G
GEO Toolbox

Privacy Policy

Last updated: August 15, 2026

1. What We Collect

When you sign in with Google, we receive your name, email address, and profile picture from your Google account.

If you connect Google Search Console, we access your GSC property list and search performance data (queries, clicks, impressions, average position, country, device, page, date) for the sites you authorize, under the https://www.googleapis.com/auth/webmasters.readonly scope.

If you connect Google Analytics 4, we access your GA4 property list and traffic metrics (sessions, users, engagement rate, conversions, landing pages, source dimensions) under the https://www.googleapis.com/auth/analytics.readonly scope. We use this to identify traffic from AI search engines (ChatGPT, Gemini, Claude, Perplexity, NotebookLM).

2. How We Use Your Data

  • To authenticate you and display your account information
  • To show your Google Search Console and Google Analytics 4 data within the GEO Toolbox dashboard
  • To generate AI visibility reports for your domains

Google user data use is strictly limited to the purposes listed above. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models. We do not transfer Google user data to third parties except as necessary to provide or improve the Service, or as required by law. Our handling of Google user data conforms to the Google API Services User Data Policy, including the Limited Use requirements.

3. Data Storage and Retention

We do not store your raw Google Search Console or Google Analytics 4 data on our servers.All GSC and GA4 API responses are cached in your browser's localStorage for up to 6 hours and then automatically cleared. Clearing browser storage removes them immediately.

Server-side storage is limited to:

  • Your OAuth tokens (access and refresh), encrypted at rest, retained until you disconnect
  • Your connected GSC property and GA4 property identifiers
  • Authentication logs (sign-in attempts, session cookies) — purged automatically within 7 days of inactivity
  • Page-fetch cache (rendered HTML we fetched on your behalf to analyze) — held up to 24 hours, then superseded on the next fetch
  • Analysis outputs you generate (scan reports, domain overviews, agent-readiness checks, content briefs, citability analyses, competitor radar scans, AI-ready export transforms, AI visibility tracking) — retained indefinitely so you and your team can compare performance over time. Your plan controls how much of that history is visible in the dashboard: lower tiers show a limited window of scan history (for example 180 days on Starter) while higher tiers show your complete history. Older data outside your plan's window is not displayed, but it is never modified or deleted while your account is active.
  • Internal cost and audit logs for our own infrastructure monitoring, containing no personal data beyond a pseudonymous account ID
  • Error telemetry (anonymized, no PII) for up to 90 days
  • Billing and contract records — your acceptance of the Terms of Service (version, timestamp, IP address, plan and price disclosed at checkout), Stripe customer/subscription identifiers, and copies of billing communications we send you (trial confirmation, reminders, cancellation confirmations). Kept for the life of the account plus 5 years (limitation period for contractual claims); invoices are kept 10 years as required by French commercial law. These records are used to answer billing questions and payment disputes.

Right to deletion. You can delete all of your data at any time by deleting your account or emailing samy@geotoolbox.ai. We action account-wide deletion within 14 days. Removing a tracked brand from your dashboard immediately soft-deletes it and its watchlist.

4. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We use the following subprocessors to operate the Service:

  • Google OAuth: authentication
  • Google Search Console API: search performance data
  • Google Analytics Data API: AI traffic data
  • Google Analytics 4: aggregated usage analytics for our website
  • Microsoft Clarity: aggregated usage analytics for our website (heatmaps and session replay with sensitive text and inputs masked)
  • Stripe: payment processing (we never store card numbers ourselves)
  • Resend: transactional email delivery (verification, magic links, digests)
  • Vercel: application hosting
  • Replit: application hosting (PHP backend)
  • Neon: PostgreSQL database hosting
  • Sentry: error monitoring (no PII transmitted)

5. Your Rights

You can:

  • Revoke GEO Toolbox's access to your Google account at any time at https://myaccount.google.com/permissions
  • Disconnect GSC or GA4 from within the app's Analytics tab (the “disconnect” link under the connected-account badge)
  • Request deletion of all server-side data by emailing samy@geotoolbox.ai; we respond within 14 days
  • Clear locally cached data by clearing your browser storage

If you are in the European Economic Area, the United Kingdom, or Switzerland, you additionally have the rights of access, rectification, erasure, restriction of processing, data portability, and objection under the GDPR (Articles 15–21), and the right to withdraw consent at any time without affecting the lawfulness of prior processing. Exercise any of these by emailing samy@geotoolbox.ai. You also have the right to lodge a complaint with your local supervisory authority — in France, the CNIL (cnil.fr).

6. Cookies & Consent

We use strictly necessary cookies for session management, security (CSRF protection), and remembering your cookie choice. These are always on and require no consent.

We also use analytics cookies as described below; where applicable law requires consent — including for visitors from the EEA, the United Kingdom, and Switzerland — these tools are enabled only after you accept the consent banner. They are set by Google Analytics 4 (aggregated traffic, pages viewed, device type, approximate location) and Microsoft Clarity (aggregated interaction patterns, including heatmaps and session replays that mask sensitive text and form inputs). Neither is used for advertising or cross-site tracking.

If you are visiting from the EEA, the United Kingdom, or Switzerland, no analytics run until you accept the consent banner. You can refuse with one click (remembered for 6 months / 180 days; acceptance is remembered for 12 months / 365 days), and change your choice at any time via the Cookie settings link in the website footer, the Cookie settings link on the app's Account page, or by clearing the sg_consent cookie. We also set a short-lived sg_cc cookie holding only your country code (or the value unknown when it cannot be determined), used to decide whether the banner applies; it contains no identifier.

7. International Data Transfers

We are based in the European Union, and several of the subprocessors listed in Section 4 (including Google, Microsoft, Vercel, Neon, Stripe, and Sentry) process data in the United States. Where personal data of individuals in the EEA, the United Kingdom, or Switzerland is transferred to the United States, we rely on the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider holds an active certification, and on the European Commission's Standard Contractual Clausesincorporated into the provider's data processing agreement otherwise. Analytics data (Google Analytics, Microsoft Clarity) is only processed at all for EEA/UK/Swiss visitors after explicit consent (see Section 6).

8. Contact

For privacy questions or data deletion requests, email samy@geotoolbox.ai.