Privacy Policy

AskGSC is available at https://askgsc.app and operated by KALYVOX SASU, SASU (French single-shareholder simplified joint-stock company), with a registered address at 6 place du Président Thomas Woodrow Wilson, 31000 Toulouse, France and registration number 999 458 409 (Toulouse Trade and Companies Register).

Privacy contact: dpo@kalyvox.ai. These details must be completed before the public service launch.

When you sign in with Google, AskGSC receives the details required to identify your Google account, including your account identifier, email address and, where permitted, your name and profile picture.

When you grant Search Console access, AskGSC can retrieve the Search Console properties you are already authorized to view. API responses may contain search queries, page URLs, clicks, impressions, click-through rates, average positions, dates, countries, devices and other reporting dimensions.

We also process your selected settings, trial and subscription dates, relevant billing information and limited technical information required to secure and operate AskGSC.

AskGSC requests the Google OAuth scope https://www.googleapis.com/auth/webmasters.readonly. It provides read-only Google Search Console access and does not allow AskGSC to modify or delete Search Console properties.

Google identity scopes (openid, email and profile) are used to authenticate users, create or identify AskGSC accounts and maintain user sessions.

We process authentication and Search Console information to provide the service requested under our contract with you, including your selected queries, reporting comparisons and authorized MCP connections.

Payment and invoicing information is processed as necessary for contractual and legal obligations. Security monitoring and abuse prevention rely on our legitimate interest in maintaining a safe service.

Where applicable law requires consent, including for non-essential tracking technologies, we request it separately. You may refuse or withdraw Google API authorization, although the related features will then stop working.

We use Google API information only to provide user-requested functionality, such as reading, analyzing and comparing your own search performance. We do not sell Google user data, use it for targeted advertising, or train our own AI models on it.

AskGSC's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Search Console reports are requested on demand. The normal service does not create a permanent historical database of your Google Search Console performance rows.

When you explicitly authorize an MCP-compatible AI assistant and request an operation, AskGSC sends only the Search Console results required for that request. These can include queries, URLs, metrics and reporting dimensions. We do not automatically transmit your entire Search Console dataset to every assistant.

Once shared with your chosen assistant, this information is also governed by the third-party provider's privacy policy, retention choices and any applicable model-improvement settings. Review the provider's practices before connecting your account.

Google provides authentication and Search Console APIs. Supabase provides user authentication, database infrastructure and backend functions. The web application is hosted by Lovable (web application hosting). Stripe may process payments when billing becomes available.

OpenAI, Anthropic or other assistants selected by the user may receive requested results only through authorized operations. We do not sell personal information to data brokers or advertising networks.

The Google OAuth refresh token necessary to maintain authorized access is encrypted and stored server-side. Credentials are not intended to appear in public API responses or application logs.

We implement account-level access restrictions, encrypted communications and technical safeguards designed to prevent unauthorized access. No online system can provide absolute security.

Account information is retained as long as needed to provide the service and then deleted or archived where required by law. Google credentials are deleted or rendered unusable when the connection is removed or the account is deleted, subject to backup retention cycles.

Search Console performance reports are not stored as a permanent reporting database. Technical logs are kept for [PERIOD TO BE CONFIRMED], and backups are purged within [PERIOD TO BE CONFIRMED].

Accounting documents may be retained for up to ten years where French accounting legislation requires it.

Infrastructure providers and user-selected AI assistants may process information outside the European Economic Area. Where AskGSC is responsible for the transfer, an adequacy decision or appropriate safeguards, such as standard contractual clauses where necessary, must apply.

A third-party assistant's separate international processing arrangements are described in that provider's privacy documentation.

AskGSC may use strictly necessary session, authentication and security storage. If non-essential analytics or marketing technologies are added, we will seek consent whenever the law requires it.

Subject to the applicable rules, you may request access, correction, erasure, restriction and portability of your personal information or object to certain processing. Consent can be withdrawn where it forms the legal basis.

Send requests to dpo@kalyvox.ai. We generally respond within one month under the GDPR, subject to lawful exceptions. You may complain to the French data protection authority at https://www.cnil.fr or another competent authority.

You can revoke AskGSC's Google authorization from https://myaccount.google.com/connections. Revocation prevents further access to Google data through that authorization.

For disconnection or account deletion requests, contact dpo@kalyvox.ai. Legally required records and technical backup copies remain subject to the retention periods described above.

We may update this policy to reflect product, provider or legal changes. Material new uses of Google data will be disclosed before they begin, and renewed permission will be requested where necessary.