Privacy Policy

This Privacy Policy applies to the DCK AEO platform operated by DCK AEO (“DCK AEO”, “we”, “us”, or “our”), accessible at https://dckaeo.com and related subdomains, applications, and APIs (the “Platform” and the “Services”).

Effective Date: 26 August 2026.

Last Updated: 9 September 2026.

Capitalised terms used in this Privacy Policy have the meanings given in the DCK AEO Terms of Service, including “Customer”, “Customer Data”, “Generated Content”, “Account”, “Website”, “Reports”, “Third-Party Services”, “AI Services”, “Grace Period”, and “PDPA”. If this Privacy Policy and the Terms conflict on a contractual matter, the Terms prevail unless this Privacy Policy expressly states otherwise for a privacy-specific topic.

DCK AEO is an AI-powered Answer Engine Optimization and AI visibility platform. Customers use DCK AEO to connect websites they own or control, analyse search and content performance, generate reports, create and publish content, and connect Third-Party Services such as Google Search Console.

This Privacy Policy describes how DCK AEO collects, uses, stores, discloses, and protects personal information and other data when you visit https://dckaeo.com, create an Account, subscribe to the Services, connect a Website, or authorise an integration.

DCK AEO processes personal data in accordance with the Personal Data Protection Act 2010 of Malaysia (PDPA) and other applicable law. Depending on the context, DCK AEO may act as a data user in respect of Account and billing information, and as a data processor in respect of personal data that the Customer includes in Customer Data.

By creating an Account or using the Services, you acknowledge this Privacy Policy. If you do not agree, you must not use the Services.

The information DCK AEO collects depends on how you use the Services. DCK AEO does not collect categories of data that are not needed to operate the Platform as described below.

3.1 Account information

When you register, DCK AEO collects your first name, last name, username, email address, and password. Passwords are stored as a one-way hash, not in plain text. DCK AEO records whether and when you accepted the Terms of Service. DCK AEO accounts are created with a username and password. DCK AEO does not currently offer Google Sign-In as the method for creating or signing in to a DCK AEO Account.

3.2 Contact information

You may add a phone number, timezone, and optional profile avatar in Account settings. DCK AEO uses the email address associated with the Account for notices, security messages, and support replies.

3.3 Authentication information

After you sign in, DCK AEO issues JSON Web Tokens (an access token and a refresh token) that the browser stores in local storage so you can stay signed in. DCK AEO may update last-login information when tokens are refreshed. Django-served pages may also use CSRF cookies and, for Django administration, session cookies.

3.4 Customer Data

As defined in the Terms, Customer Data includes data, files, documents, text, images, URLs, credentials, configurations, keywords, instructions, prompts, and other materials that you or your Authorised Users upload, input, submit, connect, or otherwise make available to the Services. This includes business briefs, competitor URLs, content drafts, Generated Content stored on the Platform, Reports, crawl results, and integration settings. The Customer owns Customer Data. DCK AEO processes it to provide the Services.

3.5 Website and project information

When you add a Website, DCK AEO collects the site name, domain or URL, organisation association, plan or service status, and related configuration. DCK AEO may crawl and analyse pages on Websites you authorise, and may collect publicly accessible information from competitor sites you ask DCK AEO to analyse, as described in the Terms.

3.6 Usage and technical information

DCK AEO and its hosting infrastructure may record technical logs such as IP address, date and time, request path, browser user agent, and error diagnostics. These logs are used for security, debugging, reliability, and abuse prevention. DCK AEO also stores a theme preference (light or dark) in local storage on your device.

3.7 Information provided through integrations

If you connect a Third-Party Service, DCK AEO receives the data that service returns under the permissions you grant. That may include OAuth tokens, account or property identifiers, and the content of API responses needed to provide the integration. Google integrations are described in Section 4. Other integrations may include LinkedIn, Cloudflare, Meta (Facebook or Instagram), and similar services you choose to connect. Certain social publishing credentials are encrypted at rest.

3.8 Communications and support information

If you email [email protected] or otherwise contact DCK AEO, we collect the content of that correspondence and any contact details you provide so we can respond.

3.9 Billing information

DCK AEO may store invoice records, payment references, payment links, plan or package selections, and service activation status. DCK AEO does not store full payment card numbers on its own systems. Payment processing, where used, is handled by the relevant payment provider under that provider’s terms and privacy policy.

4.1 How Google OAuth works in DCK AEO

DCK AEO allows a signed-in Customer to connect a Google account to a Website from the Websites area of the Platform (the “Connect Google” or “Connect to Google” action). Google then shows Google’s own consent screen listing the permissions DCK AEO is requesting. If you approve, Google issues OAuth tokens to DCK AEO.

DCK AEO stores those OAuth credentials (including access token, refresh token, expiry, and granted scopes) in the Google settings for the Customer’s organisation so that DCK AEO can call Google APIs on the Customer’s behalf until the connection is disconnected, the tokens expire or are revoked, or the Account data is deleted as described in Sections 11 to 13.

4.2 Google OAuth scopes currently requested

The current Connect Google flow requests these Google OAuth scopes:

• openid — to complete Google’s OpenID Connect authentication of the Google user who is authorising the connection.
• https://www.googleapis.com/auth/userinfo.email — to receive the email address of the Google account used to authorise the connection.
• https://www.googleapis.com/auth/userinfo.profile — to receive basic profile information for that Google account (such as name).
• https://www.googleapis.com/auth/webmasters.readonly — read-only access to Google Search Console.

DCK AEO only accesses Google data that you authorise on the Google consent screen. If DCK AEO later requests additional Google scopes, Google will show those permissions to you before they are granted.

4.3 Google account identity (email and profile)

What is accessed: the email address and basic profile information associated with the Google account that completes OAuth, together with OAuth tokens.

Why: to identify which Google account authorised the connection and to maintain a working OAuth session.

How it is used: solely to operate the Google connection for the Customer’s organisation and Websites. DCK AEO does not use this identity data to create a public profile, to advertise, or to contact Google users other than in connection with the Services the Customer requested.

Whether it is stored: OAuth tokens and related connection metadata are stored in organisation Google settings. Identity information returned by Google as part of OAuth may be processed to complete and maintain the connection.

How it is protected: stored on DCK AEO systems with access controls and transmitted over HTTPS. See Section 14.

When it is deleted: when stored Google credentials are cleared (including on request to [email protected], after the Grace Period following Account termination, or when tokens are no longer valid). You can also revoke DCK AEO in your Google Account so new access is impossible.

4.4 Google Search Console

Google Search Console is the Google API DCK AEO currently requests through the Connect Google OAuth scopes listed above.

What is accessed:

• The list of Search Console properties (site URLs) available to the authorised Google account, so you can select the property that matches your Website.
• Search performance data for the selected property, including search queries, clicks, impressions, click-through rate (CTR), and average position.
• Sitemap submission for blog sitemaps DCK AEO publishes for the connected Website, where that feature is used.
• URL Inspection information for specific URLs (for example indexing verdict or coverage state) where that feature is used.

Why it is accessed: to provide Search Console Integration described in the Terms: property selection, keyword and ranking insights, AEO and performance reporting, and optional sitemap or URL indexing status related to content DCK AEO publishes for you.

How it is used: DCK AEO copies relevant Search Console metrics into the Customer’s DCK AEO workspace (for example keyword rows, ranking snapshots, and dashboard reports) so the Customer can view AEO analysis inside DCK AEO. DCK AEO does not use Search Console data to build advertising profiles or to sell data.

Whether it is stored: yes. DCK AEO stores the selected Search Console property URL, connection status, and retrieved performance metrics (such as queries, clicks, impressions, CTR, and position) associated with the Customer’s Website, plus the OAuth tokens needed to refresh that data.

How it is protected: HTTPS in transit; access limited to the Customer’s organisation and authorised DCK AEO personnel who need it to operate or secure the Services; see Section 14.

When it is deleted: Search Console property association for a Website can be disconnected from the Websites page (see Section 13). Stored metrics remain part of Customer Data until deleted under Section 12. OAuth tokens remain until cleared as described in Sections 12 and 13.

How to disconnect or revoke: use Disconnect on the Website’s Google connection panel, and revoke DCK AEO in Google Account permissions. See Section 13.

4.5 Google Analytics

The Terms describe Google Analytics Integration as a Service that may interoperate with the Platform. DCK AEO includes product functionality that can retrieve aggregated Google Analytics 4 metrics (such as sessions, users, pageviews, and organic search sessions) for a GA4 property the Customer has associated with a Website.

The current default Connect Google OAuth consent does not request the Google Analytics OAuth scope. DCK AEO therefore does not obtain Google Analytics API access through that default consent screen. If a Customer later grants Google Analytics permissions to DCK AEO, DCK AEO would use that access only to populate AEO performance reporting for the connected Website, would store aggregated metrics (not advertising audiences), and would not sell that data or use it for ads. Until those permissions are granted, DCK AEO does not access Google Analytics user data via Google APIs.

4.6 Google Business Profile

The Terms describe Google Business Profile Insights as a Service that may interoperate with the Platform. DCK AEO includes product functionality that can store a Business Profile account and location association for a Website and, if authorised, retrieve reviews (including reviewer display name, star rating, and review text) to produce complaint themes and content recommendations.

The current default Connect Google OAuth consent does not request the Google Business Profile management scope. DCK AEO therefore does not obtain Google Business Profile API access through that default consent screen. If a Customer later grants those permissions, DCK AEO would use review and listing data only to provide the requested insights, would not sell the data, and would not use it for advertising. Until those permissions are granted, DCK AEO does not access Google Business Profile user data via Google APIs.

4.7 Google Gemini and other Google services used as AI providers

Separately from Google OAuth for Search Console, DCK AEO may send prompts and related Customer inputs to Google Gemini (a Third-Party AI provider) when you use AI features. That processing is governed by Section 7 and by Google’s terms for that API. It is not access to your Google Account via OAuth unless you have connected Google as described above.

4.8 What DCK AEO does not access through the current Google OAuth consent

DCK AEO does not currently request Gmail, Google Drive, Google Calendar, Google Photos, or Google Ads (AdWords) OAuth scopes in the Connect Google flow. DCK AEO does not read the contents of your Gmail or Drive through that connection.

DCK AEO uses information for the following purposes:

• Creating and managing Accounts — registration, profile updates, organisation and Website setup, and Terms acceptance records.
• Authentication — verifying username and password, issuing and refreshing access tokens, and protecting the Account.
• Providing DCK AEO Services — crawling authorised Websites, keyword and competitor analysis, content planning and generation, publishing, dashboards, and AEO automation.
• Website and AEO analysis — producing Reports, health snapshots, and recommendations from Customer Data and authorised third-party data.
• Generating reports — storing and displaying AEO, ranking, and related Reports for the Customer.
• Analytics and performance monitoring of the Customer’s Websites — using Search Console (and, if separately authorised, other connected sources) to show performance inside DCK AEO. This is not advertising analytics about visitors to dckaeo.com.
• Connecting third-party integrations — exchanging OAuth tokens and API data you authorise, including Google Search Console.
• Customer support — responding to emails and in-product requests.
• Security and fraud prevention — logs, access controls, investigating abuse, and protecting the Platform.
• Improving the Services — reliability, diagnostics, and aggregated or de-identified insights as permitted by the Terms (Section 12.6 of the Terms), without using Customer Data to train DCK AEO proprietary AI models without consent (Section 7).
• Legal and regulatory compliance — including the PDPA, tax or accounting records where applicable, and responding to lawful requests.
• Billing and subscription administration — invoices, payment references, plan status, and the Grace Period process described in the Terms.

Depending on the processing, DCK AEO relies on performance of a contract (providing the Services you requested), your consent (for example Google OAuth), legitimate interests in operating a secure SaaS platform, and legal obligations.

Google user data obtained through Google APIs is used only for the purposes necessary to provide the functionality you requested, principally connecting Search Console and producing related AEO reports and publishing-related Search Console actions described in Section 4.

DCK AEO does not sell Google user data.

DCK AEO does not use Google user data for advertising purposes, does not build advertising profiles from Google user data, and does not serve ads based on Google user data.

DCK AEO does not transfer Google user data to third parties except: (a) to subprocessors who process data solely to help DCK AEO provide the requested Service (for example hosting infrastructure), under appropriate confidentiality and security obligations; (b) to Third-Party Services you ask DCK AEO to use (for example an AI provider generating an output from a report you requested), to the extent necessary for that request; (c) when required by law; or (d) as otherwise permitted by applicable Google policies and your authorisation.

DCK AEO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

DCK AEO does not use Google user data to train generalised AI or machine-learning models. DCK AEO does not allow humans to read Google user data except (a) with your consent, (b) for security, abuse, or troubleshooting investigation, or (c) as required by law.

This section is consistent with Section 20 of the Terms of Service.

DCK AEO will not use Customer Data or Customer Generated Content to train, fine-tune, or otherwise develop DCK AEO’s proprietary artificial intelligence models without the Customer’s explicit prior consent.

That restriction applies to DCK AEO’s own proprietary models. It does not stop DCK AEO from processing Customer Data and Generated Content as needed to provide the Services in real time, including sending inputs to Third-Party Services such as third-party AI providers to generate outputs you requested.

AI features may use providers such as Google Gemini and, depending on configuration, other providers referred to in the Terms (including OpenAI and Anthropic). Those providers process inputs under their own privacy policies and terms. DCK AEO will use commercially reasonable efforts to select Third-Party Services and configurations that do not use Customer inputs to train the third party’s models, where such options are reasonably available. DCK AEO does not control and is not responsible for the data practices of Third-Party Services.

If you have given consent for training DCK AEO proprietary models, you may withdraw that consent prospectively by notice to [email protected]. Withdrawal does not undo processing already carried out or models already trained before withdrawal.

Google user data obtained through Google APIs is not used to train generalised AI or ML models, as stated in Section 6.

DCK AEO uses cookies, local storage, and similar technologies that are needed to run the Platform. DCK AEO does not currently operate a third-party advertising pixel or a third-party product-analytics cookie suite (such as Google Analytics tags) on https://dckaeo.com.

Local storage. The signed-in application stores authentication tokens and a theme preference in the browser’s local storage. These are not HTTP cookies. Clearing site data or signing out removes the tokens from that browser.

Cookies on Django-served pages. Pages served by DCK AEO’s application server (including this Privacy Policy and the Terms of Service) may set a CSRF cookie to protect form and session integrity. Django administration uses session cookies for authenticated staff. These are essential security cookies.

Fonts and static assets. Legal pages may load fonts from Google Fonts. Google may receive your IP address as a result of that request, under Google’s own policies. This is not DCK AEO accessing your Google Account.

If DCK AEO later adds optional analytics cookies, this section will be updated and, where required, additional notice or consent will be provided.

Consistent with Section 18 of the Terms, the Services interoperate with, and may depend upon, Third-Party Services, including Google services, Google Search Console, Google Analytics, Google Business Profile, Cloudflare, Meta, OpenAI, Google Gemini, Anthropic, Serper, LinkedIn, and other APIs and platforms.

You only connect an integration if you choose to. DCK AEO then accesses that service on your behalf solely to provide the related feature. Your use of each Third-Party Service is governed by that party’s terms and privacy policy. DCK AEO does not control those practices.

Examples of how this works in DCK AEO today:

• Google / Search Console — as described in Section 4.
• Serper — DCK AEO may query search-result data for keyword and ranking features using a Serper API key configured for the Platform or organisation. That is not Google OAuth access to your Google Account.
• Cloudflare — if you connect Cloudflare, DCK AEO stores OAuth or API credentials needed to publish or manage content on your behalf.
• Meta (Facebook / Instagram) and LinkedIn — if you connect those platforms, DCK AEO stores tokens and account identifiers needed to publish or manage social content you request.
• AI providers (Google Gemini, OpenAI, Anthropic) — inputs you submit for generation may be sent to the configured provider to return an output.

DCK AEO does not sell personal information.

DCK AEO may disclose information in these situations:

• Service providers / sub-processors — hosting, email delivery, logging, and similar vendors who process data only to help DCK AEO operate the Services, under confidentiality and data-protection obligations as described in the Terms.
• Third-party integrations you request — Google, Cloudflare, Meta, LinkedIn, and others you connect, to the extent required to perform the integration.
• AI providers — where required to generate an output or analysis you requested.
• Legal and regulatory requirements — if required by law, regulation, or valid legal process.
• Protection of rights, security, and the Services — to investigate abuse, prevent fraud, or protect DCK AEO, Customers, or the public.
• Business transfers — if DCK AEO assigns or transfers its business as described in the Terms (for example a merger or sale of assets), information may transfer to the successor, who remains bound to protect it consistently with this Policy to the extent required by applicable law.

DCK AEO may identify a Customer as a customer in a factual manner unless the Customer opts out by notice to [email protected], as stated in the Terms. That courtesy mention is not a sale of personal data.

DCK AEO retains information for as long as needed to provide the Services and for the periods described in the Terms.

Account and Customer Data remain available while the Subscription is active and during the Grace Period. Under Section 11 of the Terms, after cancellation, expiry, non-renewal, or termination for non-payment, the Account enters a grace period of thirty (30) calendar days. No data is deleted during that Grace Period solely because the Grace Period started. After exactly thirty calendar days from the start of the Grace Period, DCK AEO may permanently and irreversibly delete Customer Data, Reports, Generated Content, keywords, crawl history, analytics history, AEO history, AI history, Backups, and connected integrations and their configurations and tokens.

Certain information may be retained longer where required by law, for security and fraud prevention, for dispute resolution, to enforce the Terms, or for other legitimate business records (for example invoice records). Backups maintained for disaster recovery may persist for a limited additional period until they rotate, even after production deletion.

Google OAuth tokens are retained while the Google connection is needed to provide Search Console (and any other Google features you have authorised). They are cleared when credentials are removed as described in Sections 12 and 13, or as part of Grace Period deletion.

12.1 How to request deletion

DCK AEO does not currently provide a self-service “delete my account” button in the Profile settings. To request deletion of your Account or personal data, email [email protected] from the email address on the Account. You may also cancel a Subscription through Account settings or by contacting support, which starts the Grace Period in the Terms rather than immediate deletion.

12.2 What happens when an Account is deleted

After the Grace Period, DCK AEO may permanently delete Customer Data, Reports, Generated Content, and related history, including connected integration tokens, as set out in the Terms. You should export any data you wish to keep before the Grace Period ends.

12.3 Connected Google integrations

When Google credentials are deleted from DCK AEO, DCK AEO can no longer call Google APIs on your behalf. Search Console metrics already copied into your workspace are Customer Data and follow the same retention and deletion rules as other Customer Data. Disconnecting Search Console for a Website (Section 13) stops that Website’s Search Console property association; it does not by itself erase historical keyword rows already stored, and it does not revoke organisation-wide OAuth tokens. To remove stored Google tokens, contact [email protected] and revoke access in Google (Section 13).

12.4 Exceptions required by law

DCK AEO may retain information where legally required, needed to resolve disputes, prevent fraud, or enforce the Terms, including limited backup copies until they expire.

13.1 Disconnect inside DCK AEO

To disconnect Google Search Console for a Website in DCK AEO:

1. Sign in to DCK AEO at https://dckaeo.com/login.
2. Open Websites.
3. Select the Website whose Google connection you want to change.
4. In the Google connection panel, choose Disconnect.

That action disconnects Google Search Console for that Website (it clears the selected property association for that site). It does not, by itself, delete organisation-wide Google OAuth tokens that may still be stored for other Websites in the same organisation. You may reconnect later with Connect to Google or Reconnect Google.

To request deletion of stored Google OAuth tokens for your organisation, email [email protected].

13.2 Revoke access in your Google Account

Independently of DCK AEO, you can revoke DCK AEO’s access at any time in your Google Account:

1. Open Google Account permissions: https://myaccount.google.com/permissions.
2. Find DCK AEO (or the Google Cloud project name shown on the consent screen).
3. Remove access / revoke.

After revocation, DCK AEO cannot obtain new Google API data with those tokens. You should also disconnect in DCK AEO and, if you want tokens removed from DCK AEO systems promptly, email support.

Consistent with Sections 19.5 and 21 of the Terms, DCK AEO implements and maintains commercially reasonable technical, administrative, and organisational safeguards designed to protect the confidentiality, integrity, and availability of Customer Data and personal data.

Those measures include, as appropriate:

• Encryption in transit — HTTPS/TLS for the public website and API.
• Encryption at rest — encryption of certain integration credentials (including social publishing credentials) using application-level encryption; other data is stored in DCK AEO databases and infrastructure with access controls.
• Access controls — authenticated APIs, organisation-scoped data, and restricted staff access.
• Authentication — hashed passwords and short-lived JWT access tokens with refresh tokens.
• Logging and monitoring — application and infrastructure logs used to detect errors and abuse.
• Security incident procedures — DCK AEO maintains procedures designed to detect and respond to incidents and will notify the Customer without undue delay of a personal data breach affecting the Customer’s personal data, as described in Section 19.7 of the Terms.

DCK AEO does not claim ISO, SOC, or similar certifications in this Policy. No method of transmission or storage is completely secure. The Customer remains responsible for protecting Account credentials and connected integrations, as stated in the Terms.

DCK AEO is operated with reference to Malaysian law, including the PDPA. Providing the Services may involve transferring, storing, and processing data in jurisdictions outside Malaysia, including through DCK AEO infrastructure and Third-Party Services (for example cloud hosting, Google APIs, and AI providers).

DCK AEO will take reasonable steps to ensure that such transfers are conducted in accordance with applicable law, consistent with Section 19.6 of the Terms. By using the Services, you acknowledge that your information may be processed outside Malaysia.

Subject to the PDPA and other applicable law, you may request:

• Access to personal data DCK AEO holds about you.
• Correction of inaccurate personal data. You can also update name, email, phone, timezone, and related profile fields in Profile while signed in.
• Deletion of personal data, subject to Section 12 and legal exceptions.
• Withdrawal of consent for optional processing, including Google OAuth (by disconnecting and revoking access) and any AI-training consent given under the Terms.
• Other data-related requests that applicable law requires DCK AEO to consider.
• Revocation of third-party integration access using in-product disconnect controls where available, plus the third party’s own security settings.

Send requests to [email protected]. DCK AEO will provide reasonable assistance to Customers responding to data-subject requests under the PDPA, as stated in the Terms, taking into account the nature of the processing.

The Services are a business AEO platform. Under the Terms, a Customer must be at least eighteen (18) years of age, or the age of majority in their jurisdiction, whichever is greater. The Services are not directed to children. DCK AEO does not knowingly collect personal data from children. If you believe a child has provided personal data, contact [email protected] and DCK AEO will take reasonable steps to delete it.

DCK AEO may update this Privacy Policy from time to time. The revised version will be posted at https://dckaeo.com/privacy/, and the “Last Updated” date at the top of this page will change. Material changes may also be notified through the Platform or by email to the address on the Account, where appropriate. Continued use of the Services after the updated Policy is posted constitutes acknowledgement of the updated Policy, except where applicable law requires additional consent.

Privacy questions, access or deletion requests, and notices under this Policy should be sent to:

DCK AEO
Email: [email protected]
Website: https://dckaeo.com
Privacy Policy URL: https://dckaeo.com/privacy/
Terms of Service: https://dckaeo.com/terms/

Notices to DCK AEO under the Terms are also sent to [email protected].