Privacy Policy

1. Information we collect

Account and workspace data: name, business email address, password hash, invitation and sign-in records, organization and project names, website address, market and time zone, team membership, role and permissions, settings, and security or activity logs. We do not store your account password in readable form.

Information you add: business facts and their sources, services, prompts, audit requests, notes, recommendations, drafts, review decisions, assigned tasks, and website handoff records. Workspace content is visible only to members with access to that workspace and permissions for the relevant feature.

Website audit data: the submitted website address, pages visited within the configured crawl limit, HTTP status and technical response information, page URLs, titles, descriptions, headings, canonical and indexing signals, and audit findings. The crawler does not save the fetched page's full HTML as a permanent page archive. It may temporarily process page content in memory to generate audit findings.

Usage and security data: request and error records, timestamps, feature usage, and information needed to detect abuse, diagnose failures, protect accounts, and maintain the service. Do not submit sensitive personal information about website visitors or other people into business facts, prompts, or draft fields.

2. Website analytics and cookies

Optional Google Analytics and Microsoft Clarity load only after a visitor accepts analytics in the Cookie settings notice. Visitors can reject optional analytics or change their choice using Cookie settings. Essential storage remains active to keep the service working.

Google Analytics may collect page views and route, visit time, referring page, browser and device information, language, approximate location, and a pseudonymous browser identifier. We configure it not to send URL query strings, disable Google Signals and ad-personalization signals, and do not use it for advertising. Microsoft Clarity records interaction events such as clicks and scrolling and captures page structure for session playback and heatmaps. Clarity masks privacy-sensitive fields by default, and authenticated workspace and account setup screens are marked for content masking. Google and Microsoft process visit data under their own terms and privacy policies; see Google's cookie documentation and privacy policy, and Microsoft's Clarity data collection and privacy information.

The Google Analytics site tag is separate from the optional GA4 connection a workspace owner can authorize. That workspace integration reads aggregate analytics reports from a customer-selected property; the site tag measures visits to Signalstead itself.

3. Google user data and Google APIs

Google connections are optional and require an authorized workspace member to sign in with Google and choose the properties Signalstead may access. Search Console uses the webmasters.readonly scope to read date-level clicks, impressions, click-through rate, average position, privacy-filtered search-query summaries, and selected URL inspection results such as indexing, robots, canonical, and rich-result status. Google Analytics 4 uses analytics.readonly to read aggregate daily Organic Search and identifiable AI-referral session totals. The optional Business Profile integration uses business.manage only when you separately connect an eligible profile; it reads daily Search and Maps impression totals for the selected location.

Signalstead does not use these Google connections to read or write Google Ads, manage websites, change Search Console settings, or access individual site visitors. The integrations do not request names, email addresses, user-level analytics, calls, bookings, messages, direction requests, website clicks from Business Profile, conversion events, or revenue. Search Console may omit anonymized queries and low-volume terms; query summaries are filtered before storage and are not a complete record of all searches.

We use Google API data only to provide the visibility reports, audits, and topic or content suggestions that a workspace user requests. Search Console query summaries may be used as topic signals in a user-requested draft or research operation. When that happens, the selected query or topic and the minimum relevant workspace context may be sent to the AI provider configured for that operation. We do not use Google user data for advertising, sell it, or use it to train generalized AI or machine-learning models. Google data is not transferred to an AI provider for model training. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Google refresh tokens are encrypted on the server and are not returned to the browser. Authorized workspace members may see resulting reports and summaries within their workspace. Other disclosures are limited to service providers needed to deliver the requested feature, protect the service, comply with law, or follow your explicit instructions. We do not sell Google user data or share it with data brokers.

Bing Webmaster is a separate, optional connection. When an authorized workspace member connects a Bing account, Signalstead requests read access to registered site data and imports aggregate clicks, impressions, and filtered query summaries for a matching verified site. Bing data remains separate from Google metrics; combined views sum only compatible clicks and impressions over a shared date window and show provider-specific breakdowns. Bing query summaries can inform user-requested content recommendations but are not proof of customer intent, AI visibility, or ranking outcomes. Bing refresh tokens are encrypted on the server and are not returned to the browser. Disconnecting Bing stops future access and retains imported Bing history; workspace members can also revoke access in Bing Webmaster Tools.

4. How we use information

We use information to create and secure accounts; authenticate users; send invitations and essential service email; administer workspace roles; run user-requested website audits, Google data syncs, reports, recommendations, AI visibility checks, and content workflows; show results to authorized workspace members; protect, troubleshoot, maintain, and improve the service; detect security incidents and prevent abuse; and manage subscription access and Paddle billing events.

Paddle collects payment details directly and processes checkout and subscription payments. Signalstead receives subscription and transaction identifiers, plan and status, billing periods, and limited transaction metadata, not full payment card numbers.

5. Service providers and sharing

We use service providers to operate features you choose: Google APIs for connected Google properties and Google Analytics for site-visit measurement; Microsoft Clarity for consented site interaction analytics; Bing Webmaster APIs for the optional Bing site connection; the AI provider configured by the workspace for requested AI generation or research; Resend for invitation and account email delivery; Paddle for checkout, payment processing, and subscription management; and hosting, database, monitoring, and security providers to run the application. Each receives information needed for its function and handles it under its own terms and privacy practices. We do not authorize providers to use Google user data to train generalized AI models.

We may disclose information if required by law, to protect users or the service, or as part of a business transfer with appropriate safeguards. We do not sell personal information or Google user data.

6. Storage and retention

Account, workspace, audit, recommendation, and content records are kept while the workspace is active so the service can provide its history and functions. Imported Google metrics are retained with workspace reporting history; disconnecting Google stops future access but does not erase previously imported metrics. A later Search Console sync replaces the current query summary and updates the covered metric dates, while older metric dates outside the sync window may remain. OAuth credentials are removed when the integration is disconnected; Signalstead also asks Google to revoke the grant where possible.

The service does not currently enforce a fixed expiry period for workspace content, imported Google metrics, or activity records. These records may remain in the active service for the life of the workspace or until a verified deletion request is processed. The service also does not yet have an automated workspace-deletion or backup-expiry workflow; deleted records in backups may persist until the deployment's backup retention period expires. Billing and transaction records may be retained as required for accounting, dispute resolution, and legal obligations. We will update this notice if the retention periods or deletion controls change.

Google Analytics event and user-level data is retained according to the retention settings of the Analytics property, which may be changed by that property's administrator. Analytics cookie expiry follows the settings described above and may also be limited by the visitor's browser.

7. Your access, correction, deletion, and revocation choices

Workspace owners and administrators can review workspace information, manage member access, and use the available workspace export. You can correct information through workspace settings where that option is available or ask us to correct it. The service does not currently provide a self-service delete-workspace control; submit a request through the MarginTop Solutions contact page from an account address and identify the workspace and data you want removed. We may ask for reasonable proof that you control the account. Deletion requests are handled manually and may require up to 30 days to remove data from active systems; backup copies are subject to the deployment's configured backup expiry and may remain longer. Legal, security, or accounting requirements may require some records to be retained.

To stop future Google data access, use Disconnect in workspace settings or remove Signalstead from your Google Account's third-party connections. Disconnecting removes the saved Google credential and requests token revocation where possible, but does not delete imported historical metrics; request their deletion separately. You may also stop using optional integrations at any time. Rights available to you depend on applicable law, and this policy does not limit rights that cannot lawfully be limited.

8. Security

We use server-side access controls, workspace-scoped permissions, encrypted storage for Google OAuth refresh tokens, and encrypted connections in transit where supported. Access to customer information is limited to the workspace team and authorized service personnel who need it to operate, support, or secure the service. No internet service can guarantee absolute security. Contact us promptly if you believe your account or data has been accessed without authorization.

9. Children, international processing, and changes

Signalstead is designed for businesses and professional users and is not directed to children. The service and its providers may process information in countries other than your own, including Nepal and the regions where selected providers operate; those countries may have different data-protection rules. We will update this page when our data practices materially change and show the revised effective date here.

10. Privacy contact and developer

For privacy questions, access, correction, or deletion requests, contact MarginTop Solutions Pvt. Ltd. through its contact page.

Postal address: Diamond Marga, Kupondole, Lalitpur, Bagmati Province, Nepal. Phone: +977-9845926945. MarginTop Solutions, Nepal designed and developed Signalstead. This contact handles privacy inquiries for the service.