Privacy Policy

SEO Hub (shown on Google sign-in as "BobSeo") is operated by BobOffice, LLC, trading as BobWork (contact: info@bobwork.ai). Last updated 2026-10-05.

What we collect

• Your Google account name and email address when you sign in with Google.
• Search Console and Google Analytics data for the sites you explicitly connect, used only to build your reports and dashboards.
• Credentials you give us to connect your website (for example a WordPress application password or Magento integration keys), stored encrypted.
• Billing details are handled by Stripe; we do not see or store your card number.
• An activity log of sign-ins and actions in the app (email, IP address, action).

Google user data

When you connect Google, SEO Hub asks for these permissions and uses them only as described:

• Search Console (view and manage): read search performance — clicks, impressions, queries and pages — for the sites you connect; add your site and submit its sitemap when you ask us to.
• Site Verification: verify ownership of your site in Search Console, only when you start that from SEO Hub.
• Google Analytics (read-only): read sessions, conversions, landing pages and traffic channels of the GA4 property you select, to show them in your dashboard and reports.
• Google Analytics (edit): create a new GA4 property and web data stream, only when you click "Create GA4 property". We never edit or delete existing properties, users or settings.

We use Google user data only to provide the features you see in SEO Hub. We do not sell it, use it for advertising, or use it to build user profiles. It is never used to develop, improve or train AI or machine-learning models — ours or anyone else's. People at BobWork do not read it unless you ask us to (for example to troubleshoot or to prepare your report), it is needed for security, or the law requires it.

Who we share, transfer or disclose Google user data with

We do not sell, rent or trade Google user data, and we do not share it with advertisers, data brokers or any other third party for their own purposes. Google user data leaves SEO Hub only in these cases:

• Infrastructure that runs SEO Hub for us, acting only on our instructions: Vercel (application hosting and encrypted token storage) and GitHub (private, access-controlled storage of the reports and dashboards we build for you). They process the data only to host and store it for SEO Hub.
• OpenAI (AI keyword research only). When you run AI Keyword Research, we send OpenAI's API up to 75 of your Search Console search queries, with the page each ranks for and its impressions and position — no account details, tokens or Google Analytics data — so it can group them into keyword clusters for your report. If you view a report in Chinese, the report text (which may include those queries and summary figures) is sent to the same API to translate it. OpenAI does not use API data to train its models, and we never ask it to.
• Your own workspace: people we add to your SEO Hub workspace at your request (for example your colleagues) can see that workspace's project reports.
• When the law requires it: to comply with a valid legal request, or to protect the rights, property or safety of our users or the public.
• Business transfer: if BobOffice, LLC is merged or acquired, only with notice to you and under the same protections as this policy.

How we protect Google user data

• Encryption in transit: every connection to SEO Hub and to Google's APIs uses HTTPS (TLS).
• Encryption at rest: Google OAuth refresh tokens are encrypted with AES-256-GCM before they are stored. The key is kept in a separate secret environment variable, not with the data, and tokens are never sent to your browser.
• Least privilege: we request only the permissions listed above and call them only for the actions described. Read access is used for reports; the Search Console write and Analytics edit permissions are used only when you click the matching button.
• Access control: report data is stored in private repositories that only a small number of authorised BobWork staff can open. The app shows each project only to signed-in members of that workspace (secure, HttpOnly session cookies).
• Audit trail: connections, disconnections and data jobs are logged with the user who triggered them.
• Deletion: disconnecting Google deletes the stored token immediately. You can also revoke access at any time at myaccount.google.com/permissions. Account deletion requests are completed within 30 days.

SEO Hub's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Publishing to your website

SEO Hub only publishes to your website after you allow publishing for that site and approve each item. Every change is logged with what it replaced so it can be undone, and you can switch publishing off at any time.

Storage, retention & deletion

Google tokens and website credentials are encrypted at rest. Disconnecting Google or your website in the app deletes the stored token or credentials immediately. You can also revoke Google access at myaccount.google.com/permissions. Report data we built for you is kept while your account is active; to delete your account and all associated data, email info@bobwork.ai and we will do so within 30 days.

Sharing

We share data only with service providers that run SEO Hub for us (hosting, encrypted storage, payments, email, and the AI provider described above), under confidentiality obligations, and only as needed to provide the service — or when required by law. For Google user data specifically, see who we share it with and how we protect it.

← SEO Hub · Terms