Privacy Policy

This Privacy Policy explains what personal data TapasSEO collects, why, how we use it, who we share it with, how long we keep it, and your rights. TapasSEO is operated by Leverage (theleverage.net).

1. Data controller

The data controller is Leverage, the company that operates TapasSEO. Contact: hello@tapasseo.com.

2. What we collect

2.1 When you order a service

• Your name and email address
• The domain(s), keywords, target market, and any other inputs you submit for the service
• Billing details handled by our payment processor (we receive a confirmation and the last 4 digits of the card; we do not store full card numbers)

2.2 When you use our AI chat consultant

• The messages you send and the AI’s replies
• A randomly generated session ID stored in your browser’s localStorage
• Your IP address, to enforce rate limits and prevent abuse
• If you ask to be contacted: your email and/or name, phone, preferred time, timezone

2.3 When you visit the site

• Standard web analytics: pages viewed, referrer, device/browser type, country-level location, approximate time-on-page (via Google Tag Manager / Google Analytics)
• A one-off anonymous token issued by Cloudflare Turnstile to distinguish humans from bots (no personal data)

3. Why we collect it

• Deliver the service you ordered — your inputs are needed to produce the research or audit.
• Contact you — to deliver the report, answer questions, or follow up on a consultation request.
• Improve the site and services — understanding which pages convert, which services are most searched for, and where users get stuck.
• Prevent abuse — rate-limiting the AI chat, detecting bots, enforcing payment validation.
• Legal compliance — record-keeping for tax, accounting, and contractual obligations.

4. Legal bases (GDPR)

If you are in the European Economic Area or the UK, our legal bases for processing your personal data are:

• Contract — to provide the service you paid for.
• Legitimate interests — to prevent abuse, improve the service, and communicate with prospective customers who initiated contact.
• Consent — for optional analytics cookies where required.
• Legal obligation — for tax, accounting, and fraud-prevention record-keeping.

5. How long we keep data

Data	Retention
Order records (customer name, email, service, invoice)	7 years — tax & accounting
Deliverable files (PDFs, Excel reports)	24 months from delivery; then archived or deleted
AI chat conversations	90 days, unless you requested a consultation (then with the lead record)
Lead records (email / phone consultation requests)	24 months, then anonymized or deleted
Web analytics	Per Google Analytics default (typically 14 months)
Rate-limit records (IP + timestamps)	30 days

6. Who we share data with

We do not sell your personal data. We share only with the service providers we need to run TapasSEO:

Provider	Purpose
Google (Tag Manager, Analytics)	Web analytics
Cloudflare (Turnstile)	Bot / abuse prevention
Anthropic	AI chat consultant — processes your chat messages to generate replies
Airtable	Lead and order records storage
n8n (self-hosted on eladleverage.app.n8n.cloud)	Workflow automation for chat, lead forms, and service delivery
BlueSnap	Payment processing
Microsoft 365 / SMTP provider	Transactional email (order confirmations, deliverables, replies)

Each provider operates under its own terms and privacy policy; we only share the minimum data needed for them to perform their function.

7. Cookies and trackers

We use a small number of cookies:

• Strictly necessary — Cloudflare Turnstile session tokens, payment session cookies. These cannot be disabled if you want to order or use the chat.
• Analytics — Google Analytics via Google Tag Manager. You can block these with a browser privacy extension or by opting out in your browser’s cookie settings where required by law.

The AI chat also stores your recent conversation in your browser’s localStorage (not a cookie) so you can resume a session if you reload the page. You can clear it in your browser’s developer tools or site settings.

8. International transfers

Our providers include companies based in the United States (Anthropic, Airtable, Google, Cloudflare, BlueSnap). Where required, we rely on Standard Contractual Clauses or equivalent safeguards for transfers of EU/UK personal data outside the EEA/UK.

9. Your rights (GDPR / CCPA)

Depending on where you live you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (subject to legal retention requirements)
• Restrict or object to processing
• Receive a portable copy of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

California residents have additional rights under CCPA/CPRA including the right to know, the right to delete, and the right to opt out of any “sale” of personal data. We do not sell personal data.

To exercise any of these rights, email hello@tapasseo.com. We respond within 30 days.

10. Security

We use HTTPS site-wide, keep access to data limited to the few people who operate TapasSEO, rely on reputable providers with their own security programs, and rotate credentials periodically. No system is 100% secure — if you suspect a breach, contact us immediately.

11. Children

TapasSEO is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has submitted personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Policy. The “Last updated” date reflects the most recent version. Material changes will be announced on this page and, where appropriate, by email to active customers.

13. Contact us

Questions about your data or this policy? Email hello@tapasseo.com or visit the contact page.