1. Who we are and how to contact us
Astride is a trading name of ISO Consultants U.K. Limited. In this policy, “Astride”, “we”, “us” and “our” mean that company. We are the controller of personal information used to run our business, manage accounts and subscriptions, respond to enquiries and protect our services.
Astride — ISO Consultants U.K. LimitedRegistered in England and Wales, company number 10766230.
Registered office: Lewis Building, 35 Bull Street, Birmingham, England, B4 6AF.
Email: info@iso-consultants.co.uk (please mention Astride).
You can use these details to request access, correction or deletion, withdraw consent, raise a privacy concern or ask about our suppliers and international-transfer safeguards. You do not need an Astride account to contact us.
2. What this policy covers
This policy covers www.astride-seo.com, the customer application at app.astride-seo.com, website audits, reports, support and enabled Astride services. It is intended to meet the transparency requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended, including applicable changes made by the Data (Use and Access) Act 2025. Cookies and electronic marketing are also subject to the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.
Where a business customer supplies personal information for us to process solely on its instructions—for example, information in website copy or a review used to prepare a reply—the customer is normally the controller and we are its processor. The data-processing provisions in our Terms of Service apply to that processing. If an agency acts for a client, its authority and the client’s instructions must cover the processing.
Our customers remain responsible for the privacy notices on their own websites. Connecting a third-party account does not replace that provider’s privacy policy or make Astride responsible for all of its independent activities.
3. Information we collect and where it comes from
- Account and business information: your name, email, account identifiers, authentication and verification records, company name, website, role, team membership, business profile and saved preferences. We receive this from you, your organisation’s authorised users and our authentication service.
- Audit and enquiry information: the contact details, business name, website, instructions and correspondence you provide when requesting an audit, report or help. Public website pages may contain names, business contact details and other personal information.
- Workspace content: keywords, briefs, uploaded images, website extracts, drafts, edited copy, approvals, publishing instructions, reports, scheduled activities and the history needed to show what happened. We collect these from your submissions, authorised website scans and the services you connect.
- Connected-service information: selected websites or properties, permission scopes, account and resource identifiers, access or refresh tokens, performance figures, and content that the selected integration is permitted to read or publish. The Google-specific details are below.
- Billing information: plan, billing contact, invoices, payment status, subscription dates, transaction references and limited payment-method details returned by our payment provider. Card details entered into Stripe’s payment forms are handled by Stripe; Astride does not need your full card number or security code.
- Technical and security information: IP addresses processed by hosting and security services, browser and device information, request times, session information, error events, usage records and anti-abuse signals. The public-audit application uses a hashed IP identifier for rate limiting rather than storing the raw IP in its audit-intake record.
Search and keyword providers may supply publicly available website information and estimated keyword metrics. Information about a company is not always personal data, but we apply this policy where it identifies a person. Please do not submit passwords, payment-card data, special-category information such as health data, criminal-offence information or children’s personal information in content or support messages. Use the designated secure connection process for credentials.
We need certain information to create accounts, deliver requested work and take payment. If it is not supplied, we may be unable to provide that part of the service. Optional integrations and preferences are identified in the application.
4. Why we use information and our lawful bases
We identify a lawful basis for each purpose. Where you contract personally with us, “contract” means processing necessary to perform that contract or take requested steps before it. Where you act for a company, managing the relationship with your employer or client is normally our legitimate interest instead.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Provide accounts, audits and subscribed services | Account, business, audit and workspace information; requested communications. | Contract, or legitimate interests in delivering services to the business you represent. For customer-controlled content, we act on the customer’s lawful instructions. |
| Run authorised connections and automation | Connection permissions, selected resources, tokens, work instructions and reports. | Contract or legitimate interests in providing the requested functionality. A provider authorisation is also required; it is not a blanket consent to unrelated use. |
| Payments and statutory records | Billing contacts, transactions, invoices and subscription records. | Contract or legitimate interests for account administration; legal obligation for tax and accounting records. |
| Security, reliability and support | Technical records, access history, relevant workspace records and correspondence. | Legitimate interests in preventing misuse, resolving faults and maintaining a reliable service; legal obligation where applicable. |
| Marketing and optional device storage | Contact details, communication choices and optional preferences. | Consent where required by PECR; otherwise legitimate interests only where lawful and subject to your right to object. |
| Rights, complaints and legal claims | Relevant identity, correspondence, contract and activity records. | Legal obligation for statutory requests; legitimate interests in resolving disputes and establishing or defending legal claims. |
When relying on legitimate interests, we consider the purpose, necessity and effect on you, including your reasonable expectations. We do not use that basis where your rights override our interests. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.
5. Google connections and Google user data
Google connections are optional and operate only when available, configured and authorised. Grant only access you are entitled to give. Authorised members of your Astride workspace can see the reports and content made available to that workspace.
Search Console
With read-only Search Console permission, Astride lists accessible website properties and reads the selected property’s search-performance data, including page URLs, search queries, dates, clicks, impressions, click-through rates and average positions. We use saved reports to show results, compare periods and suggest work. If an owner enables daily checks, reports can refresh while that owner is signed out. This permission does not allow Astride to edit your website.
Google Analytics
With read-only Analytics permission, Astride reads accessible account/property information and the selected property’s reporting data. This includes aggregated organic-search sessions, users, key events, event names, transactions and revenue, with reporting dates and currency. We use it to show business results and comparisons. Connecting your Analytics property is separate from placing analytics cookies on Astride’s marketing website.
Google Business Profile
Where this connection is enabled, Astride can read accessible accounts, selected locations, listing details and recent reviews. Requested review-reply preparation sends the relevant review text to our AI processing service; the reviewer’s identity is excluded from that writing prompt. Publishing a supported post or reply requires the application’s approval and publication controls. Google’s moderation and availability rules still apply.
Use, storage, sharing and control
Astride follows the Google API Services User Data Policy, including its Limited Use requirements. Google-connected information is used for the customer-facing features described here, not sold or used for advertising, credit assessments or training general-purpose AI models. Transfers and human access are restricted to the purposes and exceptions allowed by that policy, such as providing authorised features, necessary security work, legal obligations or specific user-authorised support. A business-transfer disclosure elsewhere in this policy does not override Google’s requirements.
Connection credentials are stored on the server with access controls; stored Google refresh tokens are encrypted. They are not made available to other customers or included in AI writing prompts. Reports are stored in the relevant customer workspace.
You can disconnect in Astride and revoke access through your Google Account’s third-party connections settings. Search Console disconnection removes the company’s stored credentials and stops refreshes, but keeps saved reports and recorded publication dates. It does not revoke a Google grant used by another company connection. Revocation stops future access; it does not automatically erase previously saved information. Contact us to request its deletion.
Imported Business Profile review content has a 29-day expiry and is also marked for removal on disconnection; its associated draft and recovery content are included in cleanup. Limited publication identifiers and status records may remain for an audit trail. Disconnecting does not remove posts or replies already published on Google. See the retention section for other stored records.
6. AI, website analysis and automated features
Requested AI features send the relevant business profile, selected website text, keywords, briefs, content or image instructions to our AI suppliers so they can generate the requested output. Avoid including personal information that is unnecessary for the task. AI output and the input snapshot may be saved so you can review, edit, approve and recover the work.
Website findings and performance recommendations are decision-support tools. Astride does not use these features to make solely automated decisions about an individual that have legal or similarly significant effects, such as decisions about employment, credit or eligibility for essential services. Content generation, scheduled checks and publication permissions remain subject to the controls described in the application.
Published copy and uploaded media become available through the destination you select. Review them for personal information before approval. Removing material from Astride does not remove copies from your website, search caches or another provider’s systems.
8. International transfers
Our suppliers operate internationally. Hosting, support, email delivery, payment processing and AI or connected services may involve access from, or processing in, countries outside the UK, including the European Economic Area and the United States. A UK database region does not mean that every associated service processes information only in the UK.
For a restricted international transfer, we must use a lawful transfer mechanism: UK adequacy regulations where applicable, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with the required assessment and supplementary protections. A statutory exception may apply in limited circumstances. You can request information about the mechanism for a particular supplier and a copy of the relevant safeguards, with confidential commercial information redacted where necessary.
9. How long we keep information
We retain personal information for the purpose for which it is needed, taking account of active services, your instructions, security, dispute resolution and legal obligations. We do not apply one blanket retention period to every kind of record.
- Account and workspace history: retained while needed to provide your account, saved content and reports. Cancelling a subscription stops paid renewal; it is not an account-deletion request. On closure or a valid deletion request, we remove or anonymise information no longer needed, subject to applicable legal obligations and the rights of other workspace members.
- Unclaimed public audits: temporary access expires after seven days. Expired unclaimed records are eligible for removal by the intake cleanup process; access expiry is not a promise that all copies are erased on that exact day. Claimed or purchased reports follow account and transaction retention requirements.
- Connection data: tokens are needed while the connection is active; disconnection and revocation handling depend on the integration. Saved performance reports may remain as workspace history after disconnection. Google Business Profile review content follows the specific expiry described above.
- Payment, tax and accounting records: normally six years from the end of the company financial year to which they relate, and longer where a legal requirement, HMRC enquiry or unresolved claim requires it.
- Support, complaint and security records: retained for as long as needed to resolve the matter, investigate misuse, demonstrate the response and address applicable legal claims. Necessity, sensitivity and the relevant limitation or regulatory period determine that duration.
- Backups and recovery copies: removal from active systems may precede expiry from protected backups or recovery storage. Retained copies must remain restricted to recovery, security or legal purposes and must not be put back into ordinary use contrary to a valid deletion request.
Contact us for the retention criteria applying to a particular record, or to request deletion. If we need to keep some information, we will explain the reason and applicable limits. Genuine anonymised statistics that no longer identify you may be retained.
10. Security and confidentiality
We use technical and organisational safeguards appropriate to the information and service, including encrypted connections, authenticated access, workspace access controls and restricted server-side credentials. Access should be limited to people and suppliers who need it for their work. No internet service can guarantee absolute security.
Use a secure password, protect your email account and review team access and connected permissions. Tell us promptly if you suspect unauthorised access. Where a personal-data breach meets the legal notification threshold, we will notify the appropriate regulator and affected individuals as required by law.
12. Emails and marketing preferences
Account verification, security notices, billing messages and the reports you request are service communications. They are not a newsletter subscription. Optional morning plans and evening progress emails depend on your enabled reporting settings; turning those off does not prevent essential account messages.
If we send promotional email, we will use consent where required, or another route permitted by PECR, such as the applicable customer soft opt-in with an opt-out at collection and in each message. Sole traders and some partnerships receive the protections for individual subscribers. Corporate contacts can also object to direct marketing.
You can unsubscribe using the message’s link or contact us at any time. We may retain a minimal suppression record to respect that choice. An audit request, account registration or Google authorisation is not, by itself, consent to marketing.
13. Your data-protection rights
Depending on the circumstances and lawful basis, you can ask for access to your information, correction, erasure, restriction of processing and a portable copy of information you provided. You can object to processing based on legitimate interests and have an absolute right to object to direct marketing. You can withdraw consent where we rely on it.
These rights have legal conditions and exceptions. We may need proportionate information to verify identity or authority and clarify the request. We normally respond without undue delay and within one calendar month. Where the law permits extra time—for example, a complex request—we will explain the reason and applicable deadline. Requests are normally free; any permitted refusal or fee must be justified and explained.
For information controlled by one of our business customers, contact that business first where practical. We will assist the controller and handle any request we receive according to our legal responsibilities. This does not prevent you contacting us about our own processing.
14. Questions and complaints
To raise a data-protection complaint, email or write to us using the details in section 1. Explain the concern and the outcome you would like; no special form or legal wording is required. We will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you appropriately informed and explain the outcome.
You also have the right to complain to the UK Information Commissioner’s Office (ICO). Visit ico.org.uk/make-a-complaint, call 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We welcome the opportunity to resolve your concern, but this does not remove your right to contact the ICO or seek a legal remedy.
15. Children and changes to this policy
Astride is intended for adults using business and marketing services, not children. If you believe a child has supplied personal information to us, please contact us so that we can investigate and take appropriate action.
We may update this policy as the service or law changes. We will show the revision date and give additional notice of material changes where required. A new policy does not retrospectively create consent or authorise a use of connected data that needs fresh permission.