Privacy Policy

What we collect

Account details (name, email, organization), the third-party accounts you connect, and the metrics we read from them to produce analysis. We record usage of the service for billing and product improvement.

How connected accounts are used

Connections to Google Ads, Google Analytics 4 and Google Search Console are read-only. OAuth tokens are encrypted at rest and used only to fetch the data needed for your analysis.

Google user data

When you choose to connect a Google account through Google's consent screen, Stryvia Growth accesses the following Google user data, in read-only form: your Google Ads reporting data (campaigns, ad groups, keywords, and daily performance metrics such as impressions, clicks, cost and conversions), your Google Analytics 4 reporting data (sessions, users, traffic sources, landing pages and conversions), and your Google Search Console performance data (search queries, impressions, clicks and positions).

This data is used solely to display your own dashboards, reports, insights and recommendations back to you and members of your organization. It is stored encrypted in our database, is never sold, is never used for advertising purposes, and is never shared with third parties except the subprocessors listed below, each of which processes only what its function requires. Only derived aggregates and summaries are processed by the AI layer; raw row-level Google data is not sent to the AI provider. You can revoke our access at any time by disconnecting the account inside the product or via your Google Account permissions, and connected Google data is deleted on account deletion.

Stryvia Growth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The AI layer

Aggregates, deltas and structured summaries from your data are sent to our AI provider to generate recommendations. Raw row-level exports are not sent to the AI provider.

Subprocessors

We rely on Supabase (database and auth), our AI provider (analysis), Stripe (billing), Resend (email), and the answer-engine and SEO data providers used by the visibility features. Each processes only what its function requires.

Your rights

You can export your data and request deletion of your account and associated data. Disconnecting a provider revokes our ongoing access. Contact us to exercise these rights.

Retention

We retain data for as long as your account is active and as needed to provide the service, then delete or anonymize it according to our retention schedule.

PDPL & your rights in Saudi Arabia

For customers in the Kingdom of Saudi Arabia, we process personal data in line with the Saudi Personal Data Protection Law (PDPL): we collect only what the service requires (data minimization), use it for the stated purposes, and honor your rights to access, correct, export and request deletion of your personal data. Where data is processed outside the Kingdom by a subprocessor, that transfer is limited to what the function requires and is subject to the same protections described here.