Privacy policy

DRAFT: replace every [bracketed] item and have your lawyer review before publishing. Effective date: [date].

1. Who we are

[Legal entity name], [registered address], Kenya. Contact: [privacy@your-domain.com].

2. Data we collect

Your email address and a password hash; connection details and access tokens for the accounts you connect (Google Analytics 4, Google Search Console, Google Ads, Meta Ads, Google Sheets); the settings of the reports you create; and a log of report runs (time, status, row count, error message). We do not store the reporting data we fetch: it is passed straight from the source to the destination you choose.

3. Google user data

We request read-only access to Google Analytics (analytics.readonly), Google Search Console (webmasters.readonly) and Google Ads (adwords) to read the reports you ask for. We request drive.file to create and write only the spreadsheets this app creates in your Google Drive. We cannot see any other file.

[Product name]'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Meta user data

We request the ads_read permission to read advertising performance for the ad accounts you select. We never create, edit or delete ads, campaigns or budgets.

5. How we use data

Only to build the reports and exports you asked for and to run your scheduled refreshes. We do not use your data for advertising, profiling or sale, and we do not use it to train AI models.

6. Who we share with

Our hosting provider [name, country], our payments provider [Paystack/Stripe], our email provider [name], and the destinations you configure (for example your own Google Sheet). We do not sell personal data.

7. Security

Access tokens are encrypted at rest with AES-256-GCM and all traffic uses HTTPS. Access to production systems is restricted and logged.

8. Retention and deletion

We keep your data while your account is open. When you disconnect an account, we revoke our access at the provider and delete its token and the reports that depend on it. You can delete your whole account in the app under Account, or follow the steps on our data deletion page.

9. Your rights

Under the Kenya Data Protection Act, 2019 you may access, correct, delete, object to processing of, and port your personal data. Write to [privacy@your-domain.com]. You may also complain to the Office of the Data Protection Commissioner.

10. International transfers

Our servers are located in [country]. [Describe safeguards for transfers outside Kenya.]

11. Children

The service is not for anyone under 18.

12. Changes

We will post changes here and update the effective date.