Privacy Policy

1. Introduction

In plain terms: we collect the data needed to run your account and our AI agents, we never sell it, and you can access, export, or delete it at any time. The sections below set out the detail.

Atlio Information Technology LLC (“Atlio Information Technology”, “we”, “us”, “our”), registered in Dubai, United Arab Emirates, operates the SearchChamp platform at searchchamp.com. SearchChamp is a product of Atlio Information Technology. We are committed to protecting your personal data and complying with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

This Privacy Policy explains how we collect, use, share, and safeguard your personal data when you access or use our platform, websites, and services. By creating an account or continuing to use SearchChamp, you acknowledge that you have read and understood this policy.

2. Data we collect

We collect the following categories of personal data:

2.1 Data you provide directly

• Account data: name, email address, company name, and job title when you register.
• Payment data: billing address and payment method details processed by Stripe. We never store raw card numbers on our servers.
• Connected-site credentials: WordPress Application Passwords and Shopify OAuth tokens that you authorise. These are stored encrypted in AWS Secrets Manager and can be revoked at any time.
• Support communications: messages, attachments, and metadata when you contact our support team.

2.2 Data collected automatically

• Usage data: pages visited, features used, agent jobs initiated, keyword searches run, and timestamps of those actions.
• Device and browser data: IP address, user-agent string, browser type and version, operating system, referrer URL, and screen resolution.
• Performance data: error traces, API response times, and crash reports collected via server-side logging.

2.3 Data from third-party integrations

• Google Search Console and Google Analytics 4: search query data, click data, and audience metrics you authorise us to read on your behalf.
• DataForSEO: keyword volume, SERP data, and backlink metrics retrieved using your search inputs.

3. How we use your data

We use your personal data to:

• Provide, operate, and improve the SearchChamp platform and its AI agents (including Keyword Research, Content Writer, Site Auditor, AI Visibility Tracker, GTM Assistant, GA4 Insights, and llms.txt Generator).
• Process payments, issue invoices, and manage subscriptions.
• Send transactional emails (account confirmation, password reset, billing receipts) and, where you have opted in, product updates and weekly SEO digest emails.
• Run AI agent jobs on your behalf using Anthropic Claude and OpenAI models. Data submitted to these models is processed as described in section 5.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations under UAE law and applicable international regulations.
• Conduct anonymised, aggregated analytics to understand feature usage and improve our product.

4. Legal basis for processing

Where the GDPR applies to our processing of your data (for example, where you are based in the European Economic Area or the United Kingdom), we rely on the following legal bases:

• Contract performance (Art. 6(1)(b)): processing necessary to provide the services you have signed up for, including account management, AI agent execution, and payment processing.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, product analytics, and customer support. We balance these interests against your rights before relying on this basis.
• Consent (Art. 6(1)(a)): marketing emails. Should we introduce optional analytics cookies, those will also rely on your consent (see our Cookie Policy). You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): retaining invoices and billing records as required by UAE commercial law.

Under the UAE PDPL, we process your data on the bases of contractual necessity, legitimate interest, and your consent where required.

5. Data sharing and sub-processors

We do not sell your personal data. We share data only with the following categories of recipients:

• Infrastructure: Amazon Web Services (AWS) eu-west-1 region hosts our application servers, RDS database, and object storage. AWS processes data under Standard Contractual Clauses (SCCs) where applicable.
• AI model providers: Anthropic (Claude API) and OpenAI process the content and instructions you submit to AI agent jobs. Under their commercial API terms, model inputs are not used to train their models. Additional AI engines used by the AI Visibility feature are listed at /legal/sub-processors.
• SEO data: DataForSEO OÜ (Estonia, EU) provides keyword, SERP, and backlink data. Queries include keywords and URLs you submit.
• Payment processing: Stripe processes all payment card transactions. Stripe is PCI-DSS Level 1 certified.
• Google integrations (optional): when you connect Google Search Console, Google Analytics 4, or Google Ads, SearchChamp reads that data on your behalf via OAuth tokens you authorise. We never share your data with Google for advertising; access is read-only and revocable at any time.
• Authentication: AWS Cognito manages identity and MFA. Tokens are stored client-side in your browser and are never stored on our servers.

A full list of sub-processors, their purposes, and data-transfer mechanisms is maintained at /legal/sub-processors and updated whenever a material change occurs.

6. International transfers

Atlio Information Technology is based in the UAE and processes data primarily in AWS eu-west-1 (Ireland). For EEA or UK users, transfers to AI providers in the United States are safeguarded by those providers’ data processing terms, which incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). We assess the legal landscape of each destination country before transferring data.

If you are based in a jurisdiction with specific transfer-restriction requirements, please contact us at [email protected] to request details of the applicable transfer mechanisms.

7. Data retention

We retain your data for the following periods:

• Account data: retained for the lifetime of your account and deleted within 30 days of account closure, unless we are required by law to retain it longer.
• AI agent job outputs (keyword lists, content drafts, audit results, reports): retained for the lifetime of your account so your work remains available, and deleted with your account data on closure. You may export outputs at any time.
• Agent job logs (task inputs, model prompts): retained for up to 30 days for debugging purposes, then deleted.
• Billing records: retained for 7 years, exceeding the five-year minimum under UAE Federal Decree-Law No. 32 of 2021 (Commercial Companies Law) and UAE tax record-keeping requirements.
• Support tickets: retained for 3 years from resolution.
• Server logs (IP addresses, access logs): retained for 30 days.
• Verified-bot crawler visit records (hashed IP + verification verdict): retained on a rolling 90-day window, then purged. Raw crawler IPs are never persisted (see our Security page).

8. Your rights

Under the UAE PDPL and, where applicable, the GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
• Portability: receive your data in a structured, machine-readable format (JSON or CSV).
• Restriction: request that we restrict processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

9. Children

The SearchChamp platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data about a child, please contact [email protected] and we will delete it promptly.

10. Cookies

We use cookies and similar technologies to operate the platform, maintain your session, and (with your consent) analyse usage patterns. A full description of the cookies we use and how to manage them is available in our Cookie Policy.

11. Security

We implement appropriate technical and organisational measures to protect your personal data, including AES-256 encryption at rest, TLS 1.3 in transit, least-privilege access controls, and audit logging of data-access events. For a detailed description of our security posture, see our Security page.

Despite these measures, no internet transmission is 100% secure. If you discover a potential security vulnerability, please disclose it responsibly to [email protected].

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the “Effective” date at the top of this page. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

13. Contact

For privacy-related enquiries or to exercise your data-subject rights: