-only reporting tool (see section 4).

Brief form: your name, company and site URL, email address, and the needs, timeline and message you enter.
Sent with the form: campaign tags (UTM parameters), the referring page and the page you landed on, so I know how you found the site.
Spam protection: your IP address and browser user agent, stored with the submission and used to rate-limit and block abuse.
Private proposals: comments and accept or decline responses a recipient leaves on their own proposal page.

The site sets no advertising or analytics cookies today.
A private proposal page sets a strictly necessary cookie for six hours after the recipient enters their passcode, so they stay unlocked.
Your browser remembers one setting locally: whether you turned animations off.
Page-speed measurements are recorded in the page and are not sent to any analytics service today. If analytics is added, this policy is updated first.

Form submissions and proposal responses are stored in the Cloudflare database that runs this website.
They are used only to reply to you, scope and deliver the work, and keep a record of what was agreed.
Form submissions that do not lead to an engagement are deleted on request, and otherwise within 24 months.

A private tool I use to deliver SEO and paid-search research and reporting to clients. It is not a public product, and nobody signs up for it.
It connects to the Google Ads API through Google OAuth, signed in as [email protected], using the Google Ads API scope (https://www.googleapis.com/auth/adwords).
It only reaches Google Ads accounts whose owners have added [email protected] as a user with Read only access.

Account details, such as the account name, customer ID, currency and time zone.
Performance reports for campaigns, ad groups and keywords, such as impressions, clicks, cost and conversions, pulled with Google Ads reporting queries.
Keyword Planner data: keyword ideas and historical search volumes.
Location lookups: Google's list of geographic targets, used to set the country or city for keyword research.

It never creates, edits, pauses or deletes campaigns, ads, budgets, bids or any other setting.
It never changes spend, billing or who has access to the account.
It never reaches other Google services, such as Gmail, Drive or Calendar, through this connection.

Only to deliver the research and reporting the account owner engaged VASEO for: keyword research, search-volume sizing, paid and organic performance analysis, and the reports and recommendations built from them.
Data from one client's account is used only for that client.
It is never used for advertising, retargeting or interest-based profiling, never sold, and never used to judge credit-worthiness or for lending.
It is never used to develop, improve or train AI or machine-learning models.

Me. A client agrees to me viewing their Google Ads data when they add [email protected] to their account for an engagement.
My self-hosted connector server, on DigitalOcean in Singapore. Requests pass through it, and it keeps no Google Ads data after a request finishes.
AI assistants: Claude, made by Anthropic, reads the results on my instructions to analyse them and draft reports. My Claude account has model training ("Model Improvement") turned off, so these sessions are not used to train Anthropic's models.
Nobody else, unless the law requires it.

Connector server: no Google Ads data is stored once a request completes.
Sign-in credentials: the OAuth refresh token sits in a file on the server that only its owner can read, plus an encrypted local backup. It grants read-only access and nothing else.
Reports and findings built from the data: kept in that client's project folder for the length of the engagement and up to 12 months after it ends, as a record of the work, then deleted. Sooner on request.
AI sessions: Anthropic keeps session data under its own privacy policy, and states that deleted conversations leave its back-end systems within 30 days.

The client who owns the Google Ads account: the reports are made for them.
The service providers named above, only to run the service.
Anyone the law requires, or where needed to investigate security abuse.
If VASEO is ever sold or merged, Google user data moves only with the client's explicit consent first.
Never ad networks, data brokers or information resellers.

Every request between Google, the connector server and the AI assistant travels over encrypted HTTPS (TLS).
The connector server only answers requests that carry a secret access key.
Credentials are never written into code, chat transcripts or shared documents.
Least privilege: one Google scope, used only for reading.

Account owners: in Google Ads, open Admin, then Access and security, find [email protected] and choose Remove access. Access ends straight away.
If you ever authorised the VASEO app on your own Google Account, you can revoke it at myaccount.google.com/permissions.
To have data deleted, email [email protected]. I delete it within 30 days and confirm in writing.

VASEO's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Clients sometimes give access to other tools for an engagement, such as Google Search Console, Google Analytics or a CMS.
That access is used only for that client's engagement, may be analysed with the same AI assistant, and follows the same retention and deletion rules as section 4.
Access is ended when the engagement ends, or sooner if the client removes it.

Website and form data: Cloudflare, on its global network.
Google Ads connector: DigitalOcean, Singapore.
AI analysis: Anthropic, United States.
Personal information may therefore be processed outside South Africa. These providers are used only to run the services described here.

Ask what personal information I hold about you, and have it corrected or deleted.
Object to how it is being processed, or withdraw consent you gave.
Send any request to [email protected]. I reply within 30 days.
You can also complain to South Africa's Information Regulator: inforegulator.org.za, [email protected].

The date at the top of this page changes whenever the policy does.
If a change affects Google user data, I tell affected clients by email and ask for their consent before any new use.