This policy explains how Clearpath Labs Ltd ("we", "us") — trading as SmashSEO — collects, processes, and protects personal data when you use the SmashSEO platform (the "Service"). We are the data controller for the information described here.
Who we are
Clearpath Labs Ltd is a company registered in England and Wales. For privacy queries, contact hello@smashseo.io.
What we collect
- Account data — your email address and authentication identifiers, held by Supabase on our behalf.
- Billing data — Stripe customer and subscription identifiers. Payment card details are handled by Stripe and never touch our servers.
- Client and content data — domains, brand voice profiles, content plans, audits, and generated articles you create in the platform.
- Operational logs — standard server logs (including IP address) retained briefly for abuse prevention and debugging.
Why we process it
- Contract — to provide the Service you signed up for: audits, plans, article generation, billing.
- Legitimate interest — to prevent abuse, protect the Service, and improve reliability.
- Legal obligation — to retain records required for tax and accounting.
Sub-processors
We rely on the following sub-processors to run the Service:
- Supabase — authentication and database hosting (EU region).
- Stripe — payment processing and subscription management.
- Vercel — website and API hosting.
- Language model providers — used to generate plans and articles on your behalf, under data-processing terms that prohibit training on your inputs.
How long we keep it
- Account and content data — for the life of your account. After cancellation, retained for 60 days for win-back, then deleted.
- Billing records — for the period required by UK tax law.
- Server logs — up to 30 days.
Your rights under UK GDPR
You can request:
- Access to the personal data we hold about you
- Correction of inaccurate data
- Erasure of your account and associated data
- A portable copy of your data
- To object to processing based on legitimate interest
To exercise any of these rights, email hello@smashseo.io. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
International transfers
Some sub-processors (e.g. Stripe, Vercel, model providers) may process data outside the UK/EEA. Where that happens, we rely on the UK International Data Transfer Agreement or equivalent safeguards.
Cookies
We use a small number of first-party cookies strictly necessary to keep you logged in and to remember your preferences. We do not use advertising or tracking cookies.
Changes to this policy
If we make material changes we will update the "last updated" date above and, where appropriate, notify you by email.