Privacy Policy

1. Overview

GSC Wizard ("the service", "I", "me") is a web application that connects to Google Search Console and related SEO data sources to provide analytics, reports, and automation for site owners. This policy describes exactly what data I store, why I store it, and how long I keep it.

2. Information I Collect

2.1 Account & identity

• Profile: your name, email address, and profile image, received from Google when you sign in with OAuth.
• Linked Google accounts: encrypted OAuth access and refresh tokens, account email, account name, and the scopes granted. When you connect Search Console you choose the access level. The default is webmasters.readonly (read-only Search Console), which powers every dashboard, report and analysis feature. You may instead choose full access (webmasters, shown by Google as "view and manage Search Console data"), which Google requires for submitting sitemaps you ask to submit and for creating Search Console properties you ask to create; nothing else is ever modified. The web app currently also asks for full access before it runs URL inspection and Indexing tracker checks. Accounts connected before 25 August 2026, when the read-only default was introduced, usually hold full access; the Account page shows the access level of each connected Google account. If you opt in to BigQuery synchronization (see 2.2), you may be asked separately to grant bigquery.readonly on top, so the service can read your Search Console bulk export from your own BigQuery dataset. If you opt in to the Google Analytics 4 integration, you may likewise be asked to grant analytics.readonly (read-only), so the service can list the GA4 properties you have access to and read their traffic, engagement and conversion reports. If you connect Google Merchant Center, you are asked to grant content, which Google shows as "Manage your product listings and accounts for Google Shopping". Google offers no read-only version of this scope, so the grant does allow changes, but the service only reads with it: your Merchant Center accounts, product listings, product statuses and Merchant Center reports. The one exception is a step you start yourself: before Google's Merchant API answers any request, your Merchant Center account has to register the service's Google Cloud project as a developer, and the Organic Shopping report offers a button that does this for you. When you use it, Google records the email address of your connected Google account as the developer contact on that Merchant Center account. Nothing else in Merchant Center is ever modified. Each optional scope is requested only when you start that integration, and never for users who do not opt in. Tokens are encrypted at rest with AES-256-GCM.
• Linked Yandex account (optional): if you connect Yandex Webmaster, your Yandex user ID, Yandex login, encrypted OAuth access and refresh tokens, their expiry and the permissions granted. Yandex is asked for webmaster:hostinfo (to list your sites) and webmaster:verify, which Yandex shows as permission to add and verify sites but which its API also requires before it returns any report data. The service only reads with it and never adds, verifies or removes a site in your Yandex account. Disconnecting Yandex, or deleting your account, revokes the token at Yandex and deletes it here.
• Email forwarding token: a unique token that lets you forward Google Search Console notification emails into the app for parsing.

2.2 Search Console & SEO data

When you use reports, I request data from the Google Search Console API, the Google URL Inspection API, and optionally from Google Analytics 4 (the Admin and Data APIs), Bing Webmaster Tools and IndexNow. If you connect a GA4 property, the read-only access is used only to list the properties you can pick from and to fetch the traffic, engagement and conversion metrics shown on that property's analytics dashboard; GA4 data is not used for any other purpose. If you have enabled Search Console bulk data export into your own Google BigQuery dataset and choose to connect it, I read those same Search Console performance rows from BigQuery instead of (or in addition to) the API. Only the dataset you point me at is read, and only the searchdata_site_impression, searchdata_url_impression and ExportLog tables that Google's bulk export writes. The following is stored in my database and Search Console data warehouse:

• Performance-data warehouse (opt-in) - the Search Console (and, where you connect Bing, Bing Webmaster) performance rows behind your dashboards and reports: query, page, country, device and date metrics such as clicks, impressions, CTR and position. These are ingested into a ClickHouse database I self-host on my own servers at Hetzner (Falkenstein, Germany, EU); this warehouse, not a managed third-party service, is the primary store for your historical Search Console metrics. This sync is entirely opt-in and per property: nothing is copied into the warehouse until you explicitly enable ("sync") a specific property from Dashboard Management, at which point that property's history is backfilled. If you later turn the sync off for a property, its warehoused history is deleted.
• Sites you track (URLs, tags, branded keywords, sitemap URLs, optional GA4 configuration, optional BigQuery configuration: the GCP project ID, dataset ID and table prefix you point the integration at, plus sync state such as last-synced date, optional encrypted Bing API key, optional IndexNow key).
• Report cache - cached JSON responses for Queries, Pages, Countries, Dashboard, and similar reports, keyed to your user so repeated views don't burn API quota. Each entry has an expiry timestamp.
• Sampling & CTR-curve reports - aggregated sampling metrics and CTR-by-position buckets per site and date range.
• URL inspections & bulk inspection batches - results of Google's Index API (verdict, coverage state, last crawl time, referring URLs, page fetch state) and the batch jobs you run against them.
• Indexing tracker - URLs you watch, their current and previous indexing status, a history of status transitions, and queued warnings for email digests.
• On-page SEO crawls & reports - title, meta description and H1 tags fetched from your own pages, plus findings that cross-reference those with your GSC queries. Full HTML bodies are not stored.
• Topic clusters, content groups, experiments, saved filters, redirect mappings you create inside the app.
• GSC messages - if you forward Google's notification emails via your forwarding token, the parsed subject, body, sender, category, and severity are stored.
• IndexNow submissions - an audit trail of URLs you submit and the response code returned.

2.2a Google Merchant Center data (optional)

If you connect Google Merchant Center and link a Merchant Center account to one of your properties, I read that account through Google's Merchant API and sync it daily, starting with a backfill of recent history. Only the Merchant Center accounts you link are read. The following is stored in the same self-hosted ClickHouse warehouse at Hetzner (Falkenstein, Germany, EU), under the same per-tenant row policy as your Search Console data:

• Product catalog - a daily snapshot of each product in the feed: offer ID, title, description, brand, product link, image links, price and sale price, availability, identifiers (GTIN, MPN), product attributes such as category, color and size, and the product's Merchant Center status and issues.
• Product performance - daily clicks, impressions, conversions and conversion value per product, by country and by marketing method (free listings and ads), as Merchant Center reports them.
• Market insights - Merchant Center's price insights (your price, benchmark price, suggested price and its predicted effect), competitive visibility (the competing domains Google shows next to yours, with relative visibility) and best-seller rankings for your categories and countries.
• Feed Audit - each month, or when you run it, the service fetches the product pages and product images listed in your feed from your own website and compares them with the feed. It stores the checks that failed and, per page, the signals it extracted (such as the price, availability, title and structured product data found on the page). Full HTML bodies are not stored.

Merchant Center data is shown to people you share a property with only if you turn on Merchant Center access for that person. It is used only for the Merchant Center reports, alerts and MCP tools you use.

2.2b Yandex Webmaster data (optional)

If you connect Yandex, I read your Yandex Webmaster reports through Yandex's Webmaster API: site summaries (Site Quality Index, indexed and excluded page counts, detected site problems), search query statistics (impressions, clicks, CTR and position, for the site as a whole and for its most popular queries) and indexing history. These reports are not copied into the warehouse: each response is held in the application's cache for up to 60 minutes, to stay within Yandex's rate limits, and is otherwise fetched fresh. The only thing stored per property is the Yandex site ID that matches it. Yandex reports are shown only to the property's owner, not to people the property is shared with.

2.3 Sharing & client portal

• Clients: email addresses and names of external people you grant access to shared reports.
• Shared reports: snapshots (HTML or JSON data) of reports you explicitly choose to share.
• Magic-link & client sessions: one-time tokens and short-lived session records that let invited clients view shared reports without a password.

2.4 Billing

Subscriptions are managed by Stripe. I store a subscription record linking your account to a Stripe customer and plan; payment card details are handled by Stripe and never touch my servers.

2.5 Operational data

• API usage counters per site per day, used to respect Google's 2,000/day URL Inspection quota.
• Rate-limit counters to prevent abuse of shared endpoints.
• Property icons: a copy of each connected property's public favicon, fetched from Google's favicon service and stored in a Supabase Storage bucket named favicons, which serves each icon at a public address so the app and the mobile app can show it. The icons name no account and contain nothing but the site's own public favicon.
• Feature events for the optional gamification UI (e.g. "first report generated"). You can disable gamification in your profile.

2.6 Programmatic access (API keys & MCP server)

GSC Wizard offers a Model Context Protocol (MCP) server at mcp.gscwizard.com so you can use your own data from AI assistants (such as ChatGPT, Claude or Microsoft Copilot) and developer tools. If you choose to use it, the following is stored:

• API keys - personal access tokens (prefixed gscw_live_) you generate at /account/api-keys. Only a SHA-256 hash of each key is stored, never the key itself, and you can revoke a key at any time. Each key carries a read-only or read-write scope that limits which tools it may call.
• OAuth client tokens - when you connect through an OAuth-capable client (for example ChatGPT), short-lived access tokens (prefixed gscw_at_) are issued and stored only as hashes, tied to your account and to the scopes you approve on the consent screen.
• Tool audit log - for usage monitoring and abuse prevention I record each tool call, including every call the mobile app makes: the tool name and its scope, the calling key (none for OAuth sessions such as the mobile app, ChatGPT or Claude), a timestamp and duration, the outcome, the property the call targeted (for read calls too), the error message when a call fails, and, for write actions only, the arguments you passed, with credentials redacted and the size capped. Arguments to read-only queries are not stored.

Data returned by the MCP server is the same Search Console, Merchant Center, Yandex and other SEO data described above; no new categories are collected. When you access it through a third-party AI assistant, see §3 for how that data reaches the assistant's provider.

3. How I Use Your Data

Stored data is used only to:

• Authenticate you and keep your session active.
• Call Google, Bing, Yandex and IndexNow APIs on your behalf to build the reports you request.
• Cache those results so the app is fast and stays within API quotas.
• Send account, billing and (if you opt in) indexing-warning emails.
• Let you share reports with clients you explicitly invite.
• Diagnose errors and improve the product (see Analytics below).

I do not sell your data, GSC Wizard does not use your Search Console data to train AI models, and I do not share it with third parties except the sub-processors listed below.

Use through AI assistants (MCP)

One data flow is under your direct control. If you connect GSC Wizard to an AI assistant through the MCP server (see §2.6), the report data you ask that assistant to fetch is transmitted to the assistant's provider (for example OpenAI for ChatGPT, Anthropic for Claude, or Microsoft for Copilot and Copilot Studio agents) so it can answer your request. This happens only for the requests you initiate, only for the properties your credential can access, and the provider's handling of that data is governed by its own terms. I do not route your data to those providers otherwise, and connecting an assistant is always optional.

4. Sub-processors

• Supabase (EU, Ireland) - authentication, PostgreSQL database (profiles, sites, encrypted OAuth tokens, subscriptions, sharing grants) and file storage for property icons.
• Hetzner (Germany, EU; Falkenstein) - application hosting, the self-hosted ClickHouse Search Console and Bing performance-data warehouse, and the semantic-search embedding service.
• Vercel (US) - marketing website hosting (www.gscwizard.com).
• Stripe (US) - payment processing and subscription billing.
• Google (US) - OAuth, Search Console API, URL Inspection API, and, if you opt in, BigQuery read-only access to your own GSC bulk-export dataset, Google Analytics 4 read-only access to the properties you connect, and Merchant API access to the Merchant Center accounts you connect.
• Microsoft Bing (US) - Webmaster Tools API (only if you provide a key).
• PostHog (EU) - product analytics and error tracking.
• Google Ads (US) - advertising conversion measurement. Only if you accept cookies: a first-party identifier then links an ad click to the signup it produced. Until you accept, the tag runs with storage denied and Google receives no identifier (see the Cookie Policy).
• Resend (US) - transactional and digest email delivery.
• Cloudflare (US) - inbound email handling for forwarded Search Console notification and feedback emails.
• AI assistant providers (e.g. OpenAI, Anthropic) - only when you connect GSC Wizard to one through the MCP server, and only for the data you ask it to fetch (see §2.6 and §3). These act as recipients you choose, not as sub-processors I engage on my own behalf.
• Yandex (Russia) - Yandex ID (OAuth authorization) and the Yandex Webmaster API, only if you connect a Yandex account. Yandex is a data source you connect, not a sub-processor: I fetch your Yandex Webmaster reports from it and send it nothing beyond the requests that fetch them (your access token and your Yandex site identifiers).

Where your data lives: your account database (Supabase, EU, Ireland) and your Search Console performance warehouse, application compute and embedding service (Hetzner, Germany, EU) are hosted in the European Union, as is product analytics (PostHog, EU). The remaining sub-processors above are US-based and support billing, email delivery, marketing-site hosting, advertising conversion measurement, and the Google and Bing APIs you connect; transfers to them are made under the EU Standard Contractual Clauses. Yandex, if you connect it, receives no data from me beyond the requests described above. A Data Processing Agreement is available to business customers on request.

The list above is my current set of sub-processors and is published publicly on this page. I notify customers of any new sub-processor at least 30 days before it begins processing your data, by email and via the RSS feed for this page, and you may object during that notice period.

5. Analytics, Advertising & Error Tracking

I use PostHog to understand how the product is used and to catch errors.

Marketing site (before sign-in)

Cookieless, aggregated tracking only: page path, referrer, coarse country, device type. No identifiers are stored on your device until you accept the cookie banner.

Application (after sign-in)

If you accept analytics cookies, PostHog associates events with your user ID so I can reproduce bugs you report and understand which features are used. Events cover feature usage, session duration, and errors. Your Search Console data is never sent to PostHog.

Advertising measurement

I advertise GSC Wizard on Google Ads. The Google tag runs on both the marketing site and the app, because the ad click lands on one and the account is created on the other; without it I cannot tell which ads actually produce signups. Until you accept cookies it runs with advertising and analytics storage denied: nothing is stored on your device and Google is sent no identifier, only an unattributed signal it uses to estimate conversions. Accepting lets it set the first-party _gcl_au identifier described in the Cookie Policy. What is reported is that a signup happened; your Search Console data is never sent to Google Ads.

6. Cookies

See the dedicated Cookie Policy for the full list of cookies and local-storage keys used by the service.

7. Data Retention

• Account, linked Google accounts & linked Yandex account: kept until you delete your account or disconnect the integration.
• Merchant Center warehouse data: kept while the property stays linked to that Merchant Center account. It is deleted when you unlink the account or link the property to a different one, and when you delete your GSC Wizard account. If a property is removed from GSC Wizard another way, a weekly clean-up deletes its Merchant Center data within 7 days.
• Yandex reports: not stored; cached for up to 60 minutes.
• Report cache: automatically expires based on per-entry TTL.
• CTR-curve & API-usage data: auto-cleaned after ~7 days.
• Rate-limit entries: auto-cleaned once expired.
• Property icons: refreshed every 30 days while in use, and deleted from the favicons bucket once no property in any GSC Wizard account uses that hostname any more (for example after the property is removed or the account is deleted).
• URL inspections, indexing history, on-page crawls, Feed Audit runs, GSC messages, redirect mappings, IndexNow submissions: kept for as long as the related site exists, as a historical audit trail.
• Magic links & client sessions: short expiry (hours).
• API keys & MCP audit log: keys are kept until you revoke them or delete your account. Individual audit-log entries are deleted after 7 days, or earlier when you delete your account or on request. Daily usage counts per user, per tool and per property are kept for 400 days for security monitoring and usage analytics. OAuth access tokens are short-lived (hours) and refresh on use.
• Billing records: retained as long as required by applicable tax and accounting law.

8. Security

• Google and Yandex OAuth tokens and Bing API keys are encrypted at rest (AES-256-GCM).
• Row-level security policies on every database table restrict rows to their owner.
• The performance warehouse (ClickHouse), including its Merchant Center tables, enforces a per-tenant row policy, so each query returns only your own rows.
• Traffic is served over HTTPS/TLS.
• Primary data (the account database and the performance warehouse) is hosted in the EU.
• Access to the production database and warehouse is restricted to the service role and to me as the operator; there are no other employees or contractors with standing access.

9. Google API Services

GSC Wizard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data I access through Google APIs is used only to provide the user-facing features you request:

• Search Console (webmasters.readonly by default) - to build the performance and indexing reports in the app. The optional full-access scope (webmasters) additionally allows sitemap submission and property creation, and the web app currently also asks for it before running the URL-inspection reports and Indexing tracker checks; it is requested only if you choose full access when connecting.
• BigQuery (bigquery.readonly, optional) - to read the Search Console bulk-export rows from your own BigQuery dataset for faster, higher-volume reporting.
• Google Analytics 4 (analytics.readonly, optional) - to list the GA4 properties you can access and to read their traffic, engagement and conversion metrics so they can be shown alongside your Search Console data.
• Merchant Center (content, optional) - to read the Merchant Center accounts you link, their product listings and product statuses, and Merchant Center's performance, price, competitive-visibility and best-seller reports, for the Organic Shopping, Title Hygiene and Feed Audit reports and Merchant Center alerts. Google offers no read-only version of this scope; the only change made with it is the developer registration you start yourself (see 2.1).

This data is not shared with third parties, is not used for advertising, and is not used to train generalized ML/AI models. The optional BigQuery, GA4 and Merchant Center scopes are requested only when you choose to connect those integrations, can be revoked at any time from your Google Account, and are never requested for users who do not opt in.

10. Your Rights

You have the right to:

• Access and export your data from your account page.
• Request correction or deletion of your account and all associated data.
• Revoke Google's OAuth grant at any time via your Google Account settings, and Yandex's by disconnecting it in the app or from your Yandex ID settings.
• Withdraw analytics consent at any time via the cookie banner.
• Lodge a complaint with your local data-protection authority.

11. Children's Privacy

This service is not intended for children under 13 and I do not knowingly collect personal information from children under 13.

12. Changes to This Policy

I may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated "Last updated" date.

13. Contact

Questions or data-subject requests:

privacy@gscwizard.com