Privacy Policy
Last updated: October 22, 2026
This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), explains how personal data of visitors of this website and users of the Active SEO dashboard (app.activeseo.it) is processed.
1. Data controller
Bug Fixing S.r.l. (innovative startup), Ripa di Porta Ticinese 39, 20143 Milan, Italy · VAT no. 13763760967.
For any privacy request: info@activeseo.it.
2. What data we process
- Account data: name, email address, password (stored only as a hash, never in clear), language, registration date and date you accepted the terms.
- Data of the connected websites: website address, public pages and content analysed, keywords, rankings, proposed and applied changes. If you enter them, also the website access credentials (FTP, WordPress application, connectors) and API keys, which are stored encrypted.
- Google Search Console and Google Analytics data, only if you authorise the connection. You can revoke access at any time from your Google account.
- Payment data: payments are handled by PayPal. We do not receive or store card or bank account numbers; we receive the subscription ID and status, the amount and the payer’s email address.
- Technical data: IP address, access date and time, actions taken in the dashboard and error messages, for security and support.
- Messages: questions asked to the built-in assistant and the communications you send us.
2-bis. Data of your websites’ visitors
If you use Active SEO on websites that contain third parties’ personal data, Bug Fixing processes it only to provide you with the service, following your instructions, as a data processor. In that case you are the controller and may request the data processing agreement by writing to the address above.
3. Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, providing Active SEO features, support | Performance of a contract (Art. 6.1.b) |
| Invoicing, tax and accounting obligations | Legal obligation (Art. 6.1.c) |
| Security, prevention of abuse and fraud, defence of legal claims | Legitimate interest (Art. 6.1.f) |
| Marketing communications about the service, only if requested | Consent (Art. 6.1.a), which can be withdrawn at any time |
Providing the account data is necessary to use the service. We do not take decisions based solely on automated processing that produce legal effects on the user: AI proposals are always reviewed and approved by you before they are applied.
4. Who we share data with
Data is processed by authorised Bug Fixing staff and by providers acting on our behalf, depending on the features you use:
- Hosting and email: Netsons (Italy), which hosts the dashboard, the database and service emails.
- Payments: PayPal.
- Artificial intelligence: for analysis, suggestions, articles and images, the text of the analysed pages and the necessary instructions are sent to providers such as Anthropic, OpenAI, Google, Pollinations and Freepik/Magnific. On the PRO and Webmaster plans you use your own API keys and have a direct relationship with the provider you choose.
- SEO data: DataForSEO and Moz receive the domain, keywords and locations to measure, not the user’s personal data.
- Google: Search Console and Analytics, through their APIs and only if you connect them.
We do not sell personal data. We may disclose it to authorities where the law requires and to advisers (tax, legal, technical) bound by confidentiality.
5. Transfers outside the European Economic Area
Some providers (for example AI providers) are based or have infrastructure outside the EU, in particular in the United States. Transfers take place on the basis of an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.
6. How long we keep data
- Account and website data is kept while the account is active and deleted when it is closed or on your request, except as stated below.
- Accounting and tax records are kept for 10 years, as required by law.
- Technical security logs are kept for as long as strictly necessary.
- Backups are overwritten on a rolling basis and do not hold data beyond this period.
7. Security
We use encrypted connections (HTTPS), store passwords as hashes and website credentials and API keys in encrypted form, limit access to data to those who need it and log sensitive operations. No system is risk-free: in the event of a personal data breach we notify the data subjects and the supervisory authority where and when the law requires.
8. Cookies and similar tools
The dashboard uses one technical session cookie, needed to sign in, and the browser’s storage to remember interface preferences (for example a notice already read). We use no profiling cookies and no third-party analytics. The marketing website sets no cookies; it loads its typeface from Google Fonts, so Google may receive the visitor’s IP address.
9. Your rights
You may at any time request access, rectification, erasure, restriction and portability of your data, object to processing (Arts. 15-22 GDPR), and withdraw consent where it is the legal basis, by writing to info@activeseo.it. We reply within one month. If you believe the processing breaches the law, you may lodge a complaint with your supervisory authority; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
10. Minors
Active SEO is a service for professionals and businesses and is not aimed at people under 18.
11. Changes
We may update this notice: the version in force is always the one published at this address, with the update date at the top. For material changes we notify registered users.