Privacy policy

Search Observatory (“we”, “us”) runs Search Observatory, an app that audits websites for search, answer engines and AI Visibility, and gives agencies a client portal (the Observation Deck). This policy explains what we collect, why, who we share it with and the choices you have. It applies to our website, the app and our emails.

Summary

• We use your data to run the service for you and your team. We don’t sell it, rent it or use it for advertising.
• Google data (Search Console, Google Analytics and, once available, Google Business Profile) is read-only, shown only to your workspace and never used to train AI models.
• You can export or delete your data at any time from Settings → Profile, or ask us using the data request form.

What we collect

Account and workspace

Your name, email address and password (stored hashed by our authentication provider), your role, the workspace and company or agency name, team members you invite, and settings you choose.

Websites you add

The address, business name, city, industry and the questions you want AI assistants checked for. To audit a website we read its public pages (the same pages anyone can visit) and store what we find: page titles, descriptions, headings, structured data, text excerpts, scores and recommendations. We also ask AI assistants your questions and store their answers.

Client portal (Observation Deck)

If an agency uses the Observation Deck, we store what the agency and its clients add: client names and emails, messages and comments, documents and files, milestones, invoices, monthly reviews, onboarding answers, contract signatures (typed name, email, time and a one-way hash of the network address) and deposit status.

Payments

Payments are handled by Stripe. We receive the plan, amount, status and Stripe’s customer and subscription references, never your full card number. Agencies taking client deposits use their own Stripe account; we only record whether a deposit was paid.

Usage and technical data

We record how much AI and crawling work each workspace uses (to manage costs and fair use), basic logs needed to keep the service secure and working, and a one-way hash of the network address on public forms to limit spam. Our marketing website uses Google Analytics to understand which pages are useful; it sets analytics cookies. The app itself uses cookies and local storage only to keep you signed in and remember choices like the selected client.

Google user data

You can connect your own Google account to Search Observatory. Each connection is yours: it’s used only for the websites in your workspace, and you can disconnect it at any time.

• Google Search Console (read-only, webmasters.readonly): the list of properties you can see, and for the property you choose for a website, search performance data (searches, clicks, impressions, positions and pages).
• Google Analytics (read-only, analytics.readonly): the list of properties you can see, and for the property you choose, reports such as visits, landing pages, traffic sources and conversions, plus the measurement ID to check your tag setup.
• Google Business Profile (when available, read-only): for the listing you choose, its details (name, categories, address, hours, services, photos and posts), reviews and replies, and performance data (searches, views, calls and direction requests).
• Your Google account email and name (openid, email, profile), to show which account is connected.

How we use it. Only to provide features you can see: reports and charts for your websites, audit recommendations, rising searches (Horizon), the results of content you publish, monthly reviews for your clients, and content ideas and drafts written for your website. Properties must match the website they’re connected to, and the data is shown only to your workspace’s team and, where your agency shares a monthly review, to that client.

AI processing. Some features send excerpts of this data (for example top searches or traffic totals) to AI models through our AI provider so they can write recommendations, drafts or a monthly review for you. These requests are made only to provide that feature, and the data is not used to train AI models.

Limited Use. Search Observatory’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, use it to train or improve generalized AI or machine learning models, or let people read it except with your permission, for security or legal reasons, or when it’s part of providing the service to you.

Storage and removal. Access tokens are encrypted and used only from our servers. Disconnect any time on the Analytics page or in a website’s Search Console tab, or remove access in your Google account permissions. When you disconnect or delete your account we delete the tokens; reports already saved for your websites are deleted with the website or workspace, or on request.

How we use your data

• To provide the service: audits, AI Visibility checks, recommendations, content, the client portal, emails you ask for (for example portal notifications) and payments.
• To keep it secure and working: preventing abuse, fixing problems and monitoring costs.
• To talk to you about your account, and about early access or the product if you asked us to. You can opt out of non-essential emails at any time.

Where privacy laws ask for a legal basis, we rely on our contract with you, our legitimate interest in running and securing the service, and your consent where we ask for it (for example connecting Google).

Who we share it with

Only with the service providers that run Search Observatory for us, under contracts that limit their use of it:

• Supabase: database, sign-in and file storage.
• Cloudflare: hosting and network.
• Lovable: app platform, AI gateway and email sending.
• OpenAI, Google and Anthropic (through the AI gateway): AI models that answer AI Visibility questions and write recommendations and drafts.
• Firecrawl: reading public website pages and web search for competitor checks.
• Stripe: payments.
• Google: the Google APIs you connect, and Google Analytics on our marketing site.

We may also share data if the law requires it, to protect people’s safety or our rights, or as part of a sale or merger of the business (in which case this policy keeps applying).

Agencies and their clients

When an agency adds its clients to Search Observatory, the agency decides what client information goes in and why; we process it on the agency’s behalf. Clients with questions about their data should contact the agency first, or ask us and we’ll pass the request on.

How long we keep it

As long as your account or workspace is active. If a plan is cancelled, the workspace’s data is kept for 30 days in case you come back, then it may be deleted. Deleting your account (Settings → Profile) deletes the workspaces you created right away. Backups roll over within about 30 days. We keep payment records as long as tax law requires.

Your choices and rights

You can see and edit most of your data in the app. You can also:

• Get a copy: Settings → Profile → Export my data.
• Delete your account: Settings → Profile → Delete my account.
• Disconnect Google: as described above.
• Anything else (correction, restricting or objecting to a use, or a request you can’t make in the app): use our data request form or email privacy@searchobservatory.com. We reply within 30 days.

Depending on where you live (for example under the GDPR or California law) you may have further rights, including complaining to your data protection authority. We don’t sell or share personal information for cross-context behavioral advertising.

Security

We use encryption in transit, encrypted storage of connection keys, row-level access rules so each workspace only sees its own data, signed and verified webhooks, and limits that stop runaway use. No system is perfectly secure; if we learn of a breach affecting your data we’ll tell you as the law requires.

International transfers

Our providers may process data in the United States and other countries. Where required, we rely on standard contractual clauses or similar safeguards.

Children

Search Observatory is a business tool and isn’t meant for anyone under 16. We don’t knowingly collect their data.

Changes

We’ll update this page when things change and show the new date at the top. For important changes we’ll tell account owners by email or in the app.

Contact

For privacy questions or requests, use our data request form or email privacy@searchobservatory.com.