AI SEO Falcon
Website: aiseofalcon.com
Last updated: September 21, 2026
1. Who Is Responsible for Your Personal Data
AI SEO Falcon (“we,” “us,” and “our”) provides AI search optimization, generative engine optimization, content, technical SEO, visibility monitoring, and digital PR services through aiseofalcon.com.
We are the controller for personal data used for this website, inquiries, client administration, and our own legal obligations. Contact [email protected] or our contact form.
This policy covers visitors, prospective clients, client representatives, and other individuals involved in the activities below. It explains our processing under the EU General Data Protection Regulation (GDPR) and other applicable data protection law. Professional contact information can be personal data.
2. Information We Receive and Where It Comes From
Depending on the interaction, we process:
- Contact and inquiry data: name, business email, telephone number, company, role, messages, attachments, and project requirements.
- Client records: proposals, contracts, billing addresses, tax identifiers, invoices, payment status, approvals, and support correspondence.
- Technical information: IP address, browser and operating system, requested pages, referrer, timestamps, and error or security information.
- Service information: the materials and account data described in section 7.
Sources include you, your colleagues, authorized client systems, and relevant professional or public sources. Where we collect data indirectly as a controller, Article 14 GDPR information is supplied within the applicable deadlines unless a lawful exception applies. Public availability alone does not remove privacy protections.
3. Inquiries and Client Administration
We use information to answer questions, arrange meetings, prepare proposals, deliver services, maintain records, and provide support.
Article 6(1)(b) GDPR applies where you personally contract with us or request pre-contractual steps. For company representatives and general inquiries, Article 6(1)(f) generally applies: our legitimate interest in business communication and service delivery. Invoicing and legally required records rely on Article 6(1)(c), including applicable tax and commercial record-keeping duties. Necessary handling of legal claims may rely on Article 6(1)(f).
Providing information is generally voluntary, but without necessary contact, contractual, or billing details we may be unable to respond or provide the service. Optional marketing consent is not a condition of our core services.
4. Website Operation and Security
Hosting and security systems process technical request information to deliver pages, maintain availability, investigate errors, and prevent abuse. Article 6(1)(f) GDPR supports our legitimate interest in secure, reliable operation. Log access is limited to those who need it.
Logs are retained for the period needed for operation and proportionate security monitoring. Specific records may be kept longer for an incident, repeated abuse, or evidence preservation, with access restricted and retention reviewed when the matter ends.
5. Cookies and Similar Technologies
Cookies, local storage, pixels, and similar technologies may store or access information on your device. We obtain consent where required by applicable cookie and electronic communications rules. Any exemption for communication transmission or a strictly necessary feature is used only where its legal conditions are met. Related personal data processing also requires a GDPR basis.
Where optional analytics, advertising, or external features are offered, we obtain consent before activation where required. The consent interface must explain purposes, providers, and storage periods. You may decline optional features and use the available consent control or contact us to withdraw consent. Withdrawal does not affect prior lawful processing.
Cookie-free measurement is not automatically anonymous or consent-exempt. Its lawful basis depends on the actual configuration. Statistics fall outside the GDPR only if individuals cannot reasonably be identified. Browsing or accepting service terms is not consent to optional tracking.
6. Contact Features and Third-Party Content
Forms, chat, communication, or meeting tools process submitted information and necessary technical data for the purposes in section 3. Please avoid sending passwords, payment card numbers, or sensitive data through a general inquiry form.
Embedded maps, videos, or social posts may disclose technical information to their providers when loaded. Where consent is required, they must remain blocked until consent is given. External links lead to services with their own privacy information; this does not remove our responsibility for disclosures we initiate.
7. Data Used in Our Services
AI visibility research may involve business-related queries, public author or company information, source pages, and recorded examples of generated answers. We use that information to assess how a brand appears and to prepare the agreed recommendations. Public professional information used for our own research is processed on legitimate-interest grounds only where the assessment supports that use.
Prompts and responses can contain personal data even when the inquiry concerns a business. We minimize identifying details and do not submit confidential client information or customer records to external AI services without appropriate authorization and a lawful processing arrangement. The selected provider’s retention, training, transfer, and controller or processor terms are relevant to the configuration. Client permission alone does not replace those requirements.
For processing solely on client instructions, we act as a processor or subprocessor under the appropriate agreement. Article 28 GDPR governs that relationship but is not itself a lawful basis for the underlying processing; the controller must establish that basis.
Where we determine a separate purpose, we assess our own controller obligations. Actual responsibilities override contractual labels. Client-controlled data is not used for unrelated marketing or model training without a separate lawful basis and required permissions.
8. Marketing Communications
Marketing subscriptions rely on consent under Article 6(1)(a) GDPR. We may retain evidence of consent and the information provided.
Where applicable law permits an existing-customer exception, we may send emails about our own similar services using an address obtained in connection with a sale, provided the required conditions are met, you have not objected, and clear opt-out information is supplied at collection and in each message. Where the GDPR applies, we rely on Article 6(1)(f) only where the relevant legitimate-interest conditions are satisfied. Being a business contact alone does not authorize unsolicited marketing.
Unsubscribe or contact [email protected] to stop marketing. Necessary project and billing messages may continue. Limited suppression records may be retained to respect your objection.
9. Who May Receive Personal Data
Necessary recipients include hosting and security providers, communication and business administration tools, payment and accounting providers, and specialists supporting the agreed services. Service recipients may include authorized search-monitoring tools, SEO platforms, publishing providers, AI services, and research or content specialists.
Providers acting on our instructions have data processing agreements where required. Authorized personnel receive task-appropriate access and confidentiality obligations. Banks, advisers, authorities, and some platforms act as independent controllers for their own processing.
Necessary information may also be disclosed for binding legal obligations, professional advice, or legal claims. We do not provide website inquiry details to unrelated businesses for their own marketing. Client-directed disclosures are explained in their service context.
10. International Transfers
Remote delivery and external providers may involve access from outside the European Economic Area, including where servers remain in Europe.
Transfers subject to the GDPR require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses, with necessary assessments and supplementary measures. A decision must cover the relevant recipient and processing. Exceptional transfer grounds apply only where their specific conditions are met.
Contact [email protected] for information on relevant transfers and a copy or explanation of safeguards, subject to necessary redactions. Client-specific location restrictions and authorized subprocessors are addressed in the processing agreement.
11. How Long We Keep Information
We keep identifiable information only while necessary, subject to legal duties and justified claims:
- Inquiries: during active discussions and ordinarily no longer than 12 months after the last substantive exchange if no engagement follows, unless a specific legal or dispute-related need applies.
- Project data: for delivery, agreed support, and handover, followed by any necessary legal retention. Client-controlled data is returned or deleted under the processing agreement unless law requires retention.
- Accounting records: for the retention period required by applicable tax, accounting, and commercial laws. The period is determined by the document type, the legal obligation applying to it, the event that starts the retention period, and any required extension for an audit or dispute. These duties do not justify keeping unrelated project or marketing data indefinitely.
- Marketing: until withdrawal or objection, with limited consent evidence and suppression records retained as necessary for compliance.
- Logs: for the operational and security purposes described in section 4.
Afterward, information is deleted or irreversibly anonymized. Protected backup copies expire through the applicable backup cycle. Information kept solely for a legal duty or claim is restricted to that purpose.
12. Your Privacy Rights
Subject to the GDPR’s conditions, you may request access, a copy, correction, erasure, restriction, and portability of data you provided where automated processing is based on consent or contract.
You may object to legitimate-interest processing for reasons relating to your situation. You may object to direct marketing at any time without giving reasons, including related profiling. We then stop that marketing processing.
You may withdraw consent without affecting prior lawful processing. Rights may be limited, for example by a legal retention duty; we explain any relevant limitation.
Contact [email protected] or our contact form. We respond without undue delay and normally within one month. If a legally permitted extension is necessary, we explain it within the first month. Additional identity information is requested only where reasonably necessary. Requests are ordinarily free.
For client-controlled data, we assist and route requests to the responsible controller without avoiding our own duties. Additional rights under other applicable privacy laws remain available where their conditions are met.
13. Complaints
You may complain to a competent data protection supervisory authority, particularly in the EU member state of your habitual residence, place of work, or an alleged infringement. Contacting us first is optional.
14. Security and Sensitive Information
We apply safeguards appropriate to processing risks, including access and confidentiality controls and measures for protecting transmission and maintaining systems. No internet service guarantees absolute security; our legal security and breach-notification duties remain unaffected.
This agency website targets businesses and adult professionals, not children. Do not send children’s data or sensitive information unless needed for an agreed service with appropriate arrangements. Special-category data and criminal-offence information require the additional conditions in Articles 9 or 10 GDPR. Public posting does not create general permission to reuse sensitive information.
15. Automated Decisions and Policy Updates
We do not make solely automated decisions with legal or similarly significant effects using website inquiry or client administration data. Separate processing in client-operated systems is governed by the responsible controller’s notices and the service arrangements.
We update this policy when processing or legal obligations change. The revision date appears above. Required additional notices or fresh consent are provided before the relevant change; updating this page alone does not authorize an incompatible new use.
16. Contact
For questions or privacy requests, contact AI SEO Falcon, at [email protected] or through our contact form.