Privacy Policy — Lexio
Last updated: June 3, 2026
1. Data Controller
Daniel Friant
Trade name: Agence SEO Connect
Status: Sole trader (Auto-entrepreneur)
Country: France
Email: daniel.friant@agence-seo-connect.tech
Application: https://app.agence-seo-connect.tech
2. Data Collected and Purposes
2.1 Account Data
- Data: email address, name, Google identifier (if signing in with Google)
- Purpose: creation and management of your user account
- Legal basis: performance of contract (Terms of Service)
2.2 Third-Party Service Connection Data
Google Search Console & Google Analytics
When you connect your Google account to Lexio:
- Data accessed: website performance data (queries, positions, impressions, clicks) from Google Search Console; audience metrics from Google Analytics 4
- OAuth scopes used:
https://www.googleapis.com/auth/webmasters.readonly(GSC read-only)https://www.googleapis.com/auth/analytics.readonly(GA4 read-only)
- Purpose: SEO analysis, content opportunity detection, report generation
- Storage: access tokens encrypted (AES-256-GCM) in our secure database
- Sharing: no Google data is shared with third parties
- Legal basis: explicit consent (OAuth flow)
Facebook / Meta
When you connect your Facebook page to Lexio:
- Data accessed: page name, page identifier, publication token
- Purpose: automated content publishing to your Facebook page
- Storage: page token encrypted (AES-256-GCM)
- Sharing: no Facebook data is shared with third parties
- Legal basis: explicit consent (Meta OAuth flow)
WordPress
- Data: site URL, encrypted WordPress application credentials
- Purpose: automated article publishing to your WordPress site
- Legal basis: performance of contract
2.3 Billing Data
- Processed by Stripe (data processor) — Lexio does not store any credit card data
- Stripe Privacy Policy: https://stripe.com/privacy
2.4 Usage Data
- Technical logs, action history (audit log), usage statistics
- Purpose: security, debugging, service improvement
- Retention: 12 months
3. Hosting and Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Hostinger | VPS Hosting | EU |
| Supabase | PostgreSQL database, file storage | EU |
| Anthropic | AI content generation (Claude) | USA |
| OpenAI | Image generation (GPT-image-2) | USA |
| Stripe | Billing | USA |
| Resend | Transactional email delivery | USA |
Transfers to sub-processors outside the EU are governed by the European Commission's Standard Contractual Clauses (SCCs).
4. Retention Periods
| Data | Retention |
|---|---|
| User account | Duration of subscription + 3 years |
| Google/Facebook OAuth tokens | Until disconnection or revocation |
| Audit logs | 12 months |
| Billing data | 10 years (legal obligation) |
5. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct your data
- Right to erasure: delete your account and data
- Right to data portability: receive your data in a structured format
- Right to object: object to certain processing activities
- Right to withdraw consent: revoke Google or Facebook OAuth access at any time
To exercise your rights: daniel.friant@agence-seo-connect.tech
If your request is not resolved, you may contact the CNIL (French data protection authority): https://www.cnil.fr
6. Revoking OAuth Access
Google Search Console / GA4
You can revoke Lexio's access at any time:
- From Lexio: Settings → Connections → Disconnect
- From Google: https://myaccount.google.com/permissions
- From Lexio: Settings → Connections → Disconnect
- From Facebook: Settings → Apps and Websites
7. Security
- All tokens and secrets are encrypted AES-256-GCM at rest
- HTTPS connections exclusively
- Data access strictly isolated per organization (multi-tenant)
- No secrets are exposed in logs
8. Cookies
Lexio uses only a secure session cookie (__Secure-next-auth.session-token) required for authentication. No advertising or tracking cookies are used.
9. Changes to This Policy
Any material changes to this policy will be notified by email to active users at least 30 days before taking effect.
10. Contact
Daniel Friant — Agence SEO Connect
daniel.friant@agence-seo-connect.tech
https://app.agence-seo-connect.tech