Privacy
How HyperGSC handles your account, Google data, and the information you share with connected tools.
Effective October 3, 2026. HyperGSC is operated by Carl Brownson. For privacy, account, billing, or legal questions, contact help@hypergsc.com.
Information we process
When you sign in by email or Google, Supabase authenticates you and provides HyperGSC with your account identifier, email, and basic profile information. Signing in with Google does not grant Search Console access. When you separately connect Google Search Console, we receive the Google account identifier, name, email address, and permissions you approve. We store your connected accounts, available Search Console properties, property selections, encrypted Google credentials, API credentials, and client authorizations. When you request a report, we process the relevant search queries, page URLs, performance metrics, sitemap information, or indexing results. When you separately connect Google Analytics, we access the GA4 properties available to that account and the read-only analytics reports you request, including traffic, audience, engagement, and conversion metrics. Google account identifiers, email, and basic profile information identify the account you connected.
Saved SEO research
When you choose to save project context, keyword lists or SEO change records, we store their contents encrypted in HyperGSC for the selected Search Console property. This can include business context, audiences, markets, competitors, page URLs, decisions, tasks, notes, keywords, metrics you supply, and dates and descriptions of changes you report. Authorized clients with read access can retrieve this research. A client needs the separate projects:write permission to save, edit, or delete it. Research remains until you clear or delete it, the associated property or Google connection is removed, or your account is deleted. The recovery-backup retention described below also applies to earlier copies of research data.
Why we use this information
We use account and connection information to authenticate you, retrieve authorized reports, and deliver results to you and the clients you connect. We record tool names, request times, success or failure, and quota usage to show activity, enforce plan limits, investigate errors, and protect the service. Billing records associate your account with your payment-provider customer, subscription, and plan. We do not sell Google user data or use it for advertising or to train general-purpose AI models.
Google permissions and your controls
Search Console access is read-only. Your selected properties determine which Search Console data connected clients can retrieve. Google Analytics requires additional read-only permission and follows your Google account’s Analytics access, separately from Search Console property selection. Disconnecting a Google connection removes its credentials and associated Search Console properties from HyperGSC. You can also remove HyperGSC from your Google Account’s third-party connections to revoke the underlying Google authorization.
Connected AI clients
When you authorize an MCP client or give it your API key, it can request data within your account’s permissions and plan limits. Approving a client authorizes us to send the Google data returned by its requests to that client to answer your questions and produce the reports you request. The client provider processes and may retain those results under its own privacy policy. HyperGSC does not use Google user data to train general-purpose AI models or authorize client providers to do so. Only connect clients you are authorized to use for this data and configure their data controls so that Google data is excluded from general-purpose model training. HyperGSC cannot change a provider’s settings or erase its copies of results. You can revoke client authorizations or replace your API key in the dashboard. Revocation stops future access through those credentials; it does not erase results already received by a client. Signing out does not revoke agent access.
Service providers and disclosures
Supabase provides authentication and the hosted PostgreSQL database. Google provides OAuth sign-in, Search Console, optional Analytics, and performance APIs. Resend delivers authentication emails. Dodo Payments handles hosted checkout and the billing portal, receiving the account and payment information needed to manage purchases; HyperGSC retains subscription identifiers and status rather than full payment-card details. DataForSEO receives the keywords, domains, or URLs needed for the SEO tools you invoke. Website audit tools may fetch the public URLs you submit. Cloudflare provides the public website, edge proxy, and encrypted recovery-backup storage; Fly.io hosts the API. Hosting and infrastructure providers process information needed to operate the service. Transfers of Google data are limited to the user-authorized features described here, necessary security purposes, legal requirements, or a business transfer after obtaining the required consent. We do not permit human access to Google data unless you affirmatively agree to specific access, it is necessary for security or legal compliance, or aggregated data is used for internal operations as permitted by Google’s Limited Use requirements. Information may also be disclosed where required by law or necessary to address fraud, security incidents, or legal claims.
Cookies and browser storage
Supabase stores and refreshes your signed-in browser session. HyperGSC uses an HttpOnly cookie to secure the separate Google authorization flow. Your theme preference is saved in local browser storage. Google Analytics measures page views and Microsoft Clarity records interactions on public pages; these providers may set cookies. PostHog measures product usage and conversion steps using a browser identifier and, after sign-in, your account identifier, name, and email address. Its browser requests pass through our domain to PostHog’s EU service. We exclude URL query strings, report contents, and credentials from these product events; PostHog session replay is disabled. Blocking required browser storage or cookies can prevent sign-in or Google connection. Connected services, including hosted checkout and AI clients, manage their own cookies and storage under their own policies.
Security and retention
Google tokens and recoverable API-key secrets are encrypted at rest. Access to account information is restricted through authentication and authorization controls. No storage or transmission method is completely secure. Connection credentials and property selections are kept while the connection is active; disconnecting removes them from the live application database. Scheduled maintenance removes detailed tool-usage events after 90 days, completed diagnostic reports after 180 days, and expired authorization records. Detailed usage is converted into daily per-account totals, which remain available while the account is maintained. Account records and client authorizations remain until revoked or the account is deleted. Billing and reconciliation records are kept as necessary to resolve payments, meet applicable recordkeeping duties, and establish or defend legal claims. Encrypted recovery backups are stored separately from live accounts and may contain earlier copies of deleted data. They are restricted to disaster recovery and retained only as necessary for recovery, security, or legal obligations. Requests to erase backup copies are handled through help@hypergsc.com, with any required retention or technical limitations explained when the request is reviewed. Disconnecting Google does not delete these separate records or cancel a subscription.
Deleting your account and data
Request deletion by emailing help@hypergsc.com from your account email. Where available, you can also use Delete my account in Settings. We verify the requester’s identity before completing a request. Deletion removes Google connections and credentials, property selections, API keys, client authorizations, application sessions, diagnostic reports, and usage history from the live application database, and prevents future access. A minimal account identifier and deletion marker remain to prevent deleted accounts or credentials being reactivated. The separate authentication-provider record is removed through cleanup. Accounts with payment history require support review to close or reconcile billing before deletion. Cancel any paid subscription separately in Billing. Results already delivered to AI clients remain subject to those providers’ deletion processes.
Your privacy rights
Depending on your location, you may have rights to access, correct, delete, or obtain a portable copy of your personal information, restrict or object to processing, and withdraw consent. Withdrawing consent does not affect earlier lawful processing. You may also complain to your local data protection authority. We may need to verify your identity before handling a request. Contact Carl Brownson at help@hypergsc.com to exercise these rights or ask about retention and transfers. We process information necessary to provide your account and requested features to perform our agreement with you; optional Google access and other consent-based processing rely on your authorization. Security and abuse prevention support our legitimate interest in protecting the service, and legally required records are processed to meet legal obligations. Service providers and connected clients may process data outside your country. Applicable safeguards are required where data-protection law restricts an international transfer; contact us for information about the providers and safeguards relevant to your account.
Changes to this policy
Updates will appear on this page with a revised date. Material changes affecting how your information is used will be communicated through the service or your account email before they take effect, where required. New permissions will be requested when needed for optional integrations.
Google API data
HyperGSC’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. Access is limited to providing the features you use; Google data is not made available for unrelated advertising, resale, or general-purpose model training.