Privacy policy

Who we are

PeachFuzz Media provides managed local SEO for local businesses and an SEO platform for agencies.

The data controller for this website is Peach Fuzz Media Ltd (trading as PeachFuzz Media), a company registered in England and Wales with company number 15845253. Our registered address is 25 Inver Road, Lubbesthorpe, Leicester, LE19 4DL, England.

In this policy, “we”, “us” and “our” mean that company. “You” means anyone who visits peachfuzzmedia.com or sends us an enquiry.

What this policy covers

This policy covers the public website at peachfuzzmedia.com, including the enquiry form.

If you become a customer, or sign in to the PeachFuzz Media platform at app.peachfuzzmedia.com, the data we handle to provide that service is covered by your customer agreement and any data processing terms that go with it. The one exception is data from Google accounts you connect to the platform, which is covered by the section "Google user data" below.

What we collect

When you send us an enquiry, we collect what you type into the form:

• your name and email address;
• your phone number, if you choose to give it;
• your business or agency name, website and town;
• the plan you are interested in, or for agencies, roughly how many clients you look after;
• your message;
• the page of our website you sent the form from.

To stop spam and limit repeated submissions, we also record a scrambled (hashed) version of your IP address and your browser’s user agent (a short description of the browser and device you are using). The scrambled version is made with a secret key held only on our server, so it cannot be turned back into your IP address without that key. We delete both after 30 days.

If you accept analytics cookies, Google Analytics collects information about how you use the site. The cookie policy explains this in more detail. If you do not accept, Google Analytics does not load.

Please do not include sensitive information, such as health details, in your message. We do not need it to reply.

How we use it and our lawful basis

UK data protection law requires us to have a lawful basis for each use of your information. Ours are:

• Replying to your enquiry, preparing a quote and following up on it: our legitimate interest in responding to people who contact us and in running our business. You would expect us to use your details this way when you send us a message.
• Preventing spam and abuse of the form: our legitimate interest in keeping the website and our inbox secure.
• Website analytics with Google Analytics: your consent, given through the cookie banner. You can withdraw it at any time.
• Providing services if you become a customer: to perform our contract with you, or to take steps you ask for before entering into one.
• Keeping records we are required to keep, such as invoices: to comply with our legal obligations.

We do not sell your information. We do not add you to a marketing list unless you ask us to.

Who we share it with

We use a small number of service providers to run the website. They handle your information on our behalf and only under our instructions:

• Supabase, which stores enquiries in a database hosted in the European Union (Ireland).
• Vercel, which hosts the website and the platform. Its servers that run our code are in Dublin, and pages are delivered through its global network.
• Resend, an email provider, which sends us a notification email when a new enquiry arrives, and sends emails from the platform such as monthly reports and password resets.
• Stripe, which takes card payments for our packages and agency plans. It receives the name, email address, business details and card details entered when paying. We never see or store full card numbers.
• Cloudflare Turnstile, which checks that the agency sign-up form is being filled in by a person and not a bot. It receives technical details about your browser and device and your IP address, and tells us only whether the check passed.
• Google, which provides Google Analytics, only if you accept analytics cookies.

We may also share information if the law requires it, or with professional advisers such as accountants and lawyers where needed.

Google user data

The PeachFuzz Media platform can connect to a business’s Google account, but only when the business, or someone it has authorised, signs in with Google and gives permission. This section explains what we access and what we do with it.

What we access:

• Google Search Console (read-only): search performance for the websites you choose, such as the searches people used, clicks, impressions and average position by page, date and type of rich result, and Google’s inspection of the site’s main pages (whether they are indexed, and the rich results Google found on them, with any errors).
• Google Business Profile: the profiles you choose, their reviews and their posts, and the ability to publish posts: the posts we publish for you.
• Google Analytics (read-only): for the property you choose, visits to the website by date, traffic source and landing page, the number of visitors, engaged visits, and the names and counts of the events the property marks as key events (such as contact forms sent). These are totals; we do not access information about individual visitors.
• Google Ads (read-only in practice): for the Ads account you choose, its name, currency and time zone; each campaign’s name, type, status, daily cost, impressions and clicks; the account’s conversion actions (such as calls and contact forms) with their daily counts and values; how many searches the ads could have shown for but missed; and the top search terms that led to clicks. Google only offers a single permission for Google Ads, which would also allow changes, but we only read figures: we never create, change or pause campaigns, budgets, ads, keywords, users or billing.
• The email address of the Google account you connected, so we can show which account is linked.

How we use it: only to provide the platform’s features to the business that connected the account. That means showing search, website visit, advertising and profile data in the dashboard, finding improvements to suggest, writing the monthly report, and publishing Business Profile posts for the business. Some of this data, such as a search term or page title, may be sent to our AI provider (Anthropic) to draft a suggestion, which a person then reviews. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.

Where it is kept: Google’s access token is stored encrypted in Supabase Vault, and the data we copy from Google is stored in our Supabase database in the European Union (Ireland). Staff at the business’s agency, and the people at the business it invites to its own dashboard, can see it in the platform. We do not share it with anyone else, except the service providers listed above that help us run the platform, or if the law requires it.

Disconnecting and deletion: you can disconnect Google at any time on the client’s Search, Analytics, Ads or Profile tab in the platform, or remove PeachFuzz Media’s access from your Google account’s security settings. Disconnecting deletes the stored token straight away, and revokes our access at Google unless the same Google account is still connected for another of your clients. We keep copied Search Console, Google Analytics and Google Ads figures for up to 16 months. To have the copied data deleted sooner, contact us and we will delete it within 30 days.

PeachFuzz Media’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Transfers outside the UK

Enquiries are stored in the European Union, which the UK recognises as giving adequate protection. Some of our providers, including Vercel, Resend, Stripe, Cloudflare and Google, are based in or may process data in the United States or other countries.

Where that happens, we rely on the safeguards the law allows, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK–US data bridge, depending on the provider: the UK–US data bridge where a US provider is certified under it, and otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as set out in each provider’s data processing terms.

How long we keep it

• Enquiries: 24 months after our last contact with you, unless you become a customer.
• Hashed IP addresses and browser user agents used for spam prevention: 30 days, deleted automatically.
• Customer records: for as long as you are a customer, and afterwards for as long as the law requires, for example for tax records.
• Google Analytics data: 14 months, after which Google deletes it automatically.

After these periods we delete the information or make it anonymous.

Keeping it safe

The website uses an encrypted connection (HTTPS). Enquiries are stored in a database that only authorised staff can access, and the form is protected against automated abuse.

No system is completely secure, but we take reasonable steps to protect your information and will tell you and the regulator about a serious breach where the law requires it.

Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to limit how we use it;
• object to us using it on the basis of legitimate interests;
• ask us to transfer information you gave us to another organisation, where this applies;
• withdraw your consent to analytics at any time, using the “Cookie settings” link at the bottom of every page.

To use any of these rights, email us at hello@peachfuzzmedia.com. We will reply within one month. There is usually no charge.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change, we will make it clear on this page.