Privacy policy

AI Growth Manager is owned and operated by Mohd Arsad, trading as AI Growth Manager, a sole proprietor established in the United Arab Emirates. That is the party responsible for the personal data described below, and the party to contact about it, at privacy@aigrowthmanager.com.

Account: your name, email address, hashed password (or your Google account identifier if you sign in with Google), and the workspaces you belong to.

Project data: the sites, listings and repositories you add, everything an audit measures about them, and the findings, opportunities, experiments and reports built from those measurements.

Connected sources: access tokens and API credentials you choose to connect, encrypted at rest with AES-256. They are never displayed back, exported, or included in reports.

Operational records: sign-in times, audit-log entries of who changed what, email delivery records, usage counters, and provider billing events.

Anonymous audits: if you run the free audit from our home page without an account, we store the URL, the findings, a hashed form of your IP address and a random device token — so the same visitor cannot re-run it endlessly. The raw IP is not stored.

We do not sell your data, share it with advertisers, or use it to train third-party models. We do not put tracking pixels in our emails. We do not collect page content, form input or cookies from visitors to sites where you install the fix snippet — it fetches the fixes you approved and applies them, nothing more.

To run the service you asked for: performing audits, storing their evidence, showing your history, sending the emails you enabled, enforcing plan limits, and taking payment. We keep audit evidence because the product’s value is that a figure can always be traced back to its source.

Paddle.com Market Ltd — payments and subscriptions as merchant of record; receives your billing details directly, not through us. Resend — transactional email delivery. Google (Search Console, Analytics, PageSpeed Insights), DataForSEO, GitHub and public app-store endpoints — only for the sources you connect. Our servers and database are hosted in the EU.

If you choose to connect Google Search Console and/or Google Analytics, we request read-only access (the webmasters.readonly and analytics.readonly scopes) to the properties you select. We use that data only to show you your own search queries, clicks, impressions, positions and traffic inside your audits, findings and reports. We never write to, change or delete anything in your Google accounts.

AI Growth Manager’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, do not transfer it to third parties except as needed to provide the features you asked for or to comply with law, do not use it to develop, improve or train generalised AI or machine-learning models, and no human reads it except with your explicit consent, for security, or where the law requires. You can disconnect at any time from the project’s integrations page, which deletes the stored token immediately, and you can also revoke access at myaccount.google.com/permissions.

Encrypted in transit. Every connection to AI Growth Manager uses HTTPS with HSTS, and our calls to Google’s APIs use TLS. Plain-HTTP sign-in is not possible.

Credentials encrypted at rest. We do not store Google access tokens; we request a short-lived one from Google each time we read your data. The long-lived refresh token is encrypted with AES-256-GCM in our application before it reaches the database, using a key that lives only in the server’s environment and never in the database. It is never displayed back, exported, written to logs or included in reports.

Only what we need, and where it is kept. We read your Search Console queries, clicks, impressions and positions and your Google Analytics sessions, users, engagement and conversions for the property you pick, and keep those figures as evidence attached to your own audits. We read nothing else from your Google account.

Separated by workspace. Every record belongs to exactly one workspace and every query is scoped to it, so one customer cannot see another’s data. Within a workspace, only members allowed to manage projects can connect or disconnect Google.

Protected infrastructure. Our servers and database are hosted in the EU. The database has no public network port and the application is reachable only through our HTTPS proxy. Sessions use signed, HttpOnly, Secure cookies and can be revoked; passwords are stored only as bcrypt hashes. Sign-in, sign-up, audit and export requests are rate limited.

Restricted staff access. As described below, our staff cannot read the content of your audits by default. Any exception lasts at most 24 hours, needs a written reason and is recorded against the person’s name. Changes in your workspace, including connecting and disconnecting integrations, are recorded in an append-only activity log that excludes credentials.

Deletion. Disconnecting Google deletes the stored refresh token immediately. Email privacy@aigrowthmanager.com to have the Google-derived data deleted with the rest of your workspace; copies in backups expire within 30 days. If we learn of a security breach that affects your data, we will tell affected users and, where the law requires, the authorities, without undue delay.

Our staff do not browse your reports. Access to the content of your audits — findings, evidence and generated reports — is switched off by default in our own administration tools, which show counts rather than content.

When you ask us for help with something we cannot diagnose from counts alone, a member of our team can grant themselves access to one workspace for up to 24 hours. Doing so requires a written reason, is recorded against that person’s name, and expires by itself. Everything else our staff can see — your plan, your subscription state, how many projects and audits exist — is operational information rather than the content of your work.

We keep a record of changes made in your workspace: who made the change, what changed, when, and the IP address and browser it came from. We keep it to answer security questions, to resolve disputes about what happened to an account, and so that a workspace owner can see who on their team changed something.

The record excludes passwords, tokens and integration credentials — those are never written to it. It is append-only: nobody, including us, can edit or delete an entry. We keep it for 24 months, and entries relating to billing or to a suspension for seven years, because those are what a payment dispute or a legal request asks about.

If we suspend an account, we retain the reason, our notes, any appeal you file and the outcome — after the account closes, and for seven years. We keep it so that a decision can be reviewed, so we can answer a payment provider or regulator who asks about it, and so that the same account is not wrongly re-created. Read the acceptable-use rules in our terms.

Account and project data: while your account exists, and for 30 days after deletion in backups. Anonymous free-audit records: 90 days. Email delivery logs: 12 months. Billing records: as long as tax law requires, usually 7 years, held largely by Paddle.

Email privacy@aigrowthmanager.com to get a copy of your data, correct it, or have it deleted. We answer within 30 days. You can disconnect any integration at any time from the project’s integrations page, which deletes the stored credential immediately. If you are in the UK or EU you may also complain to your data protection authority.

We use a session cookie to keep you signed in, a cookie to remember which workspace you are viewing, and — for the free anonymous audit — a device token cookie so one machine cannot run it repeatedly. There are no advertising or analytics cookies on this product.