$DRAFT = false; in
privacy.php once this page is final and this notice disappears.
This policy explains what information the B2 SEO Intelligence platform handles, why, and what we do with it. It covers this application specifically, including the data we access from Google Analytics, Google Search Console and Google Ads on behalf of our clients.
B2 SEO Intelligence is operated by TO CONFIRM: full registered company name ("B2 Creative", "we", "us"), registered in England and Wales, company number TO CONFIRM, registered office TO CONFIRM: registered address.
For any question about this policy or the information we hold, contact jon@b2creative.co.uk.
B2 SEO Intelligence is a private reporting dashboard we use to deliver SEO and digital marketing services to our clients. It collects a client's existing Google marketing data into one place and presents it in plain English, alongside recommendations. Access is by invitation only — there is no public sign-up.
When a client connects their Google account, they grant us read-only access to the following. The application never creates, edits or deletes anything in a client's Google account, and never changes their campaigns, settings or website.
| Permission requested | What we read | Why |
|---|---|---|
analytics.readonly |
Google Analytics 4 metrics: visits, users, page views, engagement, traffic sources, devices, locations, conversions and ecommerce totals | To show website performance in the dashboard and in client reports |
webmasters.readonly |
Google Search Console data: search clicks, impressions, click-through rate, average ranking position and search queries | To report on visibility in Google Search and identify ranking opportunities |
adwords |
Google Ads totals: spend, clicks, impressions, conversions and conversion value | To report advertising performance and return on ad spend alongside organic results |
userinfo.email and openid |
The email address of the Google account used to authorise access | To record which account a site is connected with, so we can tell you when a connection needs renewing |
The analytics information we receive is aggregated — totals, averages and rankings. We do not receive, request or store data identifying individual visitors to a client's website, and we do not track website visitors ourselves.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not sell Google user data, we do not use it for advertising purposes, we do not use it to train or improve generalised artificial intelligence or machine learning models, and we allow humans to read it only where a client has asked us to, where it is necessary for security or to resolve a technical problem, or where the law requires it.
Parts of this application use a third-party AI service, the Anthropic Claude API, to turn reporting figures into plain-English summaries, recommendations and answers to questions. When one of those features is used, the relevant aggregated figures and business profile details are sent to Anthropic to generate the response. Account passwords, Google credentials and login details are never sent.
Anthropic processes this data on our instructions in order to return the result, and under our agreement with them it is not used to train their models. TO CONFIRM: check the commercial terms in force and the retention period Anthropic applies
We do not sell information to anyone. We share it only with the service providers needed to run the platform:
| Provider | Purpose | Location |
|---|---|---|
| Source of the Analytics, Search Console and Ads data described above | EU / United States | |
| Anthropic | AI summaries, recommendations and question answering | United States |
| TO CONFIRM: hosting provider legal name (StackCP) | Hosting of the application and its database | United Kingdom |
We may also disclose information where we are legally required to, or to protect our rights or the security of the platform.
The platform can generate a link that shows a client's report without signing in. These links are unguessable, are excluded from search engines, and can be replaced or switched off at any time, which immediately stops the old link working. Anyone holding an active link can see that report, so they should be treated as confidential.
Some of our providers process information outside the UK, principally in the United States. Where that happens we rely on the UK International Data Transfer Agreement, or on Standard Contractual Clauses together with the UK Addendum, along with additional safeguards where appropriate. TO CONFIRM: ensure the relevant agreements are in place and on file
These are our intended retention periods. TO CONFIRM: agree these before this page is published
| Information | Kept for |
|---|---|
| Google connection credentials | Until the connection is removed, or the client relationship ends |
| Cached reporting data | 12 months |
| Website audit data | 12 months |
| Generated reports and action plans | Duration of the client relationship, then 12 months |
| Activity log, including IP addresses | 12 months |
| Login accounts | While the account is active; removed within 30 days of a request or the end of the relationship |
A client can ask us to disconnect their Google account at any time, which revokes our access. They can also revoke it themselves at myaccount.google.com/permissions. On request we will delete the reporting data we hold for them.
Access to the platform requires an individual account and password, and every account is limited to the clients it has been granted. Traffic is encrypted in transit using HTTPS, passwords are stored only as salted hashes, and actions are recorded in an activity log. Access to the underlying server and database is restricted to our technical staff.
For the analytics and marketing data we process on a client's behalf, the client is the data controller and we act as their processor, under the terms of our services agreement. For our own platform accounts and activity logs, we are the controller.
Under UK data protection law you have the right to:
To exercise any of these, email jon@b2creative.co.uk. We will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
We process this information to deliver the services set out in our contract with each client, and, for security logging, on the basis of our legitimate interest in keeping the platform safe.
The application sets a single cookie, b2seo_session, which keeps a user signed in
for up to eight hours. It is strictly necessary for the platform to work and is deleted when
the session ends or on sign-out. We do not use advertising, tracking or analytics cookies on
this platform, so there is no cookie banner.
If we change how we handle information we will update this page and the date at the top. Where changes are significant we will tell affected clients directly.
B2 SEO Intelligence · TO CONFIRM: company name and registered address
Email jon@b2creative.co.uk