Privacy Policy

• Account information: your email address and the credentials used to sign in. Accounts are created by invitation.
• Workspace information you provide: your website domain, business name, Google Business Profile identifiers (such as CID or Place ID), markets, locations and the keywords you choose to track.
• Search measurements: results of the searches SearchTerrain runs for you — for example Google Maps and Google organic rankings for your keywords and locations, the ranking URLs, and the other businesses or websites that appear in those results. These are collected from public search results through our data provider.
• Google user data (only if you connect Google Search Console): see section 3.
• Free previews: the website domain you enter and the public search data we retrieve for it. To limit abuse we store a one-way hash of your IP address (never the address itself).
• Billing: if you subscribe, your plan, subscription status and invoices. Card details are handled by Stripe and never reach SearchTerrain.
• Enquiries: the name, email, phone and business details you send when you ask to talk to an SEO strategist.
• Technical information: essential cookies that keep you signed in and secure a Google connection in progress, a first-party cookie with a random visitor ID used to count steps in our own signup funnel, and standard server logs (such as IP address, browser type and request time) used for security and troubleshooting.

We do not use advertising or third-party analytics trackers, and we do not sell personal information.

• To provide the service: show your rankings, search performance, reports and history within your workspace.
• To run the searches you request or schedule, and to account for usage against your plan.
• To secure the service, prevent abuse, and troubleshoot problems.
• To communicate with you about your account and the service.
• To meet legal obligations.

Connecting Google Search Console is optional. When you connect it, you sign in with Google and grant SearchTerrain access using Google OAuth. We request only:

• View Search Console data for your verified sites (webmasters.readonly) — read-only; SearchTerrain cannot change your Search Console settings or submit anything to Google; and
• Your Google account email address (openid, email) — to show which Google account is connected.

What we access: the list of Search Console properties your Google account can see and your permission level for each, and — for the one property you choose for your workspace — search performance data: clicks, impressions, click-through rate, average position, and breakdowns by date, search query, page, country and device.

How we use it: solely to display that property's search performance to the members of the SearchTerrain workspace you connected it to, including trends, comparisons with earlier periods, and page- and query-level reports. We do not use Google user data for advertising, we do not sell it, we do not use it to build user profiles, and we do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.

Sharing: we do not share or transfer Google user data to third parties, except to our infrastructure providers listed in section 4 that store and process it on our behalf to operate the service, when required by law, or as part of a merger or acquisition with notice to you.

Human access: our staff do not read Google user data except with your permission (for example, when you ask us for support with your workspace), when necessary for security purposes such as investigating abuse, or to comply with applicable law.

Storage and security: Google OAuth tokens are encrypted at rest (AES-256) and are used only by our servers; they are never sent to your browser. Search Console data is stored so reports load quickly and history can be kept for your workspace.

Retention and deletion: Search Console data is kept while the connection is active. When you disconnect Google Search Console in SearchTerrain (Settings → Google Search Console → Disconnect), we revoke our access with Google and delete the stored tokens, property list and Search Console data for that workspace. You can also revoke access at any time from your Google Account at myaccount.google.com/permissions; SearchTerrain will then stop receiving data. To have any remaining data deleted, disconnect in SearchTerrain or contact us.

SearchTerrain's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of providers to run SearchTerrain. They process information only on our instructions:

• Cloudflare — website and application hosting, network security.
• Supabase — database and sign-in (data hosted in Canada).
• DataForSEO — runs the Google Maps and organic searches you request. It receives the search terms, locations and settings for those searches; it does not receive your Google Search Console data or Google account information.
• Google — Search Console API (if you connect it) and web fonts served by Google Fonts.
• Stripe — subscription payments and invoices.
• OpenAI — researches public information about your business (from your website and the public web) to build your Business Knowledge profile. It receives your website domain and public web content, not your Search Console data.
• Cloudflare Turnstile — bot protection on the free preview.

We may also disclose information if required by law or to protect the rights, property or safety of our users or others.

We keep account and workspace data for as long as your account is active. If a subscription ends, your workspace data is kept for up to 12 months so you can return, unless you ask us to delete it sooner. When an account or workspace is closed, we delete its data within a reasonable period, except where we must keep limited records for legal, security or accounting reasons. Server logs are kept for a limited time.

Data is encrypted in transit (HTTPS). Access to workspace data is restricted to that workspace's members, with each workspace's data kept separate from every other workspace. Credentials for third-party services are held server-side only. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach where required by law.

• Disconnect Google Search Console at any time in Settings, or revoke access from your Google Account.
• Request access to, correction of, or deletion of your personal information by emailing admin@vortio.com.
• Close your account by contacting us; we will delete its data as described above.

We handle personal information in accordance with applicable Canadian privacy law. If you are elsewhere, you may have additional rights under your local law; contact us to exercise them.

SearchTerrain is a business service and is not intended for children under 16.

We may update this policy. We will change the “Last updated” date and, for material changes, notify account holders before the change takes effect.

Vortio Inc., Ontario, Canada. Privacy questions and requests: admin@vortio.com.