Privacy Policy

Search Portfolio is a web application available at searchportfoliohq.com that combines Google Search Console data for the websites you own or manage into one portfolio dashboard. It is operated by Kaizen Properties LLC (“we”, “us”), the data controller responsible for the personal information described in this policy.

Our postal address is Kaizen Properties LLC, 3801 N 27th St, PO Box 6882, Tacoma, WA 98407.

This policy explains what information we collect, why, how it is stored and protected, whether it is shared, and the choices you have. Questions can be sent to gpmediacontact@gmail.com.

When you create an account we store:

• your email address, used to sign you in and to send service emails you have enabled;
• your display name;
• your timezone, used to schedule reports and show dates correctly;
• your theme preference (system, light or dark).

Sign-in is handled by Supabase Auth, using an emailed sign-in link or, optionally, “Sign in with Google”. Google sign-in shares only your basic profile and email address with us, to identify your account: if you use it, our authentication provider stores the name, profile picture URL and Google account identifier that Google provides. It does not give Search Portfolio access to Search Console. That requires the separate, explicit connection described below.

If you subscribe to a paid plan, payment is processed by Stripe. We store your plan and the subscription details Stripe reports: your Stripe customer and subscription identifiers, the price, subscription status, current billing period, latest invoice and, if a payment fails, when it failed. We never receive or store your full card number.

• When you request a sign-in link, we use your IP address and email address to limit how many links can be requested; unsubscribe links in our emails are limited by IP address in the same way. We store these only as one-way hashes, in short-lived counters that are deleted periodically.
• Requesting a sign-in link also sets a short-lived cookie in your browser so that a link opened in the same browser can sign you in directly (see Cookies and local storage).
• Our authentication provider (Supabase Auth) records the IP address and browser user agent of sign-ins and active sessions for security. Our hosting provider (Vercel) keeps request logs that include IP addresses. Both keep these only for their limited log retention periods.
• Our application logs record events such as sign-ins, errors and deletions with internal account identifiers. They never contain Google tokens, sign-in links or Search Console data.

Search Portfolio accesses Search Console data only after you click Connect Google Search Console and approve access on Google’s consent screen. We request:

• https://www.googleapis.com/auth/webmasters.readonly, read-only access to Search Console;
• openid and email, so we can show which Google account each connection belongs to.

What we access

• the list of Search Console properties your Google account can access, and your permission level for each;
• Search Analytics performance data: clicks, impressions, click-through rate and average position, by date, query, page, country, device and search appearance;
• the status of sitemaps submitted for your properties;
• URL Inspection results for URLs you choose to inspect.

Read-only access means Search Portfolio cannot add or remove properties or users, submit or delete sitemaps, or change any Search Console setting. We do not access any other Google service.

Why we access it

We use this data only to provide Search Portfolio’s features to you: to show your portfolio and category dashboards, to detect opportunities and material changes, and to generate the weekly reports and alerts you configure.

• Data is stored in a Supabase-hosted Postgres database.
• Google OAuth refresh and access tokens are encrypted with AES-256-GCM using a server-only key. They are never exposed to your browser or written to logs, and calls to Google are made only from our servers.
• Access is restricted per workspace by database row-level security, so one account cannot read another account’s data.
• All traffic between your browser, our servers and our providers is encrypted in transit with HTTPS.
• Our service providers may process data in the United States and other countries where they operate.

• Daily totals for each property, and the analyses and reports we generate, are kept while your account is active so you can see history.
• Detailed query and page tables are kept only for the most recent analysis windows and are replaced on each sync.
• URL Inspection results you request are kept with their property and deleted with it.
• Cached responses from Google’s APIs expire automatically.
• When you delete data or your account, it is removed immediately from our live database, including your product-usage events, and from backups within 30 days (see Deleting your data).

We do not sell your data, and we do not use it for advertising. We do not transfer it to third parties except the service providers that operate the product on our behalf:

• Supabase: database and authentication;
• Vercel: application hosting;
• Stripe: payments (we never receive full card numbers);
• Resend: email delivery, such as weekly reports and alerts.

We may also disclose information if required by law or valid legal process, or as part of a merger, acquisition or sale of assets, in which case we will notify you first.

We record first-party product-usage events, such as “connected a Google account” or “created a category”, to understand how the product is used. These events never include your search queries or page URLs, and they are deleted with your account. We do not use advertising trackers.

Search Portfolio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not use it for advertising, and we do not sell it.
• We do not use it to develop, improve or train generalized artificial intelligence or machine learning models. Search Portfolio’s analysis is rule-based.
• People do not read your Search Console data, except with your permission (for example, to help with a support request), when necessary for security purposes such as investigating abuse, or as required by law.

To disconnect one Google account, open Settings → Google Connections and choose Disconnect. Search Portfolio asks Google to revoke its access (unless the same Google account is still connected to another Search Portfolio workspace) and deletes the stored tokens. Data already imported from that account is kept until you delete it.

You can also remove Search Portfolio’s access at any time from your Google Account at myaccount.google.com/permissions. After that, Search Portfolio can no longer read that account’s Search Console data.

Deleting your Search Console data in Settings → Data & Privacy disconnects every connected Google account in the same way. Removing access at Google does not delete data that was already imported; delete it as described below.

In Settings → Data & Privacy you can, at any time:

• Delete Search Console data: removes every property imported from Google Search Console and everything derived from it (metrics, analyses, opportunities, URL Inspection results and reports), and disconnects your Google accounts: we ask Google to revoke our access and delete the stored tokens. Your account, categories and settings stay; or
• Delete account: permanently removes your account and workspace with everything in it, including Google connections and tokens, imported data, reports, settings and product-usage events. If the workspace has a paid subscription that still renews, cancel it in Settings → Billing → Manage billing first.

If you cannot sign in, email gpmediacontact@gmail.com from the address you sign in with. Deletion completes immediately in our live database and within 30 days in backups. Billing records may be kept where the law requires it. Step-by-step instructions are on the data deletion page.

• Essential cookies keep you signed in (they cannot be read by scripts on the page) and protect sign-in and the Google connection flow against request forgery. A sign-in-link cookie ties an emailed link to the browser that requested it and expires after one hour.
• Your theme preference, and when you chose it, are saved in your browser’s local storage and, when you are signed in, in your account.
• In the app, a preference cookie remembers the category and date range you last viewed (for up to 180 days), and display choices such as table density and visible columns are saved in your browser’s local storage. Neither is used for tracking.
• We do not use advertising or cross-site tracking cookies.

You can view and update your account details in Settings, and remove our access to Google or delete your data yourself at any time. Depending on where you live, you may have additional rights to access, correct, export, delete or restrict the processing of your personal data. To exercise them, contact gpmediacontact@gmail.com.

Search Portfolio is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with information, contact us and we will delete it.

We will update the date at the top of this page when this policy changes. If a change materially affects how we use your data, we will notify you by email or in the app before it takes effect.

Questions or requests about privacy: email gpmediacontact@gmail.com, or write to Kaizen Properties LLC, 3801 N 27th St, PO Box 6882, Tacoma, WA 98407.