Google account data: access, use, storage and sharing
Connecting Google is optional. AAA Signal is a website-monitoring and SEO reporting app; connecting your account lets it retrieve the Search Console and Analytics data needed for your selected website reports. Google asks for your permission before granting access. You choose which accessible properties to use in your dashboard.
- Access: the normal connection requests read-only Search Console and Google Analytics permissions. Search Console data includes accessible properties, search queries, page URLs, clicks, impressions, position, sitemap information and stored URL inspection results. Analytics data includes accessible accounts/properties, users, sessions, traffic sources and configured event counts, ecommerce revenue and purchases where your site already measures them. The separate optional sitemap-submission connection requests broader Search Console permission because submission is unavailable with read-only access.
- Use: we use this data to display your reports, comparisons, indexing results and practical guidance. An SEO Action Plan may collect selected evidence in background stages only after you purchase the service and explicitly consent. Production delivery requires owner review. We do not edit your website or Analytics settings, and sitemap submission does not request indexing of individual pages.
- Storage: Google refresh tokens are encrypted in the server-side database. Short-lived access tokens are used on the server to call Google APIs and are not returned to your browser. Selected property settings and saved indexing scans are stored; a consented SEO review also stores selected reporting evidence and its draft or delivered plan. Ordinary dashboard reports are retrieved on demand.
- Sharing: Google API requests are sent to Google and the app processes and stores data using Cloudflare hosting and database services. Your private Google reports are not public and are not made available to other customers. Clerk handles account identity and Stripe handles billing; Google reporting tokens are not supplied to either provider for those functions. The current rule-based SEO plan engine and product-help assistant do not send your Google reports or tokens to an AI model provider.
- Retention and deletion: disconnecting Google revokes access and deletes the stored encrypted token and saved indexing scans. Business/property settings remain for reconnection, and previously collected paid-review evidence and plans remain separately stored. You can request deletion of those records or your entire account through our deletion instructions or support@aaasignal.com.au. Section 10 explains retention and section 12 explains your controls.
We do not sell Google user data, use it for advertising or creditworthiness decisions, or use it to develop, train or improve general-purpose AI or machine-learning models. Human access to Google user data is limited to the specific assistance you affirmatively authorise, necessary security investigations, applicable legal requirements, or other uses permitted by Google’s Limited Use requirements. The operator may review evidence for an SEO plan you have explicitly authorised; this does not grant unrestricted access to your Google account.
AAA Signal’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
1. Who is responsible
AAA Signal is an Australian website-monitoring and SEO reporting service operated by Brenton James Haddin trading as AAA Signal, ABN 30 671 785 400. Privacy questions or complaints can be sent to support@aaasignal.com.au or through the contact page.
We handle personal information with reference to the Australian Privacy Principles where they apply, and use them as a practical minimum standard for the service.
2. Information we collect
We collect only information reasonably needed to operate and secure AAA Signal:
- Account information: the account identifier, email address and optional name supplied through Clerk, our independent authentication provider. AAA Signal does not receive or store your sign-in password.
- Business settings: business names, websites, selected Google properties and optional enquiry-event names.
- SEO Action Plan information: the goals, services or products, target locations, competitors and notes you deliberately provide in a purchased website brief, together with your automation/assistance choice, fulfilment status, job progress, collected evidence, generated draft/final plan and the private delivered report link.
- Support information: your name, email, topic and message when you contact us.
- Billing records: plan, subscription and payment status, Stripe customer and transaction references, invoice information and purchased service records. Stripe collects and processes payment-card details; AAA Signal does not store full card numbers.
- Security information: limited technical logs and one-way identifiers derived from connection information where needed to prevent spam, rate-limit the help assistant, investigate faults and protect the service.
3. Google data AAA Signal accesses
After you choose to connect Google, AAA Signal requests read-only access for reports. You may separately authorize the additional Search Console permission needed to submit or resubmit sitemap URLs on your behalf. AAA Signal uses that permission only for the sitemap submission feature; it does not edit your website, Analytics setup or other Search Console settings.
- Google Search Console: the properties you can access, clicks, impressions, click-through rate, average position, search queries, pages, countries, devices, sitemaps and URL inspection results.
- Google Analytics: the accounts and properties you can access, visitors, sessions, traffic channels, events and other reporting dimensions needed for the reports you request.
We also store your selected Search Console property, selected Analytics property, optional enquiry-event name and an encrypted Google refresh token so you do not need to reconnect for every report.
4. How Google data is used
Google data is used only to provide visible AAA Signal features that you request: dashboards, comparisons, search and page reports, opportunity reports, indexing checks, sitemap submissions, enquiry-event reporting and the paid SEO review you request. With your explicit consent and when activated, that review can fetch and store selected reports in background stages to prepare and deliver a rule-based plan. Operator access to the selected review evidence is for the assistance you authorise, or other permitted security/legal purposes. AAA Signal cannot edit your website or Analytics setup. If you separately authorize sitemap submission, AAA Signal can submit sitemap URLs to Search Console; it does not use that access to edit other Search Console settings. We do not sell Google user data, use it for advertising, build advertising profiles or use it to train general-purpose AI models.
AAA Signal’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
5. How we use information
We use information to authenticate customers, provide requested reports, maintain business workspaces, process purchases, respond to support, improve reliability, detect misuse and meet accounting or legal obligations. We do not sell personal information or Google user data, rent customer lists, or use your reports to create advertising profiles.
6. Cookies and similar technology
AAA Signal and its hosting or authentication providers may use essential cookies or equivalent session technology for sign-in, security, checkout continuity and service operation. We offer optional Google Analytics on our public website pages to understand visits and improve the website. It runs on public pages by default, without advertising or personalisation cookies. You can turn it off at any time with “Turn off” in the notice or through “Analytics preferences” in the public website footer, without losing access to the service. We store that choice in your browser; analytics cookies are configured for up to 90 days, while Google Analytics data retention follows the property settings. After consent, successful product enquiries, partnership enquiries and AI integration requests also send a generate_lead event with a fixed form label. Support, billing, privacy requests, failed submissions and spam-trap responses do not send that conversion event. Completed new account registrations can send a sign_up event from the account-completion screen unless you have turned analytics off. No account page views are sent. A browser-local marker prevents repeated counting of the same account on that browser; measurement can still be missed or repeated across devices or cleared storage. No message contents, account identifiers or receipt identifiers are sent to Analytics. Google may process device/browser information, public page views and technical request information such as IP addresses; GA4 does not log or store individual IP addresses. Our page-view implementation excludes query strings and fragments, sends only the referring origin, and does not send account IDs, email addresses, form contents, payment details, Google tokens or private dashboard reports. Private dashboard, sign-in and Google-return routes are excluded. Advertising storage, Google signals and ad personalisation are disabled. Declining or withdrawing stops our analytics tracking and clears accessible Google Analytics cookies on this site. Browser restrictions and consent choices mean Analytics will not count every visitor. Google processes this website analytics data under its own privacy terms, separately from the Google reporting data you connect to AAA Signal.
If you arrive through a referral link from one of our partners (an address ending in ?ref=…), we store a small first-party cookie with that partner’s code for up to 90 days. When you sign in, we record which partner referred your account so we can pay them their commission, then delete the cookie. The partner is not given access to your account or reports; we may tell them that you signed up and which plan you are on, so they can be paid correctly.
7. Weekly reports and saved workspace data
Optional Weekly Signal Email uses your verified account email, a separate opt-in for each business, your selected day, hour and timezone, and a consent record. When delivery is configured and you enable it, AAA Signal retrieves a seven-day Google report in the background and prepares a limited summary of figures, changes, missing-data explanations and next steps. You can preview the report without sending it. Sending infrastructure is configured, but each business requires your explicit opt-in before delivery is enabled. We do not add you to a marketing list.
The delivery integration uses Resend when configured. It receives the recipient address, sender details and report message needed to deliver that opted-in email, subject to its processing terms and possible overseas processing. Email preferences and consent records are retained while needed to provide this feature. Delivery status and temporary retry bodies are retained for up to 90 days; message bodies are cleared after provider acceptance. Your mail provider may retain delivered messages under its own settings. Unsubscribe links contain a signed identifier, not your Google credentials. Disabling reports stops future scheduled sends; a message already accepted by the provider may still arrive.
The saved workspace stores SEO tasks, notes, saved search-filter settings, page addresses, dates and keyword phrases you choose to add, up to 30 manually collected position checks per keyword, and up to 20 private report snapshots per business. These snapshots can include Google reporting data and remain historical records until you delete them or request account deletion. Ordinary unsaved reports are still fetched on demand. Downloaded reports contain private business information; you control where you store or share those files. The diagnostics and landing-page comparison features use the existing read-only Google permissions.
8. AI assistants
Read-only custom connections for ChatGPT (OpenAI) and Claude (Anthropic) are available where the customer’s assistant plan and workspace support them. If a supported direct assistant connection is enabled and you deliberately request a report, only the content needed for that request is sent to the supported provider and is then handled under that provider’s terms and privacy policy. The on-page help assistant uses guided product answers by default. If its OpenAI service is configured, it sends your question and limited recent conversation to OpenAI to answer it; it is designed for product guidance and does not receive your passwords, card details or Google tokens. AAA Signal does not send your Google reports to an AI assistant unless you initiate a report request. The automated paid-plan engine is rule-based and does not send your Google reports to a language-model provider. Opportunity scores, estimated gains and optional AI explanations are informational and do not make decisions with legal or similarly significant effects about you.
9. Sharing, service providers and overseas processing
Information is processed only by providers needed to run AAA Signal, including Clerk for account authentication, Cloudflare for application hosting and data infrastructure, Google for connected reporting APIs and the PageSpeed Insights speed test, Stripe for checkout and billing, Resend for sending opted-in report and alert emails, and OpenAI when the configured AI help feature or an enabled supported AI report connection is deliberately used. The optional OpenAI help provider is separate from the rule-based paid-plan engine. A supported AI provider receives only the content needed for the requested feature. These providers receive only information needed for their role. Some providers may process information outside Australia, including in the United States or other regions where they operate.
Information may also be disclosed where required by law, to respond to a lawful request, or where reasonably necessary to investigate fraud, abuse, a security incident or threats to users and the service.
10. Storage and retention
Google refresh tokens are encrypted before storage and used only on the server. Ordinary dashboard reports are fetched when requested. A consented paid SEO review may retain the selected Search Console/Analytics snapshots, page findings, competitor-page metadata and Google inspection evidence inside its job and report so you can view the findings and obtain fulfilment assistance. Saved sitemap indexing inventories may contain page addresses, indexing results, canonical addresses and check times. Disconnecting Google deletes the encrypted token and saved indexing inventories. Saved business names, selected properties and event settings remain for reconnection; they do not retain authorisation to fetch new Google data. Previously collected paid-review evidence, drafts and delivered plans remain separately stored until deleted or no longer needed for the requested service or applicable retention purposes.
Account and business settings are kept while the account is active or as needed to provide the service. Contact messages are kept while reasonably needed to answer the request, protect the service and maintain support records. Subscription, invoice, transaction, SEO order, refund, fraud-prevention and tax records may be retained for accounting, dispute-resolution and legal obligations even after account deletion. Information no longer requiring identification may be securely deleted or de-identified.
11. Security and data incidents
AAA Signal uses encrypted token storage, server-side API calls, authenticated private report routes, restricted payment credentials and access controls intended to keep customers’ data separate. No internet service can guarantee absolute security. We maintain reasonable technical and organisational safeguards and will assess suspected data breaches and make notifications where required.
12. Access, correction, deletion and complaints
You can disconnect Google from the dashboard at any time. AAA Signal then asks Google to revoke access and deletes the encrypted token and saved indexing inventories. Business names and property/event settings are retained for reconnection. Weekly email reporting is disabled on Google disconnection; saved report snapshots, tasks, notes and keyword histories are retained separately until removed or deletion is requested. Disconnecting does not cancel billing, delete a previously delivered paid plan or automatically erase all review evidence. You can separately stop automated work from its progress controls and request deletion of review evidence or account data. You can also revoke access in your Google Account connections.
You may request access to, correction of, or deletion of personal information through the data deletion page, by emailing support@aaasignal.com.au, or through the contact form. We may verify your identity and may retain limited records where required or permitted by law. Privacy complaints will be investigated and answered within a reasonable period.
13. Optional read-only assistant connections
If you explicitly approve a ChatGPT or Claude custom connection, AAA Signal shares requested reporting data only for the businesses you select and that remain enabled within your plan. This may include search queries, website URLs, metrics, enquiry-event counts, saved indexing results, tasks, notes and keyword-check history. Google passwords and connection tokens are never shared. Your chosen assistant provider (OpenAI for ChatGPT, Anthropic for Claude) receives this content; review the terms, privacy settings and data controls applicable to your assistant account before approving access. AAA Signal does not authorise use of Google API data to train general-purpose models.
We store approval identifiers, your account identity, client metadata, selected business IDs, expiry, revocation and request-limit counters in Cloudflare D1. The OAuth service stores hashed credentials and encrypted authorization properties in a separate Cloudflare D1 table; short-lived access tokens expire after 15 minutes, and approvals and refresh access expire after 30 days. You can revoke an approval in AI assistants to block future calls immediately. That does not erase data already shared with the assistant. Expired approval records may be retained for up to 90 further days for security and are cleaned by scheduled maintenance or when you next begin authorization; deletion can also be requested through support.
14. Setup imports, action briefings and comparisons
You may upload template CSV files containing tasks and keywords. Previews are parsed in your browser; choosing Import sends the validated rows to AAA Signal for storage in your selected business’s private workspace. We do not request old-provider passwords or tokens. Report alerts in Your next steps use the reports you request and opted-in weekly reports. The separate, optional Website alerts feature checks your site on a schedule; see section 15. Comparisons use your saved report snapshots, which remain private until you choose to share them.
15. Website checks, alerts and competitor comparisons
To show website health, the page scan, speed scores, alerts and competitor comparisons, AAA Signal’s servers request public web pages: your website’s home page, robots.txt, sitemap and up to 20 pages listed in it, and the public home page and sitemap of any competitor website you add. The address of each website tested is sent to Google’s PageSpeed Insights service, which loads the public page and returns a speed score. These checks read only what any visitor could see; they do not log in to any website. Results are cached for about a day.
If you switch on website alerts, we store your alert settings, the most recent check results needed to spot a change, and the alerts raised (kept for up to 180 days). If you also switch on alert emails, alerts are sent to your verified account email through our email provider, Resend. Competitor website addresses you add are stored with your business until you remove them. Website alerts do not use your Google data except to compare your own Google clicks week to week.
16. Tutorial videos
Help guide videos are hosted by AAA Signal and play from our own website, so watching them does not load YouTube or share anything with Google. The same videos may also be published on our YouTube channel. Opening a Watch on YouTube or channel link takes you to that service, where Google’s Privacy Policy applies.
Our website footer shows review badges from Trustpilot, SaaSHub, AlternativeTo and LaunchNest. Loading these badges connects your browser to those services, which may receive technical information such as your IP address and browser type under their own privacy policies. Clicking a badge takes you to that site.
17. Children
AAA Signal is a business service and is not directed to children under 18. Do not create an account or provide personal information if you are not legally able to enter the agreement.
18. Updates
We may update this policy as the product, providers or legal requirements change. The latest version and date will remain available here. Material changes will be highlighted before they take effect where reasonably practicable, and Google data will not be used for a newly disclosed purpose without any consent required by law or Google policy.