Privacy Policy

What Scaup is

Scaup is an automated search and AI visibility service that connects to your website and Google Search Console account. We analyze your site's content and search performance, make improvements on your behalf, and set up your site to be discoverable by AI tools like ChatGPT and Perplexity. If you're curious about how automated SEO works and whether it's right for your site, check out our guide on what automated SEO is and whether it actually works.

Beyond traditional SEO, we also help your site appear in AI search tools and chatbot answers by setting up an llms.txt file, which tells AI systems how to surface your content accurately. Learn more about AI search visibility and how to get your website into ChatGPT and other AI answers.

What data we collect

When you sign up and connect your site, we collect and store:

• Google account info — your name, email address, and profile picture, used to identify your account
• Google Search Console data — search queries, clicks, impressions, and average position for your verified properties. We use this to understand how your site performs in search and decide what to improve
• Website content — page titles, meta descriptions, headings, and other on-page content from your connected site. We read this to identify improvements and apply changes
• Website connection credentials — such as a WordPress application password or a Webflow OAuth token, used to read and update your site's content
• Usage data — basic analytics about how you use the Scaup app (pages visited, buttons clicked) to help us improve the product

How we use your data

• To analyze your site's search performance and identify improvements
• To generate and execute a growth plan for your site
• To apply content changes to your website (with your approval or via auto-apply if you opt in)
• To submit your URLs to Google's Indexing API so changes get picked up faster
• To send you weekly progress reports by email
• To improve the Scaup product based on aggregated, anonymized usage patterns

How we connect to your website

Scaup supports WordPress, Webflow, Wix, and GitHub-hosted sites. What we access depends on the platform, but the principles are the same everywhere:

• We connect through each platform's official, secure method — OAuth for Webflow, an app installation for Wix, application passwords for WordPress, a GitHub App installation for GitHub. Where a platform issues us a credential to keep, such as a Webflow OAuth token or a WordPress application password, it is stored encrypted. Wix and GitHub issue a short-lived token for each request instead, so there is nothing long-lived for us to hold. You can revoke access at any time.
• To build your growth plan, our background service reads the public, already-published pages of your site over the normal web — the same content any visitor can see. This needs no special access.
• Every change we make (page titles, meta descriptions, and new content) goes through the platform's official API using the access you granted.
• We never add tracking code or analytics to your published site, and we do not collect any information about your site's visitors. On Webflow we do add one thing, and we would rather spell it out than have you find it: a small script that places structured data (JSON-LD) in your site's head, so search engines and AI tools can read what your business is. It makes no network requests of its own and carries nothing but that structured data.

For Webflow specifically:

• We request read and write access to your sites, pages, CMS collections, custom code and assets, plus read access to components. Nothing beyond that.
• We use those permissions to read your pages and blog content, update SEO titles and meta descriptions, publish new blog posts as CMS items, write descriptions for images that have none, and place the structured-data script described above.
• The custom code permission is used only for that structured-data script. We read what is already on your site before writing, so our own entry replaces itself and anything you or another app added is left alone. When you remove your site from Scaup, we take our entries back off.
• All Webflow operations run through the official Webflow API (api.webflow.com) with your OAuth authorization. Your Webflow token is stored encrypted; we never see or store your Webflow password.
• Publishing is site-wide on Webflow, so before we publish we check whether you have unpublished work in the Designer. If you do, we leave our changes staged for you rather than publishing your drafts by accident.
• No firewall changes or IP allowlisting are needed, because we only fetch your published pages over the public web.

How we store and protect your data

Your data is stored in our backend database hosted by Convex. Sensitive credentials, including Google OAuth refresh tokens and website connection passwords, are encrypted using AES-256-GCM before storage. They are never stored in plaintext.

We use HTTPS for all data transmission. Access to production systems is restricted to authorized team members only.

Third-party services

We share data with the following services to operate Scaup:

• Google (OAuth, Search Console API, Indexing API) — to authenticate you and access your search data
• Anthropic (Claude AI) — to analyze your site content and generate improvements. We send page content and search data to Claude for analysis. Anthropic does not use this data to train their models
• Convex — backend database and server functions
• Resend — to send you weekly report emails
• Mixpanel — anonymous product analytics (browser-side only, no personal data sent)
• BetterStack — application logging and monitoring (no personal user data is logged)

We do not sell your data to anyone. We do not share your data with any parties other than those listed above.

Google API Services

Scaup's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request access to the Google API scopes necessary to provide the service (Search Console read/write and Indexing API)
• We do not use Google user data for advertising or sell it to third parties
• We do not allow humans to read your Google data unless you give explicit permission, it is necessary for security purposes, or it is required by law
• We limit our use of Google data to the practices described in this privacy policy

Your rights

You can:

• Disconnect your site at any time from the Scaup dashboard. This stops all scanning and changes
• Revoke Google access from your Google account permissions page at any time
• Unsubscribe from emails using the link in any Scaup email
• Request data deletion by emailing us at [email protected]. We will delete all your data within 30 days
• Request a copy of your data by emailing us at [email protected]

Data retention

We keep your data for as long as your account is active. If you delete your account or request data deletion, we remove all your personal data and site data within 30 days. Anonymized, aggregated data (like overall usage statistics) may be retained indefinitely.

Children

Scaup is not intended for use by anyone under 18. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email. The "last updated" date at the top of this page reflects the most recent revision.

Contact

Questions about this policy? Email us at [email protected].