Privacy Policy

WebSignalytics is operated by WebSignalytics Inc. (Ottawa, Canada). This policy explains what data we collect, how we use it, and what rights you have over it. We've written it in plain language because we believe you should actually be able to read and understand it.

What we collect

We collect only what we need to provide the service.

• Account information: Your name, email address, and billing details when you sign up.
• Website analytics data: We connect to your Google Analytics (GA4) account with read-only access. We read your site's traffic, engagement, and conversion data to generate your weekly report. We do not modify your GA4 data.
• Site context: The description of your site you provide during onboarding, used to generate relevant reports and AI visibility queries.
• Usage data: Basic logs of when reports were generated and delivered, for reliability and debugging purposes.

What we do not collect

• We do not collect data about your website visitors beyond what's already in your GA4 account.
• We do not sell your data to third parties.
• We do not use your data to train AI models.
• We do not run advertising or tracking pixels on our platform.

How we use your data

• To generate and deliver your weekly analytics report.
• To run AI search visibility checks using anonymised topic queries based on your site's subject matter.
• To send transactional emails: your weekly report, trial reminders, billing notifications, and account updates.
• To process your subscription and manage billing through Paddle.

Third-party services

We use a small number of third-party services to operate WebSignalytics:

• Google Analytics API: Read-only access to your GA4 data. Governed by Google's own privacy policy.
• Anthropic (Claude API): Used to generate the narrative sections of your report. Your site data is sent to Anthropic's API for this purpose. We use Anthropic's API under their standard commercial terms, which include data handling commitments.
• Perplexity and OpenAI: Used for weekly AI visibility checks. Topic queries are sent to these services. No personally identifiable information is included in these queries.
• Paddle: Handles subscription billing and payment processing. Your payment details are held by Paddle, not by us. Paddle is the Merchant of Record for all transactions.
• Cloudflare: Our reports are hosted on Cloudflare R2. Cloudflare also handles CDN, DNS, and DDoS protection for this website.
• Render.com: Our application is hosted on Render. Your account data is stored on Render-hosted infrastructure.

Data retention

• Weekly analytics snapshots are retained for 12 months, then archived.
• Signals, recommendations, and AI visibility results are retained indefinitely to support trend analysis and historical context.
• If you cancel your account, your data is retained for 12 months to support reactivation. After 12 months of inactivity with no reactivation, your data may be permanently deleted.
• You may request deletion of your data at any time by emailing [email protected].

Your rights

You have the right to:

• Access the data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Export your data in a portable format.
• Withdraw consent for data processing at any time by cancelling your account.

To exercise any of these rights, email us at [email protected]. We will respond within 10 business days.

Google Analytics OAuth access

When you connect your Google Analytics account, you authorise WebSignalytics to read your analytics data using Google's OAuth 2.0 protocol. We request only the analytics.readonly scope, which grants read-only access to your GA4 property data. We do not request write access and cannot modify your Google Analytics account or data in any way.

We access only the data necessary to generate your weekly report and do not store raw GA4 event-level data. Aggregated traffic metrics are retained for up to 12 months to support trend analysis across your reports.

This access is read-only. You can revoke this access at any time from your Google Account settings at myaccount.google.com/permissions. Revoking access will stop your reports from running until you reconnect.

Google Analytics data accessed through your OAuth connection is shared only with Anthropic's Claude API for the purpose of generating the narrative sections of your report. It is not shared with, sold to, or disclosed to any other third party. Paddle, Cloudflare, and Render do not receive your Google Analytics data.

Data security

We take reasonable technical and organisational measures to protect your data.

• All data transmitted between your browser and our application is encrypted in transit using TLS (HTTPS).
• Google Analytics OAuth tokens are encrypted at rest using AES-128 symmetric encryption before being stored in our database.
• Account passwords are hashed using bcrypt and are never stored in recoverable form.
• Payment information is handled entirely by Paddle. We do not store credit card numbers or full payment details on our infrastructure.
• Access to production systems and user data is restricted to authorised personnel and protected by multi-factor authentication.

Cookies

WebSignalytics uses a single session cookie to keep you logged in to your account. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies on our platform.

Data location

Our application infrastructure is hosted in the United States (Render.com). Report files are stored on Cloudflare's global network. By using WebSignalytics, you consent to your data being processed in these locations.

Changes to this policy

If we make material changes to this policy, we will notify you by email at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

Contact

Questions about this policy? Email us at [email protected].

WebSignalytics Inc.
Ottawa, Ontario, Canada