Xenro SEO Agent Privacy Policy

Effective 15 October 2026. This policy describes Xenro SEO Agent, operated by Xenro Enterprise ("Xenro"). Contact: [email protected].

Information processed

When a site uses managed workflows, the plugin sends Xenro's runner the site URL, tenant identifier, a hashed licence identifier, request identifiers, requested operation, and relevant configuration. Configuration includes business descriptions, audiences, locations, approved claims, brand voice, topics, publishing preferences, and model selection.

Keyword requests include seed keywords, keyword lists, language, and, where relevant, a domain being researched. Research results can include keywords, search-volume estimates, difficulty, cost-per-click estimates, intent, search-result URLs, and related questions.

For content generation, the runner can receive site details, article titles, URLs, excerpts, dates, categories and status, product information, media references, and editorial feedback. Article context can include draft, pending, scheduled, and private posts as well as published posts. Do not put confidential or unnecessary personal information in content or instructions supplied for generation.

Requests also use authentication signatures and, for article jobs, a temporary job token to allow the runner to obtain context and return results. The ordinary job payload contains the AI provider's name and model, not its API key.

Why information is used and who receives it

Information is processed to authenticate requests, validate licences, research keywords, prepare briefs, generate and check content, deliver results to WordPress, and track usage and errors.

Keyword queries are currently sent to DataForSEO through Xenro's runner. Content prompts and relevant context are sent to the site's configured AI provider. Supported configurations include OpenAI, Anthropic, Google Gemini, and compatible model endpoints. Depending on configuration, the runner coordinates generation through WordPress's provider bridge or the site generates content locally. Provider processing and retention depend on the selected service and account configuration.

Google Ads integration

Xenro SEO Agent uses the Google Ads API only for keyword research. It sends seed keywords, a location and a language, and receives keyword ideas with historical search-volume and competition figures. Requests go through Xenro's own Google Ads account. Site owners never sign in with Google, and the app never reads anyone else's Google or Google Ads account. It does not create or change ads, campaigns, bids or budgets. Results are handled like other research data: cached on Xenro's runner for reuse for up to 30 days and stored in the client's WordPress. The target keywords and related questions chosen from them go into article briefs for the configured AI provider; search-volume figures do not. Until this integration is live, keyword research uses DataForSEO.

The cache freshness and deletion rules are explained below; a 30-day reuse period is not a guaranteed deletion deadline.

Storage and retention

The plugin stores research records, topic queues, settings, job information, and generated content in the client's WordPress installation. The runner also stores keyword responses in a shared cache: matching research requests may reuse a cached response across clients. Cache keys use the operation and query parameters, rather than the client's identifier. Licence and client usage records are handled separately.

Keyword responses are valid for reuse for 30 days; search-result responses are valid for 14 days. These are freshness periods, not guaranteed deletion deadlines. The workflow removes entries older than 31 days after a successful fetch; without another successful fetch, older entries can remain. The runner also maintains monthly usage counters.

Runner job records are deleted after 14 days; occasional manual database backups are deleted when no longer needed. Job records can contain full payloads, including business details and post excerpts. There are no scheduled runner database backups. Manual dumps may contain records subsequently pruned from the live database; the 14-day rule does not automatically delete those backup copies.

WordPress content and research records remain until removed by the site administrator or through an agreed cleanup. Uninstalling the plugin does not guarantee deletion of all research records or published content. The client's hosting backups and AI or research providers' records follow their respective configurations and retention policies.

Controls and requests

Site administrators can disable scheduled workflows, change publishing settings, and manage content in WordPress. Contact Xenro to request access, correction, or deletion of information held by the managed service, identifying the relevant site. Do not include passwords or private keys in a request. Stopping future processing does not automatically erase existing content, caches, or backups.

Security and changes

The managed client requires HTTPS and signs requests. Access credentials should be kept private. No system can guarantee absolute security. Material changes to processing will be reflected in an updated policy before the new processing begins.