Data Control
Export, deletion, retention, and what HubSEO stores. Your data is yours.
What HubSEO stores about you
- Account · email and auth identity (Supabase Auth).
- Projects and reports · the URLs you audit, the measurements taken, and the evidence artefacts behind each finding.
- Connections · encrypted third-party credentials for services you explicitly connect (Search Console, GitHub, WordPress, Shopify). Stored AES-256-GCM encrypted; never in plaintext.
- Billing state · plan tier and purchase records via Stripe. Card data never touches HubSEO systems; Stripe handles it.
Export
Self-serve, any time: a machine-readable JSON export of all projects, reports, opportunities, and evidence associated with your account. Initiate it from your account settings.
Deletion
Self-serve, any time: account deletion performs an atomic cascade that removes all user records, reports, credentials, and the auth user entity. There is no soft-delete limbo: the cascade is verified by tests that assert the rows are gone.
Data Export
POST /api/account/export · machine-readable JSON archive of all records, telemetry, and audit evidence.
Account Deletion
POST /api/account/delete · verified atomic cascade. Complete hard deletion with zero soft-delete limbo.
Disconnecting a service
Revoking a connector revokes its stored credential and stops all reads through it. Google Search Console disconnection stops all GSC reads immediately.
Where the data lives
Production data lives in the European Union: the application and database run on EU infrastructure (Contabo, Germany, for the audit engine and self-hosted Supabase; Vercel's EU regions for the site). Legal pages, including the DPA, are on the main site at hubseo.dev/dpa.
What HubSEO does not do
- Sell or share your data with third parties for their marketing.
- Store payment card data.
- Keep credentials you revoked.