Privacy Policy

Google Account and SEO Reporting Data

Google connections are optional. An authorized agency owner connects a Google Account and selects the client's Search Console site, Google Analytics 4 property, or Google Business Profile location from those available to that account. We use Google data only to provide client reporting, including dashboards, monthly imports, comparisons, and optional monthly email reports. Google passwords are entered on Google's authorization pages, not in the CRM.

What we access

Search Console and Analytics use read-only permissions. We read accessible property names and identifiers, then import monthly aggregate results for the selected client source: search clicks, impressions, click-through rate, average position, queries and pages; and Analytics sessions, active users, engaged sessions, page views, key events and acquisition channels. These integrations do not change Search Console or Analytics settings or import individual Analytics visitor identities.

Business Profile connects separately. We read accessible business accounts and locations, the selected location's name, address and identifiers, profile impressions, website clicks, call-button clicks, directions requests, Google's rating and review-count summary, and up to ten latest updated reviews. Saved reviews include rating, comment, update date and whether a reply exists, but exclude reviewer names, photos and reply text. Review comments can still contain personal information. Google calls this permission business.manage and describes it as management access; the CRM currently uses it only to read data, not edit listings, publish posts or write replies. These integrations do not read Gmail or Google Calendar.

Who can access the data

Imported results belong to the selected client workspace and are accessible to agency owners and authorized workspace members. Clients cannot view another client's workspace. Agency owners may send reports to authorized, configured recipients, including recipients without a CRM login. Google API requests use HTTPS, and OAuth refresh credentials are encrypted before database storage; those credentials are not exposed in page-facing connection details.

We use Vercel for application hosting and processing, Neon for database storage, Clerk for application authentication, and Twilio SendGrid for optional report-email delivery. These providers process the information needed for their service. SendGrid processes report contents and recipient information; the CRM's delivery ledger stores delivery metadata rather than complete email bodies. Recipients and email providers may retain copies of delivered reports.

Retention and your choices

We retain Search Console and Analytics snapshots for historical client reporting. They do not currently expire automatically after a fixed period. Business Profile content uses a temporary cache: cached content becomes unavailable after 29 days, and a daily cleanup removes expired active-cache content. Selected resource identifiers and connection metadata are retained while the connection is configured. This cache schedule does not erase previously delivered email reports or copies in recipients' systems or provider backups.

You can revoke future Google access in your Google Account's third-party connections settings. Revocation does not automatically delete credentials or reporting data already stored in the CRM, and it may affect multiple Google features using the same authorization. The CRM's Business Profile disconnect control removes that workspace's Business Profile credential and cache; it does not delete the Google listing, revoke Google permissions, or disconnect Search Console and Analytics.

For Google-data access, disconnection or deletion requests, email hello@growthbco.com and identify the client workspace. Do not send passwords or tokens. Search Console and Analytics do not currently have an in-app disconnect or automatic historical-data deletion control; requests are handled through support after appropriate verification. Deleting CRM data does not recall emails already delivered to recipients.

Limits on Google data use

We do not sell Google data, use it for advertising, or use it to train artificial intelligence or machine-learning models. Access and sharing are limited to the client-reporting purposes described here and the providers and authorized recipients needed to deliver those features.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.