Privacy Policy

Cendol AI is operated by SWH Alpha Pte Ltd, a company registered in Singapore. In this policy, “we”, “us”, and “Cendol AI” refer to SWH Alpha Pte Ltd. “You” refers to any individual or entity that uses our service.

Cendol AI is an AI-powered search visibility optimization service. It helps website owners improve their presence across Google Search, AI Assistants, AI Search Results, and Voice Search through an edge proxy that automatically optimizes website HTML.

2.1 Account Information

When you sign up via Google OAuth, we receive and store your email address, full name, and profile avatar URL from your Google account. We do not store your Google password.

2.2 Google Search Console Data

When you connect your Google Search Console (GSC) account, we request the webmasters.readonly OAuth scope. We store your OAuth refresh token (protected by infrastructure-level encryption at rest) to periodically fetch keyword and ranking data on your behalf. Access tokens are short-lived, held only in memory, and refreshed as needed — they are not persisted to our database.

Data we retrieve from GSC includes: search queries, clicks, impressions, click-through rates, and average position for your website’s pages. This data is stored as periodic snapshots to measure SEO performance over time.

2.3 Site Configuration

When you add a site to Cendol AI, we store your domain name, origin server IP address, and Cloudflare hostname configuration details needed to route traffic through our edge proxy.

2.4 SEO Data and AI-Generated Content

We store SEO audit results, AI-generated page content, optimization action logs, and performance metrics associated with your site. This data is used to continuously improve your search visibility.

2.5 Activity Logs

We log actions taken within your account (such as adding a site, running an audit, or changing settings) for debugging and service improvement purposes.

Our edge proxy sits between your website’s visitors and your origin server. It intercepts HTML responses and applies SEO optimizations (such as adding structured data, meta tags, and internal links) in real time.

The proxy does not:

• Inject tracking scripts, pixels, or analytics into your pages
• Set cookies on your visitors’ browsers
• Collect or store any visitor personal data (IP addresses, user agents, etc.)
• Log or retain visitor request data

The proxy only modifies outbound HTML to improve search engine and AI assistant visibility. All visitor traffic passes through and is served without data collection.

We use the data described in Section 2 to:

• Authenticate your account and manage your session
• Fetch keyword and ranking data from Google Search Console on your behalf
• Run SEO audits and generate optimization recommendations
• Generate and serve AI-optimized content for your website
• Measure the impact of optimizations and learn from outcomes
• Send you periodic performance reports via email
• Debug issues and improve our service

We do not sell your data to third parties. We do not use your data for advertising. We do not share your data with other Cendol AI customers.

We use the following third-party services to operate Cendol AI. Each service only receives the minimum data necessary to perform its function.

Cendol AI uses authentication cookies set by Supabase to manage your dashboard session. These are strictly necessary cookies and cannot be disabled while using the service.

We do not use advertising cookies, analytics cookies, or social media tracking cookies on our dashboard.

As noted in Section 3, our edge proxy does not inject any cookies into your website visitors’ browsers.

We retain your account data and associated site data for as long as your account is active. When you delete a site or your account, we perform a soft delete (marking data as deleted) rather than immediately purging it. This allows us to:

• Recover data if a deletion was accidental
• Debug issues that may have occurred before deletion
• Improve our machine learning models with anonymized, aggregated patterns

You may request permanent deletion of your data at any time by contacting us (see Section 11).

We take reasonable measures to protect your data, including:

• Protecting OAuth tokens with infrastructure-level encryption at rest
• Using HTTPS for all data in transit
• Applying row-level security (RLS) in our database to isolate customer data
• Restricting access to production systems to authorized personnel

No system is 100% secure. If we discover a data breach that affects your personal data, we will notify you promptly.

If you are in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection laws, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate data.
• Erasure: Request permanent deletion of your data.
• Portability: Receive your data in a machine-readable format.
• Restriction: Ask us to limit how we process your data.
• Objection: Object to certain types of processing.

For GSC data, Cendol AI acts as a data processor on your behalf (you are the data controller). We process this data only as necessary to provide the service and according to your instructions (connecting GSC, running audits, etc.).

To exercise any of these rights, contact us at the address in Section 11.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email.

Continued use of Cendol AI after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at: