How we handle privacy and data

Information may include name, email, phone number, business details, messages sent through the site, IP address, location or bot-detection signals derived from IP, browser and device details, app surface parameters, notification permission state, theme preference, audience-path preference, adult-gate preference, referrers, campaign parameters, route paths, pageviews, clicks, form interaction metadata, dead clicks, scroll and heatmap behavior, Web Vitals and performance attribution, browser errors, console logs, session replay data, canvas activity, network timings, request and response headers or bodies where PostHog permits capture, and survey answers if surveys are created later.

PostHog Cloud EU is the active consent-gated analytics and replay processor when enabled by deployment flags and accepted by the visitor. Google Analytics 4 remains reserved unless its consent-gated tag is enabled later. PostHog may use cookies, local storage, events, session replay, heatmaps, Web Vitals, logs, errors, surveys, IP/device signals, and network diagnostics. Auth-token query parameters are redacted before analytics capture, and SEOH's manual marketing-event bridge strips direct email, phone, company, and message-body values.

Personal data may be processed by trusted service providers that help with hosting, communications, technical infrastructure, analytics, session replay, heatmaps, product analytics, logging, error tracking, performance measurement, surveys, and diagnostics. PostHog Cloud EU processes analytics and replay data for consented visitors. Analytics or advertising providers are used only when configured, disclosed, and consent-gated. Some providers may process data outside Israel when required for those services.

Personal data is processed to respond to enquiries, deliver services, maintain the website, remember visitor preferences, diagnose problems, protect the business, and meet legal or contractual duties.

We use reasonable safeguards such as access controls, limited internal permissions, monitoring, encryption where appropriate, and retention review. Personal data is kept only as long as needed for the purpose collected or as required by law. PostHog session replay retention is currently 30 days; analytics identifiers may remain until cleared by the visitor or expired by the provider.

Users may request access to, correction of, restriction of, or deletion of their personal data where those rights apply. Visitors can reject or withdraw analytics consent through the consent controls or browser storage settings. Privacy choices, account access removal, document deletion, and cancellation requests can be sent through the support or cancellation pages by WhatsApp or email.

When the SEOH PWA or native mobile shell is used, the site may process install state, app surface parameters, notification permission state, device/browser metadata, crash or error context, and external-link handoff signals needed to operate the app experience.

The client portal uses invite-only Supabase magic-link authentication. Supabase may process email addresses, session cookies, authentication events, project rows, status records, intake history, shared documents, and storage metadata under Row Level Security controls.

The PWA can ask for browser notification permission only after a user action and only when the notification prompt flag is enabled. Permission can be denied or changed in browser or device settings.

Adult-industry pages and app sections remain professional, non-explicit, age-rated, and focused on lawful compliance, consent, platform policy, payment policy, reputation, and brand-safe operations.

Support, cancellation, account access removal, document deletion, and data-deletion requests can be sent by WhatsApp or email. SEOH reviews each request against account authority, service status, legal retention, security, and contractual duties.