Privacy Policy for the AlwaysRight App

4.1 Google User Data We Access

When you sign in via Google or connect Google services to AlwaysRight, we access only the following data that you have explicitly authorized:

• Google Sign-In / profile data: email address, name, profile picture URL, and unique Google account ID (sub).
• Google Search Console API (optional, read-only): list of connected sites/properties, performance metrics (impressions, clicks, CTR, average position), and search query analytics (Scope: webmasters.readonly).
• Google Analytics 4 API (optional, read-only): analytics properties, session data, page views, conversion events, and traffic sources (Scope: analytics.readonly).
• Google Ads API (optional, read-only): accessible ad accounts (Customer IDs, Login Customer IDs / MCC), campaign structures, ad groups, keywords (match types, quality scores), search terms reports, and performance & cost metrics (impressions, clicks, CTR, average CPC, total spend, conversions) (Scope: adwords). AlwaysRight performs read-only queries only and never modifies bids, budgets, or campaigns without explicit human action.

4.2 How Your App Uses Google User Data

The Google user data we collect is used by AlwaysRight exclusively for the following purposes:

• Authentication and identity verification to provide and secure your user account.
• Displaying SEO & SEA dashboards, ranking statistics, traffic trends, and ad performance analytics within the app.
• Generating AI-powered content, keyword, and SEA recommendations (such as discovering SEO/SEA keyword synergies, finding wasted ad spend, and suggesting negative keywords) to optimize your overall search presence.

Note: Google user data is used exclusively to provide and improve user-facing features of AlwaysRight and is not processed for any unrelated or undisclosed purpose.

4.3 Sharing & Disclosure of Data & the Google Limited Use Policy

We do not sell, rent, or share your Google user data with third parties under any circumstances. Data is only transmitted to necessary technical infrastructure providers (e.g., Supabase for database hosting, Vercel for application hosting) to deliver our service, under strict data processing agreements (DPAs).

Google user data is never used for advertising, data trading, or to train general-purpose AI models of third-party providers.

4.4 Data Protection & Security Mechanisms

We use modern technical and organizational security measures to protect your sensitive Google user data:

• Encryption in transit: All data transfers between user, AlwaysRight, and Google APIs take place over encrypted HTTPS/TLS 1.3 connections.
• Encryption at rest: Sensitive Google OAuth access and refresh tokens (Search Console, Analytics 4, Google Ads) are stored encrypted in our database using the AES-256-GCM algorithm.
• Secure secret management: Developer tokens and server secrets are strictly managed as server-side environment variables and never exposed to the client.
• Access restrictions & location: Strict role separation (principle of least privilege). Database storage takes place in ISO 27001-certified data centers within the European Union (Frankfurt, Germany).

4.5 Retention, Revocation & Deletion of Google Data

Google user data is only stored for as long as your user account is active or the connection to Google services persists.