Privacy policy: how cmo.so looks after your data

01Your Privacy Matters

At CMO.so, your privacy is a priority. As a brand that automates SEO, GEO (Generative Engine Optimization), and multi-channel marketing, we are committed to protecting the data entrusted to us. We follow a few fundamental principles:

• We do not ask for personal information unless it’s absolutely necessary.
• We never sell or rent your data to third parties.
• We do not share your data with third parties except to comply with the law, develop our products, or protect our rights.
• We only store your data for as long as necessary to provide you with the requested service.
• We will always make our policies easy to find.

AI Marketing OS Ltd ("CMO.so") operates several websites and platforms under the cmo.so domain. This Privacy Policy outlines how we collect, use, and protect information. By using our services, you agree to the collection and use of information in accordance with this policy.

02Website Visitors

Like most modern websites, CMO.so collects non-personally identifying information typically available from browsers and servers, such as IP addresses, browser type, language preference, referring site, and timestamps. This information helps us understand how visitors interact with our platform so we can improve performance and user experience.

We may also collect potentially personally identifying information like IP addresses of logged-in users and commenters. These are disclosed under the same conditions as any personal data — to comply with law or protect our platform.

03Gathering of Personally Identifying Information

Some users may interact with CMO.so in ways that require us to collect personally identifiable information — for example, when signing up for updates, commenting, or submitting a website for SEO automation. In such cases, we only ask for the information necessary to provide our service (e.g., name, email address, phone number).

Users can always refuse to supply personal information, although that may limit certain features.

04Phone Numbers

If you provide your phone number, you may receive text messages related to your subscription or account. These are strictly opt-in. Message & data rates may apply. You may unsubscribe at any time by replying STOP or contacting our support team.

05Aggregated Statistics

CMO.so may collect and publish aggregated data about user behavior, such as the most viewed domains or top blog generators. These reports help us better serve our users and are never linked to personally identifiable information.

06Protection of Personally Identifying Information

CMO.so discloses personally identifying information only to employees, contractors, and affiliated organisations who:

• Need access to process it on our behalf, and
• Are bound by confidentiality agreements.

We never sell your data. We may disclose data when required by law or to protect our rights, users, or the public. If you contact us via support or feedback forms, we may use your message (anonymously) to improve support for others.

07Cookies

CMO.so uses cookies to enhance user experience and track activity. These help us remember login sessions, analyse trends, and optimise onboarding. You can disable cookies in your browser settings, but this may affect site functionality.

08Usage Tracking

We collect technical data to ensure compatibility and improve user experience. This includes information such as:

• WordPress themes/plugins
• Locale, timezone, SSL status
• PHP & MySQL versions
• Whether your site is multisite
• Domain and IP info

We track plugin activation, onboarding progress, and integration status to improve product design. Sensitive data such as API keys are excluded from tracking.

09Google Search Console Integration

If you choose to connect Google Search Console, CMO.so accesses your keyword rankings and page insights to enhance reporting. Data is accessed only with your consent and used strictly for your benefit.

All access is handled through Google's official APIs and restricted to authorised support staff.

CMO.so's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Search Console data only to show you your own search performance and to plan and improve your content; we do not sell it, use it for advertising, or use it to train AI models.

10The CMO.so App and Maggie

This section covers the CMO.so app (iOS, Android and web at app.cmo.so) and Maggie, our AI marketing assistant, including when you use Maggie from other apps you connect (such as ChatGPT or Claude).

What we collect and why:

• Account: your name, email address and sign-in details (email, Google or Apple, handled by Google Firebase Authentication), to create and secure your account.
• Your websites and business profile: the websites you add and what Maggie learns from them (products, audience, brand voice), to plan and write your content.
• Your content and messages: posts, ideas and LinkedIn drafts, your edits and approvals, and what you write to Maggie, to do what you ask.
• Photos you choose or take: if you pick or take photos to get post ideas, they are sent to our servers to generate the ideas and are not stored afterwards. If you choose a photo as a post's picture, it is stored with that post (and changed as you ask, if you ask Maggie to). The app only reads the photos you select and uses the camera only when you take a photo.
• LinkedIn: if you connect LinkedIn, we keep the access tokens, your profile name and the pages you manage, to publish the posts you approve. You can disconnect at any time.
• Facebook Pages: if you connect Facebook, we keep the access tokens for the Facebook Pages you manage, with their names and categories, to publish the posts you approve to the Page you choose for each website. We do not read your personal profile, friends, groups or messages. You can disconnect in the app at any time, or remove CMO.so in Facebook (Settings, then Apps and websites), which ends our access.
• Instagram: if an Instagram professional account is linked to one of those Pages, we keep its id, username and profile picture with the Page's access token, to publish the posts and pictures you approve to the Instagram account you choose for each website. We do not read your followers, comments or messages. Disconnecting Instagram or Facebook in the app, or removing CMO.so in Facebook, ends our access.
• Google Business Profile: if you connect a Google Business Profile, we keep the access token, the profile's name, address, website, category and Google ids, to publish the posts you approve to the profile you choose for each website and to show its views, calls, website clicks and direction requests. We do not read your reviews or messages. Disconnecting in the app deletes the token we hold.
• YouTube: if you connect a YouTube channel, we keep the access token and the channel's id, name and picture, to upload the videos you approve to that channel and set their cover image. See “YouTube” below.
• TikTok: if you connect a TikTok account, we keep the access tokens and the account's id, display name, username and profile picture, and for each video you post the settings you chose (who can view it, comments, Duet and Stitch, content disclosure and the AI-generated label), to post the videos you approve to that account. We do not read your other videos, followers, comments or messages. Disconnecting TikTok in the app revokes our access at TikTok and deletes the tokens we hold; you can also remove CMO.so in the TikTok app (Settings and privacy, then Security, then Apps and services).
• Cloudflare DNS: if you choose to verify a website by adding its DNS record with Cloudflare, you sign in to Cloudflare and allow CMO.so to read your zones and edit DNS records once. We use that access only to find the website's zone and add one TXT record (ai-cmo-so-verification=…), then revoke it straight away. We do not keep the token or read or change anything else; you can delete the record after the website is verified.
• Videos you upload or link: we use a video only to check it, prepare it for each channel (for example change its format or shape, or cut it to the part you choose) and post it. Our copy is deleted once the posts that use it have gone out, and never kept longer than 7 days. Videos are processed and stored by Amazon Web Services in the United Kingdom.
• Maggie Memory: what Maggie learns from your edits and choices (for example the tone or length you prefer), kept per website and per channel so later posts suit you. You can see and delete it in the app (Me, then Your Maggie Memory).
• Google Search Console: as described above, if you connect it.
• Usage: how many messages and AI generations you use each day, and a record of the changes Maggie makes for you, so you can review them and we can apply fair-use limits.
• Notifications: if you turn on notifications, a device token so we can send them.

The app has no advertising and does not track you across other companies' apps or websites. We do not sell your data.

Service providers: we use Google (Firebase Authentication, and the Gemini API to generate text, which under Google's paid API terms is not used to train their models), Stripe for payments on cmo.so, the LinkedIn, Meta (Facebook and Instagram), Google (Search Console, Business Profile), YouTube, TikTok and Cloudflare DNS APIs for the connections you choose, Amazon Web Services to prepare and briefly store videos you post, and Cloudflare to host the web app. They process data only to provide their service to us.

YouTube: CMO.so uses YouTube API Services to post videos to a YouTube channel you connect. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. We access only your channel's id, name and picture, and upload only the videos you approve, with the title, description and cover you see before posting. We do not read your other videos, comments, subscribers or analytics, and we do not share YouTube data with anyone except to provide this service. You can disconnect YouTube in the app, which deletes the token we hold, and you can remove CMO.so's access at any time on Google's security settings page. To ask us to delete the YouTube data we hold, disconnect YouTube or email support@cmo.so; we delete it within 7 days. Our use of information from Google APIs, including YouTube, follows the Google API Services User Data Policy, including the Limited Use requirements.

ChatGPT, Claude and other AI assistants: if you connect CMO.so to an AI assistant (through our MCP server, the ChatGPT app or the command line), you sign in to CMO.so and approve the connection. The assistant can then read and, after showing you a preview and getting your confirmation, change the data of the websites you manage, within your team permissions. What it reads (for example your results, posts and LinkedIn drafts) is sent to that assistant's provider, such as OpenAI or Anthropic, and is handled under their privacy terms. We receive only the requests the assistant makes, and we keep the same usage records and change history as for the app. We never receive your conversations with the assistant beyond those requests. You can disconnect any assistant in your account settings under Connected apps.

Retention and deleting your account: we keep your data while your account is open. You can delete your account in the app (Me, then Delete account) or by emailing us. This removes your sign-in, profile, API keys, connected apps, LinkedIn, Facebook, Instagram, Google Business Profile, YouTube, TikTok and Search Console connections and tokens, social drafts and campaigns, Maggie Memory, notification settings and Maggie history. To ask us to delete only the data we received from Facebook or Instagram, disconnect Facebook in the app or email us at support@cmo.so; we delete it within 30 days. Websites you own are released and the posts already published stay on your sites. Paid plans stop renewing and end at the end of the paid period. Billing and invoice records are kept as required by law.

11Your Data Protection Rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. CMO.so aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal data. You have the following rights:

• The right to access, update, or delete the information we have on you.
• The right to rectification if your information is inaccurate or incomplete.
• The right to object to our processing of your personal data.
• The right to request that we restrict the processing of your personal data.
• The right to data portability, allowing you to request a copy of your personal data in a structured, machine-readable format.
• The right to withdraw consent at any time where we rely on your consent to process your personal data.

If you wish to exercise any of these rights, please contact us at support@cmo.so. We will respond to your request within a reasonable timeframe, typically within one month.

12Business Transfers

If CMO.so is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

In the event of bankruptcy or insolvency, your data may be transferred to third parties as part of the business assets. We will ensure that any such transfer is compliant with applicable data protection laws.

13Advertising

Third-party ads shown on our platform may use cookies to track ad performance. These advertisers may collect data about your visits to deliver personalised ads. This policy only applies to our cookies — not those used by advertisers.

We do not control how advertisers collect or use your data. If you have concerns, please contact the advertiser directly.

14Comments

Content submitted to anti-spam tools may be stored temporarily to improve filtering accuracy. Comments left on our platform are visible to site administrators and may be retained for quality assurance and moderation purposes.

We encourage you to avoid sharing personal information in comments. We may collect data such as IP addresses and browser user agents to help spam detection.

15Policy Updates

We may update this policy from time to time. Material changes will be posted here. Continued use of our service after a policy update indicates acceptance.