Privacy Policy

Effective date: August 19, 2026
Last updated: August 19, 2026
Version: 1.0

This Privacy Policy explains how David Kuyk, an independent SEO and AEO consultant operating as a sole proprietor (“David Kuyk,” “I,” “me,” or “my”), collects, uses, shares, stores, and protects information in connection with the website https://davidkuyk.com/ (the “Site”) and the consulting services I provide (the “Services”).

By using the Site, contacting me, engaging my Services, or connecting a bank account through Stripe, you agree to the practices described in this Policy. If you do not agree, please do not use the Site or the Services.

1. Quick summary

  • I am a one-person consulting practice. I collect only what I need to answer inquiries, deliver SEO work, and get paid.
  • I do not sell your personal information, and I do not share it for cross-context behavioral advertising.
  • Payments are processed by Stripe. I never see or store your full card number.
  • If you choose to pay by ACH bank debit, Stripe Financial Connections may be used to verify your bank account. That data is used only to set up and process the payments you authorize — never for marketing, never for sale, and never for any purpose you have not been shown at the time you connect.
  • You can disconnect a linked bank account or request deletion of your data at any time: david@davidkuyk.com.

2. Information I collect

2.1 Information you give me directly

  • Contact and inquiry information — name, email address, phone number, company or website URL, and anything you choose to write in a contact form, email, text message, or call.
  • Client engagement information — business name, billing contact, business address, project details, and the goals and background you share while we work together.
  • Scheduling information — if you book a call, the details you provide to the scheduling tool.

2.2 Payment information

Payments for retainers, audits, and website projects are processed by Stripe, Inc. (“Stripe”). Stripe collects and processes your payment credentials directly. I receive only limited transaction information from Stripe — such as the invoice, the amount, the date, the payment status, the last four digits of a card or bank account, and the billing name and email. I do not receive or store full payment card numbers or full bank credentials.

Stripe’s handling of your information is governed by the Stripe Privacy Policy.

2.3 Bank account information (Stripe Financial Connections)

See Section 3 for a full description of what is collected through Stripe Financial Connections, why, how it is used and shared, how long it is kept, and how to disconnect.

2.4 Information collected automatically

  • Usage and device data — IP address (often truncated or anonymized by the analytics provider), browser type and version, operating system, device type, referring URL, pages viewed, links clicked, and time spent on pages.
  • Cookies and similar technologies — small files and identifiers used to keep the Site working and to understand how it is used. See Section 6.
  • Server logs — my hosting provider records standard access logs for security and troubleshooting.

2.5 Client account access

To perform SEO and AEO work, clients often grant me delegated access to their own accounts and properties — for example Google Search Console, Google Analytics, Google Business Profile, Google Tag Manager, WordPress or other CMS admin, and third-party SEO platforms. Any personal information contained in those accounts belongs to the client. I access it only to perform the agreed Services, I do not copy it out of those systems except as needed to produce the client’s deliverables, and my access can be revoked by the client at any time.

3. Stripe Financial Connections and bank account data

I use Stripe Financial Connections, a service provided by Stripe, to let clients securely link a bank account. This section describes that practice in detail. It applies only if you choose to link a bank account; linking is optional, and alternative payment methods are available.

3.1 Why I ask you to link a bank account

I request access to your financial account data for the following purposes, and only these purposes:

  1. To verify your bank account and set up ACH Direct Debit payments — so that invoices, retainers, and project fees you authorize can be debited from the correct account without you having to manually enter and re-verify account and routing numbers.
  2. To confirm ownership of the account — to confirm that the account you are linking belongs to you or your business, which helps prevent fraud, mistaken debits, and unauthorized use.
  3. To check account balance status before initiating a debit — to reduce failed payments, returned debits, and the fees and rescheduling that follow from them.

Separately, I link my own business bank account to Stripe to receive payouts of funds collected on my behalf. That connection involves my account data, not yours.

3.2 What data is collected

When you link an account, Stripe presents an authorization screen that names the specific categories of data being requested for that connection. Depending on what you authorize, the data may include:

  • Account details — financial institution name, account type, account nickname, and account and routing numbers (a tokenized reference and the last four digits are what I see).
  • Account ownership details — the names, mailing addresses, email addresses, and phone numbers associated with the account, as held by your bank.
  • Balances — current and available balance information.
  • Transactions — transaction history for the linked account, where you have specifically authorized it.

You enter your online banking credentials directly with your financial institution or with Stripe’s secure connection flow. I never see, receive, or store your online banking username, password, PIN, or multi-factor authentication codes.

3.3 How I use this data

I use financial account data solely to:

  • Verify the account and enroll it for the ACH debits you have authorized;
  • Initiate the specific payments you have authorized, on the schedule stated in your invoice or engagement agreement;
  • Confirm account ownership and detect or prevent fraud, error, and unauthorized transactions;
  • Check available balance before initiating a debit in order to reduce failed payments;
  • Provide customer support relating to a payment, a returned debit, or a refund;
  • Maintain records required for accounting, tax, and legal compliance.

3.4 What I do not do with this data

  • I do not sell, rent, or license your financial account data.
  • I do not use it for marketing, advertising, audience building, profiling, or lead generation.
  • I do not use it to make credit, lending, insurance, or employment decisions.
  • I do not share it with data brokers, analytics vendors, or advertising networks.
  • I do not use it for any purpose that was not disclosed to you in the Stripe consent flow at the time you connected the account.

If I ever need access to a new category of financial data, or need to use your data for a new purpose, I will surface that request through Stripe’s consent flow and obtain your authorization before doing so. Authorization to access account data is separate from your authorization to debit your account; each is requested and granted separately.

3.5 Who this data is shared with

  • Stripe — Stripe operates the connection, receives the data from your financial institution, and processes the resulting payments. Stripe’s use of the data is governed by the Stripe Privacy Policy and the Stripe Privacy Policy for End Users.
  • Your financial institution — which authenticates you and supplies the permissioned data.
  • My accountant and tax advisors — who may see transaction records (amount, date, payer) as part of routine bookkeeping. They do not receive account credentials or transaction history from your bank.
  • Legal and regulatory recipients — where disclosure is required by law, subpoena, or lawful government request, or is necessary to establish or defend legal claims.

No other third party receives your financial account data.

3.6 How long it is kept

I keep financial account data only as long as necessary for the purposes above. In practice:

  • Active connections are retained for as long as you have an ongoing payment arrangement with me.
  • Balance and transaction data is used at the time of the transaction and is not warehoused for later analysis.
  • Connections are disconnected promptly after your engagement ends or after your final payment clears, unless you have asked me to keep the account on file for future work.
  • Transaction records (invoice, amount, date, payment method last four) are retained for the period required by tax and accounting law, generally seven years.

I maintain internal procedures to review linked accounts periodically and remove those that are no longer needed.

3.7 How to disconnect a linked account

You may revoke access to a linked financial account at any time. You can:

  • Email david@davidkuyk.com and ask me to disconnect the account. I will action the request promptly, and in any event within 30 days;
  • Manage or revoke connections yourself through Stripe at Stripe’s Financial Connections support center, or through the Link account portal at link.com if you saved your bank details to Link;
  • Contact your financial institution, many of which offer their own dashboard for managing third-party data connections.

Disconnecting stops future data access. It does not automatically cancel a payment already authorized and in flight — contact me if you also want to cancel a scheduled debit. If you believe an account was connected without your authorization, or you want to file a complaint about how financial data has been handled, email david@davidkuyk.com and I will investigate and respond.

4. How I use information generally

  • To respond to inquiries and provide quotes or proposals;
  • To deliver, manage, and improve the Services;
  • To send invoices and collect payment;
  • To communicate about a project, including status updates and deliverables;
  • To send occasional business updates, where you have opted in — you can unsubscribe at any time;
  • To operate, secure, maintain, and improve the Site;
  • To detect and prevent fraud, abuse, and security incidents;
  • To comply with legal, tax, and accounting obligations, and to establish or defend legal claims.

Where a legal basis is required (for example, under the GDPR), I rely on: performance of a contract; my legitimate interests in running and securing a small consulting practice; your consent, where asked for; and compliance with legal obligations.

5. Service providers I share information with

I do not sell personal information. I share it only with service providers who process it on my behalf under contract, and only as needed:

  • Stripe — payment processing and Financial Connections.
  • Website hosting provider — hosting the Site and storing form submissions.
  • Google (Analytics, Tag Manager) — website analytics and tag management.
  • Email and productivity providers — email, calendar, and document storage.
  • Scheduling software — if you book a call.
  • Accounting and tax professionals — bookkeeping, tax filing.
  • Legal and professional advisors — where necessary.

I may also disclose information if required by law or valid legal process, or in connection with a sale or transfer of the practice — in which case I will give notice before your information becomes subject to a different privacy policy.

6. Cookies and analytics

The Site uses cookies and similar technologies for:

  • Strictly necessary purposes — keeping the Site secure and functional.
  • Analytics — Google Analytics, deployed via Google Tag Manager, to understand traffic sources and page performance in aggregate.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. Blocking cookies may affect how parts of the Site function. I honor Global Privacy Control (GPC) signals where my systems receive them.

7. Data retention

  • Inquiries that do not become engagements — up to 24 months, then deleted.
  • Client project records and correspondence — for the engagement plus up to 7 years, for tax, accounting, and legal-claim purposes.
  • Financial account connections — as described in Section 3.6.
  • Analytics data — per the retention setting configured in Google Analytics, currently 14 months.
  • Email newsletter subscriptions — until you unsubscribe.

8. Security

I use reasonable administrative and technical safeguards appropriate to a sole practitioner handling this type of data: encryption in transit (HTTPS/TLS), multi-factor authentication on business accounts, a password manager with unique credentials, limited access to client systems, and reliance on Stripe’s PCI-compliant infrastructure so that payment credentials never touch my own systems. No method of transmission or storage is completely secure, and I cannot guarantee absolute security. If a breach affecting your personal information occurs, I will notify you and any required regulator as the law requires.

9. Your privacy rights

Depending on where you live, you may have the right to:

  • Know what personal information is collected about you and access a copy of it;
  • Correct inaccurate personal information;
  • Delete personal information, subject to legal retention requirements;
  • Obtain your data in a portable format;
  • Opt out of the sale or sharing of personal information, or of targeted advertising — note that I do not sell or share personal information or run targeted advertising;
  • Withdraw consent where processing is based on consent;
  • Not be discriminated against for exercising these rights;
  • Appeal a decision I make about your request, and to lodge a complaint with your state attorney general or supervisory authority.

These rights are provided under laws including the Colorado Privacy Act, the California Consumer Privacy Act as amended, comparable laws in other U.S. states, and the EU/UK GDPR where applicable.

To exercise a right, email david@davidkuyk.com with a description of your request. I may need to verify your identity, typically by confirming details already in my records. I will respond within 45 days, and will tell you if I need an extension. If I deny a request, you may appeal by replying to my response; I will answer the appeal within 45 days and explain how to escalate to your regulator.

If you are a client’s customer whose data appears in a system I access on that client’s behalf, please direct your request to that business, which is the controller of that data. I will assist them in fulfilling it.

10. Children’s privacy

The Site and Services are intended for businesses and adults. I do not knowingly collect personal information from anyone under 16. If you believe a child has provided information, contact david@davidkuyk.com and I will delete it.

11. International transfers

I operate from the United States, and information is processed and stored in the United States. If you access the Site from outside the U.S., you understand that your information will be transferred to and processed in the United States, which may have different data protection rules than your home jurisdiction. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses entered into by my service providers.

12. Third-party links

The Site may link to third-party websites and tools. I am not responsible for their privacy practices. Review their policies before providing information.

13. Changes to this Policy

I may update this Policy as my practice, tools, or the law changes. When I do, I will revise the “Last updated” date and version number above. Material changes — including any change to how financial account data is collected, used, or shared — will be communicated by email to active clients before taking effect, and where required I will seek renewed authorization through Stripe’s consent flow. I retain dated copies of every prior version of this Policy.

14. Contact

David Kuyk — SEO & AEO Consulting (sole proprietor)
Boulder, Colorado, United States
Email: david@davidkuyk.com
Web: https://davidkuyk.com/

For questions specifically about bank account connections, write to the same address with “Financial Connections” in the subject line.