Privacy Policy

Account data: your email address (sign-in is passwordless — we email you a sign-in link; sessions are managed by our authentication provider, Supabase). Workspace and project names you choose.

Analysis data: the website URLs you submit, crawl results, keyword and competitor data, generated reports, strategies and content — stored so your history and reports keep working.

Leads: if you embed our audit widget on your site, the name/email your visitors submit is stored in your workspace for you.

Technical data: IP addresses are used for rate limiting and abuse prevention; standard server logs are kept by our hosting provider.

Crawl session cookies: if you use "Crawl behind a login", the session cookie you paste is used only for the duration of that crawl, is scoped to the audited domain, and is never stored or logged.

Publishing connections: if you connect a publishing destination (for example a WordPress site or a GitHub repository), we store the credentials or connection you provide so we can publish content there on your behalf. Disconnecting removes them.

Payments: when paid checkout is available it is processed by Stripe — we receive your subscription status, never your card details.

To run the analyses you request, keep your report history, operate the scheduled re-audits and reports you set up, show Site traffic for websites you connect to Google (section 4), send transactional email (e.g. sign-in links, scheduled-report notifications), and protect the platform from abuse.

We do not sell your personal data, and we do not use your data for advertising.

We use a small set of processors to operate the Service: Vercel (hosting), Supabase (database and authentication), Anthropic (AI analysis of the content you submit), DataForSEO (search-engine data), Google APIs (optional Sheets/Slides export, page-speed data, and the Search Console and Analytics data described in section 4), Stripe (payments), Resend (transactional email) and PostHog (product analytics and session recordings, with typed input, on-screen text and images hidden before anything is sent, and you identified by an account ID only), plus stock-image providers when you generate images.

If you connect a publishing destination (such as GitHub or a WordPress site), content is sent to that platform when you publish — that connection is yours and under your control.

Anthropic processes submitted content through its API and does not use it to train AI models. Each processor receives only what it needs to perform its function. Public web pages you ask us to audit are fetched directly from the site in question.

Some of these providers store data outside Singapore. Where they do, we take steps to ensure it receives a standard of protection comparable to the PDPA.

This section covers what SearchBlueprint receives when you connect a Google account to Site traffic. Connecting is optional. Nothing here applies until a workspace manager connects Google for a website.

What we access: Search Console performance data (clicks, impressions, click-through rate, average position, queries and pages) and Google Analytics 4 reports (sessions, users, channels, traffic sources and landing pages) for the properties you choose. We also read the list of Search Console sites and Analytics properties your Google account can see, so you can pick one, and the email address of the Google account you connected. We ask Google for read-only access. We cannot change anything in your Search Console or Analytics account.

How we use it: only to show you your own traffic reports inside SearchBlueprint, to the people in your workspace who can open that website, and in the scheduled traffic reports you set up and send to recipients you choose. We do not use it for any other purpose.

How we store it: the tokens Google issues when you connect are encrypted before we store them. A built report is cached for up to 6 hours so the page loads quickly, and is then fetched from Google again. Each scheduled traffic report you generate is kept with that website so its report history keeps working.

What we never do: we do not sell Google user data, use it for advertising, or use it to train AI models. We do not transfer it to anyone except the processors in section 3 that host and run the Service. If you ask the in-app assistant a question while Site traffic is open, the page's headings, status labels and any text you have selected go to Anthropic with your question so the assistant can answer; Anthropic does not use data sent through its API to train its models.

Who reads it: no person at SearchBlueprint reads your Google user data unless you ask us to (for example in a support request), it is needed for security (such as investigating abuse), or the law requires it.

How to disconnect: open Site traffic for the website, choose Manage connection, then Disconnect Google. That revokes our access at Google and deletes the stored tokens and the cached reports for that website. You can also remove SearchBlueprint at any time from your Google Account permissions. Deleting the website or your account deletes the stored tokens and its scheduled reports, and cached copies are cleared after 6 hours.

SearchBlueprint's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Analysis history is retained so your workspace keeps working; you can archive projects at any time.

You can delete your account yourself from within the app — it is a hard delete that removes your account and workspace data. To delete a single workspace or specific data instead, email hello@searchblueprint.io and we will action it within 30 days.

Under Singapore's Personal Data Protection Act (PDPA) you may request access to or correction of your personal data, and withdraw consent to its use (which may mean closing your account).

Requests: hello@searchblueprint.io. We respond within 30 days.

We set authentication/session cookies needed to keep you signed in. PostHog, our product analytics, keeps an anonymous visitor ID in your browser's local storage, not in a cookie. We do not set third-party advertising or cross-site tracking cookies.

Data is encrypted in transit (HTTPS) and at rest by our providers. Access to production data is restricted to the operating team. Row-level tenancy keeps each workspace's data isolated from every other workspace.

No system is perfectly secure — if we learn of a breach affecting your personal data we will notify you as required by law.

We will signpost material changes to this policy in the app or by email.

Data protection contact: hello@searchblueprint.io.