Skip to main content
Last updated: September 8, 2026 This notice explains how Genseo processes data when you use the Genseo Public API, CLI, remote MCP server, or AI plugins for Claude, ChatGPT, Codex, and other compatible clients. It supplements the Genseo Privacy Policy.

​
Controller and contact

The service is provided by:
Privacy and support requests: support@genseo.co

​
Data processed

Developer integrations process only the data needed to authenticate the connection and perform the operation requested by the user or their AI client. This may include:
  • Account, workspace, and project identifiers
  • API key or OAuth authorization metadata
  • Project configuration and website domain
  • Accessible-project listings for an OAuth-connected account
  • Site Audit history, pages, scores, Issues, evidence and Opportunities
  • Keywords and keyword metrics
  • Article titles, drafts, generated content, metadata, and publication status
  • Publishing integration status and field mappings
  • Webhook configuration
  • Technical request information such as timestamps, IP addresses, client identifiers, error details, and rate-limit events
The MCP server does not request access to Claude or ChatGPT conversation history, memories, unrelated files, contacts, calendars, email, or data outside the connected Genseo account. Although OAuth can list all projects available to that account, each project operation is isolated by an explicit project_id and a fresh membership check.

​
How data is used

Genseo processes this data to:
  • Authenticate and authorize the connection
  • List projects available through the connected account and enforce project and permission boundaries
  • Return Audit, page, Issue, evidence, Opportunity and Autopilot information
  • Return project, keyword, article, integration, and webhook information
  • Create or update content when requested
  • Generate keywords or article content when requested
  • Publish approved content through a configured CMS integration
  • Detect abuse, investigate errors, enforce rate limits, and maintain service security
  • Provide support and improve reliability
Genseo does not sell personal data obtained through developer integrations.

​
AI clients and instructions

The plugin repository contains only public configuration and workflow instructions. It does not contain user credentials or private Genseo application data. Prompts and conversation context remain with the AI client unless the client sends specific values as arguments to a Genseo MCP tool. Genseo receives only the tool name and arguments required to perform that request. Rate-limit telemetry contains operational bucket type, limit, reset time and authentication type; it does not contain prompts, tool bodies, tokens, API keys or credentials.

​
Authentication and permissions

Developer API keys are bound to one Genseo project and a defined set of scopes. OAuth grants belong to a user account and may list multiple projects available through that user’s workspace memberships. Membership is checked again for every operation, so removing a member also removes their connector access. Users can revoke keys in Genseo at any time. Marketplace connections use authorization-code OAuth with PKCE, refresh tokens and a dedicated MCP audience. They require browser consent and can be disconnected from the AI client or revoked in Genseo. Ordinary Genseo browser-session tokens and credentials in MCP URL query parameters are rejected.

​
Service providers and external publishing

Genseo uses service providers for hosting, databases, authentication, monitoring, email, and product operations, as described in the main Genseo Privacy Policy. When a user explicitly publishes content, Genseo sends the required article data to the CMS provider configured by that user, such as Webflow, Shopify, WordPress, Wix, or Framer. Those providers process data under their own terms and privacy policies.

​
Retention and deletion

  • Project content and configuration are retained while the project or account remains active, unless the user deletes them earlier.
  • Revoked API keys and authorization records may be retained as necessary for security, fraud prevention, and audit purposes.
  • Technical logs are retained only as long as reasonably necessary for security, troubleshooting, service reliability, and legal obligations.
  • Data may remain in encrypted backups for a limited period until routine backup rotation completes.
Users can delete content in Genseo, revoke developer credentials, disconnect integrations, or request account and personal-data deletion by contacting support@genseo.co.

​
Security

Genseo uses HTTPS for data in transit and applies access controls and project-level authorization. Users must keep API keys confidential and should grant only the scopes required for their workflow. If a credential may have been exposed, revoke it immediately and create a replacement.

​
User rights

Depending on applicable law, users may request access, correction, deletion, restriction, portability, or objection regarding their personal data. Requests can be sent to support@genseo.co. For additional information about legal bases, international transfers, cookies, subprocessors, and GDPR rights, see the Genseo Privacy Policy.