Privacy notice: SeoPageForge AI sales assistant

1. Who is responsible

The controller of your personal data is:

You can contact us at this address about anything in this notice, including to exercise your rights. A person, not the AI assistant, handles privacy requests.

2. How the AI assistant works

• Emails from our sales assistant may be drafted by an AI system. The first message to you says so and names SeoPageForge as the business it acts for.
• A human reviews and approves every outgoing message before it is sent. The approval covers the exact recipient, subject and text. If any of these change, the message needs a new approval.
• The assistant cannot decide on its own whether it may contact you. Our system checks, among other things, that the address is not blocked because of an opt-out, a complaint or a failed delivery. If any check fails, nothing is sent.
• Replies you send us are received and processed by our own system and read by our staff. They are not currently passed to the AI assistant or an AI model. If the assistant is later given access to replies, we will update this notice first.
• We do not use the assistant to make decisions that have legal or similarly significant effects on you. Questions about pricing, contracts, legal matters or privacy go to a human.
• We do not track opens or link clicks in these emails.

3. What data we process

• Business contact details: your business email address and, where known, the company it belongs to (the company’s legal name and web domain). We do not keep separate fields for your name or job title. Your name can appear in the text of a message or note if it is part of that text.
• Contact basis: a record of why we may contact you, the evidence for it, and where your address came from.
• Business context: notes about your company that are relevant to a possible business conversation, taken from sources described in section 4.
• Messages we send you: the subject, text, sending time and the technical headers that keep an email conversation together (such as Message-ID).
• Your replies: the content of any email you send back, including attachments, and its technical headers.
• Delivery events: technical records from our email provider, for example whether a message was accepted, delivered, bounced, or reported as spam.
• Opt-out and blocking records: your email address together with the reason it is blocked (opt-out, complaint, hard bounce, repeated temporary delivery failures (three within seven days) or a manual block), plus when and how an opt-out reached us.
• Records of approvals and actions: which person approved which message and when. These audit records are designed not to contain your email address or message text.

We do not intend to process special categories of personal data. Please do not send them to us.

4. Where the data comes from

We obtain your business contact details from an address your organisation publishes itself for business enquiries (for example on its own website), from information you gave us yourself, or, with your consent, from an introduction by someone you know. A person at SeoPageForge enters each address and records its source and the reason we may contact you. Your replies and delivery events come from you and from our email provider.

Our systems do not send email to addresses collected by automated scraping.

5. Purposes and lawful basis

Where we rely on legitimate interest, you can object at any time (see section 10). An objection to direct marketing is always honoured.

6. Who receives the data

We do not sell your data. We share it only with these service providers, who process it on our behalf:

• Mailgun (Mailgun Technologies, part of the Sinch group), EU region: sends our emails and receives your replies and opt-outs. Mailgun sees the full messages, addresses and delivery events. Our Mailgun account uses its EU region, so this data is processed there. Mailgun support staff and its sub-processors may access it from outside the EEA; see section 7. Mailgun processes this data under its standard Data Processing Agreement, which forms part of its terms of service.
• Cloudflare: terminates the secure connection that forwards delivery events and incoming replies (including their content and attachments) from Mailgun to our server, and hosts this page. Cloudflare processes this data under its Data Processing Addendum, which forms part of its subscription terms. Cloudflare runs a global network, so a connection may be handled in a Cloudflare data centre outside the EEA. We do not export Cloudflare request logs.
• AI model providers: to draft a message, the assistant sends relevant context to an AI model. This context can include your email address, your company, business notes (which may mention your name) and the earlier messages we sent you. It does not currently include your replies (see section 2).
  • OpenAI provides the main model. It is accessed through a ChatGPT Business (formerly Team) plan held for SeoPageForge. Under OpenAI’s business terms, business data from this plan is not used to train OpenAI’s models by default. For customers in the EEA, OpenAI’s business services are provided by OpenAI Ireland Limited under OpenAI’s Data Processing Addendum. At present no personal data of real recipients is sent to any AI model: the assistant currently works only on test data. We will update this notice before that changes.
  • Upstage provides the fallback model, which is used only when the main model is unavailable. We reach it through Nous Portal, operated by Nous Research, which may run the request itself or pass it to Upstage or another inference provider. Nous Research, and Upstage where it is used, therefore receive the context of that request. Before the assistant processes personal data of real recipients, we will either confirm the data processing terms of Nous Research and Upstage and update this notice, or remove the fallback.

Our own application, database and the AI assistant runtime run on a server that SeoPageForge owns and operates itself in the Netherlands. No hosting provider processes this data. The database and the blocking list are stored on that server. The credentials for our email provider and our platform services are held in our password manager, 1Password, and are only loaded into the server’s memory while a service runs. The AI assistant has no direct access to the credentials, the database or the blocking list.

We may disclose data where the law requires it, for example to a court or regulator.

When you open this page, Cloudflare processes your IP address to deliver it. The page sets no cookies and uses no analytics.

7. Transfers outside the EEA

Mailgun processes our email data in its EU region. Our own server is in the Netherlands. Some providers listed above may process or access data outside the European Economic Area: the AI model providers (OpenAI, and for the fallback model Nous Research and Upstage), Cloudflare, and Mailgun, whose support staff and sub-processors may access EU-region data from outside the EEA (Mailgun Technologies is a US company in the Sinch group). For transfers to the United States by Mailgun (support and sub-processor access), Cloudflare and OpenAI (OpenAI Ireland Limited may transfer data to OpenAI group companies in the US), the providers rely on the European Commission’s Standard Contractual Clauses and, where they are certified, the EU–US Data Privacy Framework, as set out in their data processing terms. No personal data of real recipients is sent to the fallback model route (Nous Research and Upstage). Before that changes, we will confirm the safeguards for that route and update this notice, or remove the fallback. You can ask us for a copy of the relevant safeguards.

8. How long we keep it

If you ask us to erase your data, we delete it except for the minimum needed to keep you on our blocking list, unless you ask us to remove that too and understand we may then be unable to prevent future contact.

9. Opting out

You can stop further emails in any of these ways:

• Reply to our message with unsubscribe, I want to unsubscribe, stop, opt out, remove me, uitschrijven, afmelden, meld mij af or verwijder mij on its own, as the subject or as one of the first three lines of your reply.
• Use the unsubscribe option that your email program shows for our message. It sends an email to a personal unsubscribe address and needs no further action from you.
• Email us at the address in section 1.

An opt-out through the unsubscribe option, or a reply as described above that answers our message in the same email conversation, takes effect immediately and automatically, without review by the AI assistant. We do not send a confirmation email. Any other opt-out request, such as a reply that only suggests you want to stop, a request sent as a new email rather than a reply to ours, or an email to our privacy address, is reviewed by a person, who blocks your address where appropriate.

Messages already approved but not yet sent to you are stopped as well. The only exception is a message whose sending had already started at the moment your opt-out arrived: that single message may still be delivered, but no further message follows it.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• object to processing based on legitimate interest, and to direct marketing at any time;
• data portability, where processing is based on a contract;
• not be subject to decisions based solely on automated processing that significantly affect you. We do not make such decisions.

To use a right, email us at the address in section 1. We answer within one month, and may ask you to confirm you control the email address concerned.

11. Complaints

Please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). You can also complain to the authority in the EU country where you live or work.

12. Security

We protect your data with technical and organisational measures, including:

• human approval of every outgoing message;
• verification of every event and reply received from our email provider;
• no public access to our database or internal systems;
• credentials that are kept separate from the AI assistant;
• logs that leave out message content and email addresses.

13. Changes to this notice

We update this notice when our processing changes. The date at the top shows the latest version.