Privacy Policy

Information we collect

Account and workspace data: name, business email address, password hash, invitation and sign-in records, organization and project names, website address, market and time zone, team membership, role and permissions, settings, and security or activity logs. We do not store your account password in readable form.

Waitlist and contact requests: name, email address, website address when supplied, and the message sent through the contact form. We use these details to respond to questions and manage early-access requests. Do not include sensitive personal information in a contact message.

Information you add: business facts and their sources, services, prompts, audit requests, notes, recommendations, drafts, review decisions, assigned tasks, and website handoff records. Workspace content is visible only to members with access to that workspace and permissions for the relevant feature.

Website audit data: the submitted website address, pages visited within the configured crawl limit, HTTP status and technical response information, page URLs, titles, descriptions, headings, canonical and indexing signals, and audit findings. The crawler does not save the fetched page's full HTML as a permanent page archive. It may temporarily process page content in memory to generate the audit findings.

Public website snapshot: when someone enters a website in the public snapshot tool, Signalstead uses that address to request a small sample of publicly accessible pages and returns an SEO, AEO-readiness, and GEO-readiness summary. The URL and report are not saved to a customer workspace or stored as a report by this feature. The service temporarily uses the request's client address in memory to enforce abuse limits; ordinary hosting or proxy security logs may also apply. This tool does not send a request to an AI provider or measure AI mentions and citations.

Usage and security data: request and error records, timestamps, feature usage, and information needed to detect abuse, diagnose failures, protect accounts, and maintain the service. Do not submit sensitive personal information about website visitors or other people into business facts, prompts, or draft fields.

Website analytics and cookies

Optional Google Analytics and Microsoft Clarity load only after a visitor accepts analytics in the Cookie settings notice. Visitors can reject optional analytics or change their choice using Cookie settings. Essential storage remains active to keep the service working.

Google Analytics may collect page views and route, visit time, referring page, browser and device information, language, approximate location, and a pseudonymous browser identifier. We configure it not to send URL query strings, disable Google Signals and ad-personalization signals, and do not use it for advertising. Microsoft Clarity records interaction events such as clicks and scrolling and captures page structure for session playback and heatmaps. Clarity masks privacy-sensitive fields by default, and authenticated workspace and setup screens are marked for content masking. Google and Microsoft process this visit data under their own terms and privacy policies. Details: support.google.com/analytics/answer/11397207, policies.google.com/privacy, learn.microsoft.com/en-us/clarity/clarity-data, and clarity.microsoft.com/privacy.

The Google Analytics site tag and Clarity project measure visits to Signalstead itself. They are separate from the optional GA4 connection a workspace owner can authorize, which reads aggregate reports from a customer-selected property.

Google user data and the Google APIs we use

Google connections are optional and require an authorized workspace member to sign in with Google and choose the properties Signalstead may access. Search Console uses the webmasters.readonly scope to read date-level clicks, impressions, click-through rate, average position, privacy-filtered search-query summaries, and selected URL inspection results such as indexing, robots, canonical, and rich-result status. GA4 uses analytics.readonly to read aggregate daily Organic Search and identifiable AI-referral session totals. The optional Business Profile integration uses business.manage only when you separately connect an eligible profile; it reads daily Search and Maps impression totals for the selected location.

Signalstead does not use these Google connections to read or write Google Ads, manage websites, change Search Console settings, or access individual site visitors. The integrations do not request names, email addresses, user-level analytics, calls, bookings, messages, direction requests, website clicks from Business Profile, conversion events, or revenue. Search Console may omit anonymized queries and low-volume terms; query summaries are filtered before storage and are not a complete record of all searches.

We use Google API data only to provide the visibility reports, audits, and topic or content suggestions that a workspace user requests. Search Console query summaries may be used as topic signals in a user-requested draft or research operation. When that happens, the selected query/topic and the minimum relevant workspace context may be sent to the AI provider configured for that operation. We do not use Google user data for advertising, sell it, or use it to train generalized AI or machine-learning models. Google data is not transferred to an AI provider for model training. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Google refresh tokens are encrypted on the server and are not returned to the browser. Authorized workspace members may see the resulting reports and summaries within their workspace. Other disclosures are limited to service providers needed to deliver the requested feature, protect the service, comply with law, or follow your explicit instructions. We do not sell Google user data or share it with data brokers.

Bing Webmaster data

Bing Webmaster is a separate, optional connection. When an authorized workspace member connects a Bing account, Signalstead requests read access to registered site data and imports aggregate clicks, impressions, and privacy-filtered query summaries for a matching verified site. Bing data appears with its own provider label and remains separate from Google’s stored metrics. Combined views sum only compatible clicks and impressions over a shared date window; differences in reporting coverage are shown.

Bing query summaries may be used as topic signals in a user-requested recommendation or content draft, alongside Google Search Console data. They are signals about search activity, not proof of customer intent, AI visibility, or ranking outcomes. Bing refresh tokens are encrypted on the server and are not returned to the browser. Disconnecting Bing stops future access and retains previously imported Bing history; a workspace member can also revoke the app’s access in Bing Webmaster Tools.

How we use information

• Create and secure accounts, authenticate users, send invitations and essential service email, and administer workspace roles.
• Run user-requested website audits, Google data syncs, reports, recommendations, AI visibility checks, and content workflows.
• Show workspace information and results to authorized members of that workspace.
• Protect, troubleshoot, maintain, and improve the service, including detecting security incidents and preventing abuse.
• Manage subscription access and reconcile Paddle billing events. Paddle collects payment details directly; Signalstead receives subscription and transaction identifiers, plan and status, billing periods, and limited transaction metadata, not full card numbers.

Service providers and sharing

We use service providers to operate features you choose: Google APIs for connected Google properties and Google Analytics for site-visit measurement; Microsoft Clarity for consented site interaction analytics; Bing Webmaster APIs for the optional Bing site connection; the AI provider configured by the workspace for requested AI generation or research; Resend for invitation and account email delivery; Paddle for checkout, payment processing, and subscription management; and hosting, database, monitoring, and security providers to run the application. Each receives information needed for its function and handles it under its own terms and privacy practices. We do not authorize providers to use Google user data to train generalized AI models.

We may disclose information if required by law, to protect users or the service, or as part of a business transfer with appropriate safeguards. We do not sell personal information or Google user data.

Storage and retention

Account, workspace, audit, recommendation, and content records are kept while the workspace is active so the service can provide its history and functions. Imported Google metrics are retained with workspace reporting history; disconnecting Google stops future access but does not erase previously imported metrics. A later Search Console sync replaces the current query summary and updates the covered metric dates, while older metric dates outside the sync window may remain. OAuth credentials are removed when the integration is disconnected; Signalstead also asks Google to revoke the grant where possible.

Waitlist requests and contact messages are stored in the platform database for staff to manage invitations and respond. They remain until removed by the platform operator or a verified deletion request is processed.

The service does not currently enforce a fixed expiry period for workspace content, imported Google metrics, or activity records. These records may remain in the active service for the life of the workspace or until a verified deletion request is processed. The service also does not yet have an automated workspace-deletion or backup-expiry workflow; deleted records in backups may persist until the deployment's backup retention period expires. Billing and transaction records may be retained as required for accounting, dispute resolution, and legal obligations. We will update this notice if the retention periods or deletion controls change.

Google Analytics event and user-level data is retained according to the retention settings of the Analytics property, which may be changed by that property's administrator. Analytics cookie expiry follows the settings described in the Website analytics and cookies section and may also be limited by the visitor's browser.

Access, correction, export, deletion, and revocation

Workspace owners and administrators can review workspace information, manage member access, and use the available workspace export. You can correct information through workspace settings where that option is available or ask us to correct it. The service does not currently provide a self-service delete-workspace control; email [email protected] from an account address and identify the workspace and data you want removed. We may ask for reasonable proof that you control the account. Deletion requests are handled manually and may require up to 30 days to remove data from active systems; backup copies are subject to the deployment's configured backup expiry and may remain longer. Legal, security, or accounting requirements may require some records to be retained.

To stop future Google data access, use Disconnect in workspace settings or remove Signalstead from your Google Account's third-party connections. Disconnecting removes the saved Google credential and requests token revocation where possible, but does not delete imported historical metrics; request their deletion separately. You may also stop using optional integrations at any time. Rights available to you depend on applicable law, and this policy does not limit rights that cannot lawfully be limited.

Security

We use server-side access controls, workspace-scoped permissions, encrypted storage for Google OAuth refresh tokens, and encrypted connections in transit where supported. Access to customer information is limited to the workspace team and authorized service personnel who need it to operate, support, or secure the service. No internet service can guarantee absolute security. Contact us promptly if you believe your account or data has been accessed without authorization.

Children, international processing, and changes

Signalstead is designed for businesses and professional users and is not directed to children. The service and its providers may process information in countries other than your own, including Nepal and the regions where selected providers operate; those countries may have different data-protection rules. We will update this page when our data practices materially change and show the revised effective date here.

Privacy contact and developer

For privacy questions, access, correction, or deletion requests, contact MarginTop Solutions Pvt. Ltd. at [email protected] or visit https://www.margintopsolutions.com/contact. Postal address: Diamond Marga, Kupondole, Lalitpur, Bagmati Province, Nepal. Phone: +977-9845926945. MarginTop Solutions, Nepal designed and developed Signalstead. This contact handles privacy inquiries for the service.