Google user data
ReportFlowHQ accesses Google user data only when you connect a Google account to a project. You sign in to ReportFlowHQ with your email and password, not with Google.
What we access
We never create, modify or delete anything in your Google accounts.
- Google account email address (openid and email scopes): to show which Google account is connected to a project and to confirm the connection.
- Google Search Console (read-only, webmasters.readonly scope): your list of sites, and clicks, impressions, CTR, average position, top queries and top pages for the site you select.
- Google Analytics (read-only, analytics.readonly scope): your list of GA4 accounts and properties, and sessions (in total, from Organic Search, and from AI assistants such as ChatGPT), users, new users, engaged sessions, engagement rate, landing pages and traffic sources for the property you select.
How we use it
Only to provide the features you use in ReportFlowHQ: project dashboards, SEO reports, PDF exports and scheduled report emails. We do not sell Google user data, use it for advertising, or use it to train AI or machine-learning models.
Sharing
We do not share Google user data except:
- With service providers that host and operate ReportFlowHQ (hosting, database and email delivery through Resend), only to provide the service.
- With OpenAI, to write the summary text in a report: when you generate a report, its metrics for the selected period (including top queries, top pages, landing pages and traffic sources) are sent to OpenAI's API. Under OpenAI's API terms this data is not used to train OpenAI's models; OpenAI may keep it for up to 30 days for abuse monitoring.
- With the report recipients you choose, when you email a report.
- When required by law.
Storage and security
OAuth tokens are encrypted at rest (AES-256-GCM) and are never sent to the browser. Data is transmitted over HTTPS, and access is limited to the systems that need it to run the service. Report metrics are stored in our database with the report they belong to.
Retention and deletion
- We keep report data while the project it belongs to exists.
- When you disconnect Google from a project, we delete the stored tokens immediately and stop fetching data. If no other ReportFlowHQ project uses the same Google account, we also revoke ReportFlowHQ's access with Google. Reports you already generated stay in the project until you delete it.
- When you delete a project, we immediately delete its reports, stored metrics, schedules and Google tokens, and revoke ReportFlowHQ's access with Google if no other project uses that Google account.
- To delete your account, email [email protected]. We delete the account and all its projects and Google data within 30 days.
- You can also revoke ReportFlowHQ's access at any time at https://myaccount.google.com/permissions.
Limited Use
ReportFlowHQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Contact
Questions or data requests: [email protected]
Information we process
ReportFlowHQ processes account details, workspace and project information, support communications, and the configuration needed to operate the service.
When you connect Google, ReportFlowHQ uses read-only access to retrieve selected Google Search Console and Google Analytics 4 data for the properties you choose. Reports are generated from that GSC and GA4 data and stored in your workspace.
How information is used
We use information to authenticate users, operate workspaces, connect selected Google properties, generate and deliver reports, enforce plan limits, secure the service, and respond to support requests.
- ReportFlowHQ does not sell client data or personal information.
- Google OAuth tokens are encrypted before storage and are not exposed to the browser.
- Users can disconnect Search Console or GA4 from a project at any time.
- Stripe handles payment details; ReportFlowHQ stores billing identifiers and subscription status, not full card numbers.
Retention, deletion, and choices
Workspace information is retained while the account is active and as reasonably required for security, billing, legal, and operational obligations. How Google data is retained and deleted is described under Google user data above. To delete your account, email [email protected]; we complete deletion within 30 days.
You are responsible for ensuring that you have authority to connect client properties and upload or process client information in ReportFlowHQ.
Service providers and contact
ReportFlowHQ relies on service providers for hosting, database infrastructure, email delivery (Resend), payment processing (Stripe), and report summary text (OpenAI). They process information only to provide their contracted services.
Contact ReportFlowHQ support with privacy questions or data requests.
Questions about trust or legal terms?
Contact us and include your workspace name so we can route the request.
[email protected]