Privacy Policy

1. Information We Collect

Account information: your email address and password (hashed, never stored in plain text) when you register.

Project information: the website URLs you submit for audits, and the technical audit results we generate from crawling them (page titles, meta tags, performance metrics, structured data, and similar publicly-visible technical signals).

Google Account data (only if you connect it): if you choose to connect a Google Account, we access only the specific data needed for the feature you're using: Search Console (search performance, queries, and indexing status for the property you select), Google Analytics 4 (traffic, engagement, and conversion metrics for the property you select), and Google Ads (account and campaign data for the account you select, requested only when you use the campaign builder, never bundled with the Search Console/GA4 connection). We request the minimum scope needed for each feature, and each connection is optional and independent.

Usage data: standard technical logs (IP address, browser type, pages visited) for security and reliability purposes.

2. How We Use Google User Data

Data accessed through Google APIs is used exclusively to provide the specific feature you requested: displaying your real Search Console/GA4 performance in your audit dashboard, and, for Google Ads, reading your accessible ad accounts so you can select one to build a campaign plan for. We do not use Google user data for advertising purposes, do not sell it, and do not share it with third parties except the service providers listed in Section 3, who process it solely on our behalf to deliver the Service.

Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Service Providers We Use

We share data with the following providers only as necessary to operate the Service, each bound to process it only on our instructions:

• OpenRouter, an AI model gateway, to generate audit diagnostics, strategy reports, and campaign content. Site and account data relevant to your request is sent to the AI model selected for that task.
• DataForSEO, to retrieve keyword search volume, competitor, and ranking data.
• Google Cloud Platform, for application hosting and database storage.
• Vercel, for hosting the web application front end.
• LemonSqueezy and NowPayments, to process subscription payments. We do not store your full payment card details ourselves.

4. Data Retention and Deletion

We retain account and project data for as long as your account is active. You can disconnect any Google Account connection at any time from your dashboard (Search Console/GA4 and Google Ads can be disconnected independently of each other), which immediately stops our access and deletes the associated tokens from our database. To request full deletion of your account and all associated data, email us at the address in Section 8.

5. Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and access-controlled infrastructure. Google Account tokens are stored server-side and are never exposed to the browser or to third parties beyond the service providers listed above.

6. Your Rights

You may access, correct, disconnect, or delete your data at any time as described above. If you are located in a jurisdiction with additional data protection rights (such as the EEA/UK or California), you may also have rights to data portability and to object to certain processing, contact us to exercise these.

7. Children's Privacy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect data from children.

8. Changes to This Policy and Contact

We may update this policy from time to time; the "Last updated" date above will reflect any changes. For questions or data requests, contact us at lumismetric@gmail.com.