ORYON SYSTEMS ("ORYON SYSTEMS", "SEOryon", "we", "us", "our") operates the SEOryon platform and related services.

This Privacy Policy explains how personal data is processed when you visit, create an account for or use SEOryon.

It also explains how SEOryon handles Customer Content, project knowledge, uploaded documents and images, connected services and AI processing.

1. Who We Are

ORYON SYSTEMS
Société par actions simplifiée à associé unique (SASU)
61 rue de Lyon
75012 Paris
France

SIREN / RCS Paris: 107 207 201
VAT number: FR73 107 207 201

Privacy contact:

support@seoryon.com

We have not appointed a Data Protection Officer.

Where applicable, you may lodge a complaint with the French data-protection authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France

If you live elsewhere in the EEA, you may also have the right to contact your local supervisory authority.

2. When SEOryon Is Controller and When It Is Processor

SEOryon does not have the same legal role for every category of personal data.

2.1 ORYON SYSTEMS as controller

ORYON SYSTEMS generally acts as data controller when it determines why and how data is processed for purposes such as:

  • creating and administering SEOryon accounts;
  • subscriptions and billing;
  • security;
  • fraud and abuse prevention;
  • product operation;
  • support;
  • Service communications;
  • analytics;
  • legal compliance;
  • managing our commercial relationship with you.

2.2 ORYON SYSTEMS as processor

Customers can enter or upload information about employees, clients, website visitors, suppliers or other third parties into SEOryon.

Where a Customer determines the purposes and means of that processing and instructs SEOryon to process that personal data only to provide the Service, the Customer is generally the controller and ORYON SYSTEMS acts as its processor.

In that situation:

  • the Customer is responsible for establishing an appropriate lawful basis and providing required privacy notices;
  • SEOryon processes that data on the Customer's instructions, subject to applicable law;
  • requests from individuals concerning Customer-controlled data may need to be referred to the relevant Customer;
  • where required by Article 28 GDPR or similar law, the processing must be governed by an appropriate data-processing agreement.

This Privacy Policy does not replace a controller-processor agreement where one is legally required.

3. Data We Process

3.1 Account and workspace information

We may process:

  • name;
  • email address;
  • authentication information;
  • profile information;
  • organization or workspace information;
  • workspace role and permissions;
  • account settings;
  • subscription and plan information.

Authentication may be provided through Supabase and supported OAuth providers.

3.2 Project and brand information

Information you provide to configure a project can include:

  • company or website information;
  • products and services;
  • target audience;
  • brand voice;
  • writing preferences;
  • article objectives;
  • keywords;
  • website URLs;
  • competitors;
  • content preferences;
  • instructions and prompts.

3.3 Article content and Output

We process information used to create and manage content, including:

  • prompts;
  • article context;
  • titles;
  • article drafts;
  • generated content;
  • editing history where supported;
  • article metadata;
  • publication schedules;
  • CMS publication status;
  • AI-generated or transformed assets.

3.4 Project knowledge

SEOryon may extract useful facts and context from information you provide and retain them in a private project-specific knowledge base.

Knowledge may include:

  • user-entered facts;
  • extracted document text;
  • text derived from project context;
  • embeddings or other vector representations;
  • metadata needed to identify and manage knowledge records.

Project knowledge is intended to be isolated to the relevant project and is not intentionally made available as project knowledge to unrelated customers.

Where functionality permits and subject to workspace permissions, users can review and delete project knowledge.

We do not use project knowledge to train a general-purpose SEOryon model shared across customers.

3.5 Uploaded documents

Users may upload supported documents such as PDF files to provide project or article context.

For this document-ingestion workflow:

  1. SEOryon reads the original document for extraction;
  2. text is extracted;
  3. extracted text may be divided into chunks;
  4. those chunks may be embedded and placed in a project-specific vector index;
  5. metadata such as filename, document type, page count and file size may be retained.

The original document bytes are not intentionally written to persistent SEOryon storage as part of this ingestion workflow.

The extracted text, embeddings and document metadata are retained until the relevant document or project is deleted, subject to the retention rules below.

3.6 Uploaded images

Users may upload featured, hero or other supported article images.

Uploaded image bytes may be stored in Cloudflare R2.

SEOryon does not currently modify uploaded image files. Embedded metadata (such as EXIF data, which can include location, date and device information) is stored as received and may be included when the image is served or published. If you do not want such metadata stored or published, remove it before uploading.

Images may be retained until, for example:

  • the image is replaced;
  • the relevant article or project is deleted;
  • an automated deletion process removes an orphaned or superseded asset.

3.7 Publicly served article images

Unlike article text, which SEOryon does not host as a public article page, certain article images may be intentionally served from SEOryon's infrastructure using publicly accessible image URLs.

This is necessary to support features such as article images, previews, emails and CMS publication.

Accordingly, an image configured for this use should be treated as potentially public.

Do not upload a confidential or private image as a public article image.

3.8 Voice dictation

SEOryon may provide speech-to-text dictation for entering article or project context.

When you dictate:

  • the audio needed for transcription is transmitted to an OpenAI speech-to-text service;
  • SEOryon does not intentionally store the original raw recording after the transcription workflow;
  • the resulting transcript may be retained as article context, project context or project knowledge according to how you use it.

The AI provider may separately retain or process API data according to its applicable contractual terms and data-retention settings.

3.9 Third-party integrations

If you connect an external account, we may process information made available through that integration.

Current integration categories include:

CMS connections

  • access credentials or OAuth tokens;
  • site or collection information;
  • taxonomy and publishing information;
  • content necessary to publish or manage articles.

Google Search Console

  • verified properties;
  • indexing information;
  • sitemap information;
  • queries;
  • clicks;
  • impressions;
  • average position;
  • click-through rate;
  • other permitted Search Console metrics.

Google Analytics

  • sessions and user metrics;
  • engagement;
  • traffic-source information;
  • channels;
  • page-performance information;
  • device or geographic reporting dimensions available through the connected property.

We access only information authorized by the applicable scopes and integration configuration.

3.10 Authentication and integration credentials

We may process:

  • OAuth access and refresh tokens;
  • API credentials;
  • encrypted CMS credentials;
  • authorization metadata.

Sensitive integration credentials are protected using technical security measures and are not intended to be exposed to other workspace users except where necessary for authorized functionality.

3.11 Payment information

Payments are processed through Stripe.

SEOryon does not store complete payment-card numbers.

We may receive billing information and transaction metadata needed to:

  • manage subscriptions;
  • reconcile payments;
  • issue invoices;
  • detect payment issues;
  • comply with accounting and tax obligations.

3.12 Usage, device and technical information

We may collect:

  • IP address;
  • user agent;
  • browser;
  • operating system;
  • language;
  • pages and features used;
  • timestamps;
  • request identifiers;
  • error and diagnostic information;
  • performance information;
  • security events.

3.13 Support and communications

We process messages and information you send to:

  • support@seoryon.com;
  • in-product support;
  • other customer-support channels.

4. Why We Process Personal Data and Our Legal Bases

Where ORYON SYSTEMS acts as controller, our main purposes and legal bases include:

Providing SEOryon

Purpose: account administration, project operation, AI features, article generation, integrations, publishing, workspace functionality.

Legal basis: performance of a contract or steps requested before entering into a contract.

Billing and subscription administration

Purpose: payments, invoices, subscription management.

Legal basis: performance of a contract and compliance with legal obligations.

Security and abuse prevention

Purpose: authentication, fraud detection, security logging, investigation of abuse, protection of users and infrastructure.

Legal basis: our legitimate interests in securing and protecting the Service and, where applicable, legal obligations.

Support

Purpose: handling requests, troubleshooting, account assistance.

Legal basis: performance of the contract and our legitimate interest in providing customer service.

Service analytics and improvement

Purpose: understanding how SEOryon performs and how features are used.

Legal basis: legitimate interests where processing does not require consent, and consent where required for cookies or similar technologies.

Legal compliance

Purpose: accounting, tax, regulatory requests, legal claims and valid authority requests.

Legal basis: compliance with legal obligations and, where appropriate, legitimate interests in establishing, exercising or defending legal claims.

Marketing

If SEOryon sends optional marketing communications, the legal basis will depend on applicable law and may be consent or our legitimate interests.

You may opt out of optional marketing communications.

Customer Content processed as processor

Where ORYON SYSTEMS acts solely as processor of Customer-controlled personal data, the relevant Customer determines the applicable lawful basis. SEOryon processes that information to provide the Service according to the Customer's instructions.

5. AI Processing

SEOryon uses third-party AI services to generate, transform, analyze or verify content.

Information sent to an AI provider can include, depending on the feature:

  • prompts;
  • article instructions;
  • relevant project knowledge;
  • selected document extracts;
  • article text;
  • product or brand information;
  • uploaded images used for image transformation;
  • image-generation prompts;
  • dictated audio sent for transcription.

We seek to send information relevant to the requested feature rather than indiscriminately sending all project information.

5.1 No general SEOryon model training on Customer Content

ORYON SYSTEMS does not use Customer Content to train a general-purpose AI model shared across SEOryon customers.

Persistent project knowledge is used for that project's future functionality; it is not equivalent to training a global model.

5.2 Third-party model training and retention

Commercial AI providers have their own API data-handling policies.

We use these providers through their business API offerings, under terms which, at the date of this Policy, state that API inputs and outputs are not used to train the provider's models by default and are retained only for limited periods (for example for abuse monitoring). The applicable retention periods are set out in each provider's own API data policy, which may change.

We therefore avoid representing that information sent to an AI API is necessarily deleted instantaneously by the provider.

6. Google API Data

SEOryon's use of information obtained through Google APIs is subject to Google's API Services User Data Policy, including the Limited Use requirements.

SEOryon requests read-only access through the Google scopes https://www.googleapis.com/auth/webmasters.readonly (Search Console) and https://www.googleapis.com/auth/analytics.readonly (Google Analytics).

6.1 Google information we use

Depending on which integration you enable, SEOryon may access:

  • basic Google identity information used for authentication;
  • Google Search Console properties and performance information;
  • indexing and sitemap information;
  • Google Analytics reporting information for properties you authorize.

6.2 Purposes

Google data is used to provide user-facing SEOryon features such as:

  • showing website search performance;
  • displaying indexing status;
  • identifying queries and pages driving search performance;
  • showing website and article traffic;
  • helping generate user-facing SEO and content recommendations.

6.3 Limited Use commitments

We do not:

  • sell Google user data;
  • use Google user data for advertising;
  • use Google user data for retargeting;
  • use Google user data to train, fine-tune or improve general-purpose AI models;
  • expose non-public Google data to unrelated customers.

Human access to Google data is restricted to circumstances permitted by applicable Google policies, including where necessary for support with user authorization, security, legal obligations or internal operations using appropriately aggregated information.

6.4 Revoking Google access

You can disconnect a Google integration through SEOryon where the applicable controls are available.

You may also revoke permissions through your Google Account.

Revocation prevents new API access but may not automatically delete data already stored by SEOryon unless the relevant feature does so.

You may request deletion in accordance with Section 12.

7. Subprocessors and Service Providers

We rely on third parties to operate SEOryon.

Depending on the features you use, these may include:

Infrastructure

Cloudflare
Application hosting, network services, Cloudflare Workers, databases, object storage, vector storage and related infrastructure.

Supabase
Authentication services.

AI services

Anthropic
AI-assisted article and text generation and related language-model processing.

OpenAI
AI image generation or transformation and speech-to-text processing, and other enabled OpenAI API functionality.

Perplexity
Research, factual verification or source-related functionality where enabled.

SEO and web-data services

DataForSEO
Search, keyword, SERP and competitor data.

Firecrawl
Web retrieval and extraction functionality where enabled.

Pexels
Stock-image search where enabled.

Payments

Stripe
Payments, subscription and transaction processing.

Analytics and reliability

PostHog
Product analytics where enabled with the required consent. With your consent, this can include session recordings of how you use the app. The text on the page and everything you type are masked in your browser before anything is sent.

Sentry / Functional Software, Inc.
Application reliability and error monitoring where enabled.

Connected services

Depending on your chosen CMS or integrations, we may communicate with services such as:

  • Webflow;
  • WordPress / Automattic;
  • Ghost;
  • Wix;
  • Google.

Third-party services may process information as independent controllers for their own purposes under their own privacy policies as well as, where applicable, as processors or subprocessors for SEOryon.

The exact processors involved depend on the features you use.

8. International Data Transfers

ORYON SYSTEMS is established in France, but some providers operate internationally.

Accordingly, personal data may be processed in countries outside the European Economic Area.

Where GDPR Chapter V requires transfer safeguards, we rely as applicable on mechanisms such as:

  • an adequacy decision;
  • the EU-U.S. Data Privacy Framework where the relevant recipient validly participates and the transfer qualifies;
  • European Commission Standard Contractual Clauses;
  • supplementary technical or contractual measures;
  • another lawful transfer mechanism.

Where ORYON SYSTEMS acts as processor, applicable international-transfer arrangements may also be addressed in the relevant data-processing agreement.

9. Retention

We retain information only for as long as reasonably necessary for the purposes described here, subject to legal and operational requirements.

Account information

Generally retained while the account remains active.

When you request account deletion, deletion is scheduled after a thirty (30) day grace period during which you can cancel the request. After that period, the account and its Customer Content are deleted from active systems, except information that must be retained for legal, financial, fraud, security or dispute-resolution purposes.

Projects

Project content is retained while the project exists.

Deleting a project triggers deletion of project data according to SEOryon's deletion workflows, subject to limited residual system copies or information that must be retained by law.

Uploaded documents

Original document bytes are not intentionally retained through the document-ingestion workflow.

Extracted text, embeddings and document metadata are retained until the relevant document or project is deleted.

Project knowledge

Retained while the relevant knowledge record or project exists.

Deletion from the project knowledge functionality removes the relevant active project knowledge according to the Service's deletion process.

Uploaded images

Article images are retained while required for the associated article or project and may be removed when they are replaced, when the project is deleted, or by automated cleanup processes.

Published CMS content

Content that has already been published to your own CMS is outside SEOryon's storage control.

Deleting it from SEOryon does not necessarily delete copies already stored or published by your CMS.

Integration data

Integration data is retained for as long as reasonably required for the connected feature.

Disconnecting an integration stops future access but does not necessarily cause every previously obtained record to be deleted immediately unless the relevant functionality is designed to do so.

OAuth and CMS credentials

Retained while necessary to operate the integration and removed or invalidated when the integration is disconnected, subject to limited technical, security or legal records.

Billing and accounting records

Accounting, invoice and transaction records may be retained for periods required by French accounting, tax and commercial law.

Logs and security data

Operational, security and diagnostic logs are retained for limited periods based on operational and security needs.

Abuse and moderation records

Where SEOryon receives an abuse report, restricts content or investigates suspected misuse, we may retain the relevant report, decision, evidence and audit records for as long as reasonably necessary to:

  • investigate the matter;
  • prevent repeated abuse;
  • respond to disputes;
  • establish, exercise or defend legal claims;
  • comply with legal obligations.

Backups

Data removed from active systems may persist temporarily in limited backup or disaster-recovery copies until those copies expire or are overwritten according to normal backup rotation.

10. Security

We use technical and organizational measures designed to protect personal data appropriate to the nature of the Service and relevant risks.

Measures may include:

  • TLS encryption in transit;
  • encryption or equivalent protection for sensitive credentials;
  • access controls;
  • workspace authorization;
  • tenant separation;
  • secure authentication;
  • logging and monitoring;
  • credential protection;
  • security testing;
  • vulnerability remediation;
  • data-minimization practices.

No online system is completely secure.

Accordingly, we cannot guarantee that unauthorized access or loss can never occur.

If a personal-data breach occurs, we will handle notification obligations in accordance with applicable data-protection law.

11. Cookies and Similar Technologies

SEOryon uses cookies and similar technologies.

Strictly necessary technologies

These can include technologies required for:

  • authentication;
  • security;
  • session management;
  • load balancing;
  • remembering privacy choices;
  • functionality specifically requested by you.

Where exempt under applicable law, these do not require consent.

Analytics

SEOryon may use analytics tools such as PostHog to understand product use. With your consent, this can include session recordings of how you use the app. The text on the page and everything you type are masked in your browser before anything is sent.

Where applicable law requires consent, analytics technologies are not activated until consent has been obtained.

Withdrawing consent stops future consent-based tracking.

Error and reliability monitoring

SEOryon may use tools such as Sentry for technical reliability, debugging and security.

We treat these as strictly necessary for the security and reliability of the Service; they are not used for analytics, profiling or advertising, and are therefore not gated by the consent banner. Where applicable law nonetheless requires consent for them, we obtain it.

Cookie controls

Where available, you may manage optional cookie preferences through SEOryon's cookie controls or Data & Privacy settings.

Rejecting optional analytics must not prevent use of functionality that does not depend on those analytics.

We do not use Customer Content for third-party behavioral advertising.

12. Your Data-Protection Rights

Where the GDPR applies and ORYON SYSTEMS acts as controller, you may have rights to:

  • obtain information about processing;
  • access your personal data;
  • correct inaccurate data;
  • request deletion;
  • restrict processing;
  • object to processing based on legitimate interests;
  • receive qualifying data in a structured, commonly used and machine-readable format;
  • withdraw consent where processing depends on consent;
  • lodge a complaint with a supervisory authority.

Rights are subject to statutory conditions and exceptions.

12.1 Exercising rights

Contact:

support@seoryon.com

We may need to verify your identity before fulfilling a request.

We will respond within the period required by applicable law.

12.2 Data controlled by a SEOryon Customer

If your personal data appears inside content controlled by one of our Customers, that Customer may be the relevant controller.

In that situation, you should ordinarily direct your request to the Customer.

If we receive such a request, we may refer it to the Customer and provide reasonable assistance where required by law or our processor obligations.

12.3 Workspace permissions

Some in-product deletion and management actions depend on workspace roles.

For example, account owners or workspace administrators may control certain projects or integrations.

Role-based product permissions do not remove any statutory data-protection right, but we may need to verify the appropriate controller, account owner or authority before acting on Customer-controlled information.

13. Customer Responsibility for Third-Party Personal Data

If you use SEOryon to process information relating to another person, you are responsible for determining whether you are legally permitted to do so.

You should not upload personal information that is unnecessary for your use of the Service.

In particular, avoid uploading unnecessary:

  • government identification;
  • passwords;
  • private keys;
  • authentication credentials;
  • payment-card information;
  • medical records;
  • biometric information;
  • highly sensitive personal information.

SEOryon does not undertake to recognize every category of sensitive information automatically.

14. Content Moderation and Legal Requests

SEOryon does not generally pre-screen all Customer Content.

Where we become aware of potentially unlawful or prohibited content, we may process relevant account, content and technical information to:

  • assess the report;
  • enforce our Terms;
  • restrict access;
  • preserve evidence;
  • protect users or third parties;
  • respond to lawful authority requests.

The legal basis may include compliance with legal obligations and our legitimate interests in preventing abuse, protecting rights and securing the Service.

Reports may be submitted to:

support@seoryon.com

15. AI Provenance and Generated Content

AI-generated images or other Output may contain technical provenance, watermarking or machine-readable indicators supplied by the AI provider or SEOryon.

Where appropriate, SEOryon may preserve or implement such mechanisms to support legal transparency obligations.

Customer-uploaded images are stored as received. AI-generated images may carry provenance markers supplied by the AI provider, which SEOryon does not intentionally remove.

16. Children and Teenagers

SEOryon is not intended for children under sixteen (16).

We do not knowingly permit users under sixteen to create SEOryon accounts.

Users aged sixteen or seventeen may use the Service subject to applicable laws concerning minors and any parental or legal-representative authorization required in their jurisdiction.

If you believe a person under sixteen has provided personal information to SEOryon, contact support@seoryon.com.

17. Automated Decision-Making

SEOryon uses automation and artificial intelligence to generate content, recommendations and analyses.

These ordinary product-generation processes are not intended to make decisions producing legal effects or similarly significant effects about individuals within the meaning of Article 22 GDPR.

If this changes, we will provide additional information where required by law.

18. Sale and Advertising

ORYON SYSTEMS does not sell personal data as a data broker.

We do not use Customer Content for third-party targeted advertising.

If applicable privacy laws outside the EEA provide additional rights concerning sale, sharing or targeted advertising, we will honor those rights to the extent those laws apply to ORYON SYSTEMS.

19. Changes to This Policy

We may update this Privacy Policy as SEOryon changes or legal requirements evolve.

The current version will be published on our website with its revision date.

Where a change materially alters how we use personal data, we will provide additional notice or obtain consent where required by law.

20. Contact

Privacy questions and requests:

support@seoryon.com

ORYON SYSTEMS
61 rue de Lyon
75012 Paris
France

Legal Notice · Terms of Service