WordPress,
Shopify,
Wix, Webflow and Ghost. Any other site, hosted on your own domain →Last updated 2 November 2026
This Privacy Policy explains how Helio SEO ("we", "us") handles personal data. Helio SEO is provided by Nexborne Ltd, a company registered in England and Wales with company number 17375877 and its registered office at 128 City Road, London EC1V 2NX. Nexborne Ltd is the controller of the personal data described here, and is registered with the Information Commissioner's Office (ICO) under reference ZC240034.
For any privacy question or request, email hello@helioseo.io.
We are the controller for the data we need to run our business and provide the Service to you: your account, billing, sign-in, support and the emails we send you. We are also the controller for the free AI visibility check, and for the list of people who have asked never to be emailed again.
For the content of the websites you connect, your drafts and articles, your Search Console data, your link requests and the reader counts on your articles, you are the controller and we act as your processor. Our Data Processing Agreement at helioseo.io/dpa covers that. If you are a reader of a customer's website, or someone named on it, please contact that business first. We will help them answer you.
Account data. Your email address, your business name, the website addresses you add, your team members' email addresses and your settings. If you arrived through a link that names where it came from, we note that too. You give us these. Passwords are stored only as a salted scrypt hash.
Billing data. Your plan, currency, payment references, invoices, and your card's brand and last four digits. The full card details are taken and held by Mollie B.V., our payment provider, and never reach our servers.
Website content. The public pages of the websites you connect, which we scan to plan and write articles, plus any style samples, instructions and images you give us.
Connection details. Publishing credentials you provide (for example an application password or API key for your website platform), used only to deliver articles to your site. If you install our Wix app, Wix gives us your site's instance ID and the site owner's Wix member ID, which Wix needs as each post's author.
Search Console data. If you connect Google Search Console, Google gives us your site's search figures: the searches it showed for, clicks, impressions and positions. We ask only for read-only access.
Technical data. Our servers see your IP address and browser details with each request. We use them to keep the Service running and to stop abuse, for example by slowing down repeated failed sign-ins. We keep a cost record of each AI request, which holds no personal data.
Communications. Emails you send us and replies we send you.
The free AI visibility check. The website address you enter, the business name we find on it and, if you choose to give it, your email address and whether you asked for a repeat check in a month.
Link requests. If a customer switches on link requests, we look on other websites for pages that mention or list businesses like theirs. We record the page, the contact email address published on that website and, where shown, a contact name. If we email you, we keep the email and any reply you send.
Reader counts. Each article we publish for a customer carries a small script that tells us, once per read, which site sent the reader (for example Google or ChatGPT), and we count clicks on the article's call to action. We keep daily totals only. To count a read once a day, we hold a one-way scrambled code made from the reader's IP address in memory until the day ends (UTC). No cookie, no identifier and no IP address is stored, so nothing we hold can be linked to a reader.
To use the Service we need an email address, a business name and a website address. Everything else is optional, though some features need it.
To provide the Service: creating your account, scanning your site, writing and publishing articles, showing your results and answering support questions. Lawful basis: performance of our contract with you.
To bill you and keep records: managing your plan and subscription and taking payments through Mollie. Lawful basis: contract, and our legal obligations to keep accounting records.
To keep the Service secure: stopping abuse, fraud and attacks, checking an email address can receive mail before an account is made, and screening text typed for the writer. Lawful basis: our legitimate interest in a safe service for every customer.
To send you emails about your account: article notices, weekly results and trial reminders. Lawful basis: contract, and our legitimate interest in helping you get value from the Service. Each email you can stop carries a link that stops it.
To run the free AI visibility check: and to email you the result and one follow-up if you asked for it. Lawful basis: our legitimate interest in showing businesses what the Service does, and your request.
To ask website owners for a link on a customer's behalf: Lawful basis: our customer's legitimate interest, and ours, in asking a business that already mentions or lists them. Each email says that one reply stops it. Anyone who says no or stop is never emailed again by any of our customers.
To improve the Service: understanding which features are used and what they cost to run. Lawful basis: our legitimate interest in a better product.
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 10).
Articles are written with the help of AI models from Anthropic. The material sent for that processing is the public content of your website, your brief and settings, and research gathered for the article. We do not send your payment details or publishing credentials to AI providers.
Under its commercial terms, Anthropic does not use what we send to train its models.
We do not sell personal data. We keep the list of companies that handle data for us short, and we name every one of them here.
Hetzner Online GmbH (Germany): hosting and storage. Our servers are in Hetzner's Helsinki data centre in Finland, inside the EU.
Anthropic PBC (United States): the Claude models that plan and write articles, run the AI visibility check, and find, draft and sort link requests.
Sendinblue SAS, trading as Brevo (France): delivery of the emails we send you, such as article notices, weekly results and account notices.
IONOS SE (Germany): our support inbox and our domain names. Emails you send us are stored there.
Google LLC (United States): the Google Fonts service, which supplies the typefaces on your dashboard and on blog pages we host. Your browser fetches them from Google, so Google sees your IP address.
Mollie B.V. (Netherlands): our payment provider. Mollie processes card payments for us and holds the card details. For its own legal duties as a payment institution it acts as a controller in its own right, under its own privacy policy. Card details go straight to Mollie and never touch our servers.
Stripe Payments UK Ltd (United Kingdom): took payments until 28 October 2026. Stripe keeps its records of those payments under its own legal duties.
Pexels, IndexNow and public DNS services receive no personal data from us: only search words for photographs, the addresses of published articles, and website domain names.
Services you connect yourself, such as your website platform and Google Search Console, receive data only at your direction and under their own terms. They are not our sub-processors.
We may also share data if the law requires it, to protect our rights or anyone's safety, or with a buyer if our business is sold. A buyer would have to keep to this policy.
Hetzner, Brevo, IONOS and Mollie keep data inside the European Economic Area, which the UK recognises as giving adequate protection.
Anthropic and Google are in the United States. For those transfers we rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the ICO, which forms part of our contract with each of them. You can ask us for a copy of the relevant terms.
Your account, sites, plans and articles: for as long as your account exists. The account owner can delete it at any time from Settings, and everything goes at once. If you cancel or your trial ends, we keep the account so you can come back, until you delete it or ask us to.
Sign-in sessions: 30 days, then removed. Signing out removes yours at once.
Password reset links: one hour.
Failed sign-in records: held in memory only, never written to disk, and counted for 15 minutes.
Reader counts: daily totals with no personal data. The once-a-day check is held in memory and dropped when the day ends (UTC).
AI cost records: kept after an account is deleted, with the link to the account removed, so they hold no personal data.
Free AI visibility checks: kept so the link to your result keeps working. Ask us and we will delete yours.
Link requests: kept while the customer's site is with us, and deleted with it.
The do-not-email list: kept for good, because its only job is to make sure we never email that address again.
Billing records: Mollie keeps its payment records under its own legal duties. Our invoices and accounting records are kept for six years, as UK law requires.
Support emails: kept for as long as we need them to help you, then deleted.
Every connection to the Service is encrypted. Passwords are stored only as salted hashes. Sign-in cookies cannot be read by scripts, and repeated failed sign-ins are slowed down. Changing your password signs out every other browser. Each account can see only its own data. Publishing credentials are held server-side, are never shown back in full once saved, and are used only to deliver articles to your own site.
You have the right to be told how we use your data, which is what this policy does. You also have the right to: get a copy of your data; have it corrected; have it deleted; restrict how we use it; object to our use of it, including for direct marketing; and receive data you gave us in a common, machine-readable format. Where we rely on consent, you can withdraw it at any time.
To use any of these rights, email hello@helioseo.io. We may ask you to prove who you are. We will answer within one month, and tell you if we need longer for a complex request. There is normally no charge.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you, as described in Article 22 of the UK GDPR.
Two automatic checks protect the Service. At sign-up we check that your email address can receive mail and is not a throwaway address. On a free trial, an account whose requests the writing model refuses three times in 30 days is suspended. Paid accounts are never suspended by that check alone. If either check affects you, email hello@helioseo.io and a person will review it.
If you connect Google Search Console, we use read-only access to your site's search figures, only to show you your results and to plan and improve your articles. We do not use Google user data for advertising, sell it or let people read it except as needed for security, the law or with your permission. Helio SEO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time from your dashboard or your Google account.
We use one strictly necessary cookie to keep you signed in, and remember your colour theme in your browser if you choose one. We do not run advertising or tracking cookies. Our Cookie Policy at helioseo.io/cookies lists each one.
The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.
If you are unhappy with how we handle your data, please tell us first at hello@helioseo.io and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.
We may update this policy and will post the current version here with the date it last changed. If a change matters to how we use your data, we will email account owners before it takes effect.
For any privacy question or request, contact hello@helioseo.io.
Terms of Service · Privacy Policy · Cookie Policy · Refund Policy · Data Processing Agreement
Nexborne Ltd. Registered in England and Wales. Company number 17375877. Registered office 128 City Road, London EC1V 2NX. ICO registration ZC240034. hello@helioseo.io