Privacy Policy

Privacy Policy

Last updated: 27 June 2026

1. Who We Are

Lefrog Digital (“we”, “us”, “our”) operates the website https://lefrog.io and the Prometheus SEO Platform, including the Prometheus Bridge WordPress plugin.

We are an SEO service provider based in the United Kingdom. Our registered business contact is available via our contact page.

2. Data We Collect

We collect the following categories of data depending on your interaction with our services:

2.1 Information You Provide Directly

  • Account information: name, email address, website URL, and billing details when you subscribe to our services or register for the Prometheus platform.
  • Communication data: information you provide when contacting us via email, contact forms, or support channels.
  • Service configuration: WordPress site URL, API keys generated through the Prometheus Bridge plugin, and settings preferences.

2.2 Information Collected Automatically

When you use the Prometheus Bridge plugin with the “Phone Home” feature enabled (opt-in only), we receive:

  • Your site URL and site name
  • WordPress and PHP version numbers
  • Plugin version
  • Active plugin count
  • Published post and page counts
  • Active theme name
  • Timestamp of the connection

This data is used solely to verify connectivity, ensure compatibility, and monitor service health.

2.3 Information from Third-Party Services

When you authorise us through OAuth, we may access data from:

  • Google Search Console: site performance data, indexing status, search queries, and coverage reports (only for sites you explicitly authorise).
  • Google Business Profile: listing information, reviews, posts, and insights (only for profiles you explicitly authorise).
  • Google Analytics / GA4: aggregated traffic and engagement metrics (only for properties you explicitly authorise).
  • DataForSEO: keyword rankings, SERP analysis, and competitive data (processed on your behalf through our platform).

3. How We Use Your Data

We use collected data for the following purposes:

  • Providing and maintaining the Prometheus SEO Platform and associated services
  • Analysing Google Search Console issues and deploying fixes through the Prometheus Bridge plugin
  • Automating Google Business Profile management and audit reporting
  • Generating SEO performance reports and dashboards
  • Conducting technical SEO audits and content/GEO optimisation
  • Processing white-label partnership deliveries
  • Communicating with you about your account, service updates, and support requests
  • Improving our services, detecting and preventing abuse, and ensuring platform security
  • Complying with legal obligations

4. Legal Basis for Processing

We process your data under the following legal bases as defined by UK GDPR:

  • Contractual necessity: to deliver the services you have subscribed to
  • Legitimate interests: to maintain and improve our platform, ensure security, and communicate with you
  • Consent: where you have opted in (e.g., Phone Home feature, marketing communications)
  • Legal obligation: where required by law

5. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

  • Third-party service providers who process data on our behalf (e.g., cloud hosting, analytics infrastructure). These providers are contractually bound to protect your data and use it only for the services we specify.
  • Google (via OAuth-scoped APIs for GSC, GBP, and GA4) — only for the specific services you authorise.
  • DataForSEO — for keyword and SERP analysis performed on your behalf.
  • Law enforcement or regulatory bodies where required by applicable law.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide our services. After account termination, we retain data for up to 12 months unless earlier deletion is requested. Audit logs and cached analytics data may be retained in anonymised form for service improvement purposes.

7. Your Rights

Under UK GDPR, you have the following rights:

  • Right of access: request a copy of the personal data we hold about you
  • Right to rectification: correct inaccurate or incomplete data
  • Right to erasure: request deletion of your personal data
  • Right to restrict processing: limit how we use your data
  • Right to data portability: receive your data in a structured, machine-readable format
  • Right to object: object to processing based on legitimate interests or for direct marketing

To exercise these rights, contact us at our contact page.

8. Cookies

We use essential cookies required for the operation of our website and platform. We do not use tracking cookies or third-party advertising cookies. You may manage cookie preferences through your browser settings. For detailed cookie information, please contact us.

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

  • HMAC-SHA256 request signing for all bridge API communications
  • Encryption in transit (TLS 1.2+) for all data transmissions
  • IP allowlisting and rate limiting on API endpoints
  • Regular security audits and dependency updates
  • Access controls restricting internal data access to authorised personnel only

10. International Transfers

Your data may be processed on servers located in the UK, European Economic Area, or the United States. Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

11. Third-Party Links

Our website and services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on our website. The “Last updated” date at the top of this policy will reflect the most recent revision.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us: