Privacy and account data

Information used to provide the service

We store your account email, display name, password hash, project domains, crawl results and AI evidence that you submit or request. API keys are encrypted on the server. Passwords are stored as salted hashes. We do not request AI account passwords or browser session cookies.

Optional Google and Bing search data

When you connect Search Console, we request Google's read-only webmasters permission for the property you choose. We store the selected property, permission level, search queries, page URLs, dates, clicks, impressions, click-through rates and average positions returned by Google. Bing imports the selected verified site's dated traffic counts using the API key you provide. These records support your private search reports and optimisation evidence. The separate native Google AI and Bing Copilot citation reports are not automatically imported by these endpoints.

Google refresh tokens and Bing API keys are encrypted on our server. They are sent only to the corresponding official Google or Microsoft API to authenticate your requested imports. Daily refresh is optional and off by default; scheduled search refreshes do not call an AI model. We do not sell search data, use it for advertising or use it to train general-purpose AI models. We limit Google API data use to the disclosed features in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Disconnect in Workspace → Search performance to delete the saved credential and stop future refreshes. Saved reports remain available until you delete the project; an already transmitted request may finish. You can also revoke Google access in your Google account. Report exports may contain private search data: review them before sharing or pasting into another service. Authorised support access is limited to your request, security investigations and legal requirements. Operational backups follow the deletion limits described below.

When information is sent to an AI provider

An API measurement sends the prompts you approve to the providers connected to your account. The provider processes them under its own terms and may charge your account. The separate Boost feature may send website excerpts, strategy information and your messages to our configured analysis provider. Do not include confidential material in these inputs. Provider-returned answers and sources are saved in your private project.

Storage, deletion and exports

You can export reports, delete individual AI observations, delete projects and disconnect API keys. Deleting a project removes its saved crawl history and observations from the active database. Disconnecting an API account deletes its saved key and cancels associated queued or running jobs; a request already sent to the provider may finish.

Operational backups may retain deleted records until backup rotation. Contact us for account deletion or a data-access request. We keep the minimum records needed to investigate the request and operate the service.

Browser storage and operational logs

Login tokens and a basic account display record are held in browser local storage. Logging out clears those browser records and revokes the current token on the server. Hosting logs can contain request URLs, IP addresses and response status codes. We do not intentionally log API key values. No advertising tracking is needed for the workspace.

Public website content

The crawler retrieves public web pages supplied by you. Private network addresses are not supported. The report describes what the crawl inspected and is private to your UltimateSEO account.