Privacy Policy

Last updated: July 2026

1. Data we collect

  • Account information: name and email address (via Google OAuth).
  • Usage data: keywords, articles, schedules, and project settings you create in SigoMark.
  • Payment data: transaction reference codes and invoice status. We do not store credit card details — payments are processed through a third-party gateway (SePay).
  • Technical data: IP address, browser type, and error logs used for technical support.

2. How we use your data

  • To provide and improve the SigoMark service.
  • To process payments and manage subscriptions.
  • To provide technical support when you contact us.
  • To send important account notifications (expiry, plan changes).

We do not sell or share your personal data with third parties for advertising purposes.

3. Data we share with third parties

We do not sell your data, and we do not share personal data with data brokers or advertisers. Data is transferred only to the providers below, and only to the minimum extent needed to operate the feature you are using:

  • Google Gemini API (paid tier): when you use an AI suggestion feature (long-tail keywords, anchor text, article content), the keyword or topic concerned is sent to Gemini to generate the suggestions returned to you. We use the paid tier; under Google's terms, data submitted through the paid tier is not used to train AI models. We never send your email, passwords, or tokens to Gemini.
  • SePay (payment gateway): receives a transaction reference and amount in order to process payment. We neither store nor transmit your card details.
  • Social publishing provider (Upload-Post): if you choose to connect a channel through this provider, the content you schedule (title, description, image/video) is sent to them for publishing. YouTube channels connected directly via Google OAuth are uploaded straight to YouTube and do not pass through any third party.
  • Server infrastructure provider in Vietnam: hosts your database and files.

Beyond the above, we disclose data only where legally required by a competent authority.

4. How we protect your data

  • Data is stored on servers in Vietnam.
  • Google access tokens (Search Console and YouTube refresh tokens) are encrypted at rest with AES-256. The encryption key lives outside the source code, in server configuration only. Each record uses its own randomly generated initialisation vector.
  • Your API keys are likewise encrypted at rest using AES-256.
  • Passwords (if applicable) are hashed using bcrypt.
  • HTTPS is enforced across all services; all exchanges with Google APIs occur over encrypted channels.
  • Each account's data is isolated by workspace; our staff access it only when you request support or when an incident requires investigation.

5. Data retention and deletion

While your account is active: we retain your data until you delete it or delete your account. Search Console performance data is fully replaced on each sync (we keep only the latest snapshot, plus ranking history so you can compare movement over time).

When you disconnect a Google service (the "Disconnect" button on the Rankings page, or removing a channel on the Social page), immediately:

  • We call Google to revoke SigoMark's access.
  • The refresh token is deleted from our database; no copy is retained.
  • For Search Console: ranking data synced via the API is deleted. Data you imported yourself via CSV is kept, because it is your own file — you can delete it at any time.

When you delete your account (Profile → Delete account), this happens immediately and cannot be undone:

  • All Google access is revoked at Google and every refresh token is deleted.
  • All your Search Console data, YouTube data, projects, articles, keywords, social channels, scheduled posts, and videos are deleted from our database.
  • Your personal profile (email, name, avatar, Google account link) is anonymised so it can no longer be traced back to you.
  • The single exception: invoices and payment transaction records are retained in anonymised form to meet statutory accounting record-keeping obligations. They contain no Google data and no information identifying you.

You may also request deletion via our support email; we action such requests within 14 days. Database backups rotate and are overwritten within 7 days, after which deleted data is gone from backups as well.

6. Your rights

  • Access: view the personal data we hold about you.
  • Correct: update your information in the Profile section.
  • Delete: delete your account and all data yourself inside the app (Profile → Delete account), or request it via our support email.
  • Revoke access: disconnect Google at any time inside the app, or via Google Account Permissions.
  • Export: request an export of your articles and keywords.

7. Cookies

SigoMark uses strictly necessary cookies to maintain your login session and save interface preferences. We do not use third-party tracking cookies for advertising purposes.

8. Policy changes

When material changes are made, we will notify you by email and display the updated policy on this page at least 14 days before it takes effect.

9. Google API Services

SigoMark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

  • Google Search Console (webmasters.readonly): when you connect your Search Console account, SigoMark reads search performance data (queries, impressions, clicks, positions) for properties you have verified ownership of. This data is displayed solely in your Rankings report to help you identify keyword opportunities. We do not sell, share, or use this data for any purpose beyond providing the service to you.
  • YouTube (youtube): when you connect your YouTube account, SigoMark uses the YouTube Data API to: (1) upload video content to your channel on your behalf; (2) schedule when a video becomes public (publishAt); (3) add videos that SigoMark has uploaded to a playlist you specify; and (4) read the publish status of videos SigoMark uploaded to confirm successful publishing. We do not delete videos, do not modify videos or playlists that SigoMark did not create, and do not change your channel settings. YouTube data is not stored beyond what is necessary to complete and confirm the upload.

No AI/ML training: data received from Google Search Console and YouTube is not used to develop, improve, or train any AI/ML model, and is not transferred to any third-party service that would use it to train their models. Our AI features use the Google Gemini API on the paid tier — under Google's terms, data submitted through the paid tier is not used for model training.

Retention and deletion: see section 5 for full details. In summary: disconnecting revokes access at Google and deletes the token immediately; deleting your account removes all of your Google data from our systems.

You may revoke SigoMark's access to your Google account at any time — inside the app, or via Google Account Permissions.

10. Contact

If you have questions about this Privacy Policy, please reach out: sigomarkseoagent@gmail.com