Privacy Policy

Last updated: 1 January 2026

1. Summary

We respect your privacy. We collect the minimum data needed to run ImageSEO. We do not sell your data. We do not train third-party AI models on your images. We are compliant with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA).

2. Who we are

ImageSEO is a product that generates AI-powered alt text, image filenames, and captions for WordPress websites. The service is accessible at imageseo.io and app.imageseo.io. For the purposes of data protection law, ImageSEO is the data controller of personal data collected through this site and the product.

Questions about this policy should be directed to our support team.

3. Data we collect

Account data

• Email address (required to create an account and send transactional emails)
• First and last name (optional)
• Password, stored as a cryptographic hash (we never see or store it in plaintext)
• Billing address and VAT number if you purchase a paid plan

Usage data

• WordPress site URL(s) connected to ImageSEO
• Number of images processed
• Language preference
• Anonymous aggregate analytics (Google Analytics 4 with IP anonymization)

Payment data

• Handled entirely by Stripe. We never see, store, or process your full card number. We store only a Stripe customer ID and the last four digits of your card for invoice display.

Technical data

• IP address (for fraud prevention and rate limiting; discarded after 30 days)
• Browser type and user-agent string
• Server logs for debugging (retained for 14 days, then auto-deleted)

4. Why we collect it

• To provide the service. We need your email to create your account. We need your WordPress URL to know where to send optimized content back.
• To bill paying customers. Stripe handles card data; we only see what Stripe sends back.
• To improve the product. Aggregated, anonymized usage analytics help us understand which features matter.
• To comply with the law. Invoices, tax records, refund history — kept as long as local law requires.

The legal basis for processing is a combination of contractual necessity (you signed up for the service), legitimate interest (product improvement, fraud prevention), and legal obligation (tax and billing records). For marketing emails, consent.

5. How we handle your images

When ImageSEO analyzes an image from your WordPress media library, we send a secure copy to an AI model running on our infrastructure or a trusted AI provider. The model returns suggested alt text, filenames, and captions. The image itself is discarded from our systems within 24 hours.

We never modify or overwrite the original image file on your server. The only data we write back to your WordPress site is text metadata (alt attributes, title attributes, filenames).

If you delete your ImageSEO account, all image-derived metadata we stored is also deleted.

6. AI models and training

ImageSEO uses large language models and vision models from trusted providers to generate alt text. We do not train third-party models on your images or content. When we send an image to an AI provider, we explicitly opt out of data retention and training where the provider supports it.

Our own models, if any, are trained only on aggregated, anonymized data and never on individual customer content.

7. Who we share data with

We only share data with providers strictly necessary to run the service. These are our “sub-processors”:

• Stripe — payment processing (USA / EU data centers)
• Hostinger — infrastructure hosting (EU data centers)
• Google Analytics — anonymous traffic analytics (IP anonymized)
• Transactional email provider — for account, billing, and support emails
• OpenAI / Anthropic / Google — AI inference for alt text generation (opt-out of training enabled)

We never sell your personal data. We never share it with advertisers. We never pass it to data brokers.

8. Retention

• Account data: retained while your account is active. Deleted within 30 days of account closure.
• Invoices and billing records: 10 years (EU and US tax law requirement).
• Server logs: 14 days.
• IP addresses: 30 days.
• Images sent for AI processing: 24 hours.

9. Your rights (GDPR)

If you are in the EU, UK, or California, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Export your data in a portable format
• Object to processing based on legitimate interest
• Withdraw consent for marketing emails (unsubscribe link in every email)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email us via the support page. We respond within 30 days.

10. Cookies

We use strictly necessary cookies for login, language preference, and fraud prevention. We use Google Analytics cookies for anonymous traffic analytics. We do not use advertising cookies. We do not track you across other websites.

You can disable non-essential cookies via your browser settings. The site will still work.

11. Security

All data is transmitted over HTTPS with TLS 1.2 or higher. Passwords are hashed with bcrypt. Databases are encrypted at rest. Access to production systems is restricted by role, logged, and audited. We use 2FA on all internal tools.

If we ever suffer a data breach that affects your personal data, we will notify you within 72 hours as required by GDPR.

12. Contact

For any privacy-related question, contact us through our support page. We typically respond within 1 business day.

This policy may be updated from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be communicated by email to active customers.