Privacy policy

Last updated: November 6, 2026

This privacy policy explains what information WebGrowthEngine ("WebGrowthEngine", "we", "us") collects when you use our website at webgrowthengine.com, our web application and our API (together, the "Service"), how we use, store, share and protect it, and the choices you have. It includes a dedicated section, Google user data, on how we handle data we receive from Google.

If you have any questions, contact us at info@webgrowthengine.com.

Summary

We collect the information you give us, the information needed to run the Service, and, only if you choose to connect them, data from services such as Google Search Console.
We use your information to provide the Service to you. We do not sell your personal information and we do not use it for advertising.
Data from Google APIs is used only to provide features you can see in WebGrowthEngine, follows the Google API Services User Data Policy, including the Limited Use requirements, and is deleted when you disconnect.
You can export your data, delete your account and disconnect connected services at any time.

Information we collect

Information you give us

Account information: your name, email address and password. Passwords are stored only as a secure one-way hash.
Workspace information: workspace names, team members and invitations, the websites (projects) you add, business details you enter or confirm, competitors and keywords you track, and settings you choose.
Content you create: content drafts, growth plans, notes, reports and anything else you write or generate in the Service.
Lead and outreach information: leads you find or import, the emails you write and send through the Service, and the settings of email accounts you connect (described below).
Messages to us: what you send through our contact form or to our support team.

Information from sign-in providers

If you sign in with Google or GitHub, we receive your name, email address, account identifier and profile picture from that provider. We never receive your Google or GitHub password. See the Google user data section below for details on Google sign-in.

Information from services you connect

These connections are optional. You start each one and can disconnect it at any time.

Google Search Console and Bing Webmaster Tools: read-only search performance data for the website properties you choose. See the Google user data section below.
Email accounts (SMTP, IMAP or POP3): the server settings and login details of a mailbox you connect to send outreach emails from your own address and to receive replies. Passwords are encrypted. We only file messages that are replies to outreach emails sent through the Service; other mail in your mailbox is left alone and not stored.
CRM tools (HubSpot, Pipedrive, Google Sheets): the API key or address needed to send your leads to the tool you choose.
Your own AI keys: if your workspace adds its own AI provider key, we store it encrypted and use it only for your workspace's AI requests.

Information collected automatically

Technical and security information: IP address, browser type, device information, pages visited in the app, and timestamps, used for security, rate limiting, fraud prevention and troubleshooting. For instant scans run without an account, we store only a keyed hash of the IP address, never the address itself.
Usage and billing information: your plan, usage counts (for example audits and AI analyses), invoices and payment status.
Push notifications: if you turn on browser notifications, your browser's push subscription details.
Cookies: see the Cookies section below.

Information about websites you analyse

When you ask us to scan or audit a website, we fetch its publicly accessible pages, as a search engine would, after checking its robots.txt. We store the results (for example page titles, status codes, links and findings) and, for a limited time, compressed copies of the pages used for the analysis. We never log in to websites, submit forms or run their JavaScript on our servers.

Google user data

This section describes how WebGrowthEngine accesses, uses, stores, shares and deletes data received from Google APIs ("Google user data").

What we access

Sign in with Google. If you choose to sign in with Google, we request the openid, email and profile scopes. We receive your name, email address, Google account identifier and profile picture.

Google Search Console (optional). If you connect Google Search Console to a project, we request read-only access with the https://www.googleapis.com/auth/webmasters.readonly scope, together with openid and email to show you which Google account is connected. With this access we read:

the list of Search Console properties your Google account has access to, so you can choose the one that matches your website; and
for the single property you select, search performance data: clicks, impressions, click-through rate and average position, by date, by search query and by page.

The access is read-only. WebGrowthEngine cannot change your Search Console settings, verify or remove properties, submit sitemaps or access any other Google service or data.

How we use it

Google sign-in data is used only to create your WebGrowthEngine account, sign you in, and show your name and picture in the app.
Search Console data is used only to provide features you can see in your project:
- search performance reports (clicks, impressions, click-through rate and position over time, top queries and top pages);
- keyword position tracking for the keywords you choose;
- suggestions for pages that may need refreshing; and
- when AI features are on for your workspace, AI-generated growth plans and content-refresh suggestions. For these, a limited summary is sent to our AI providers: totals for the last 28 days and up to 15 of your top search queries with their metrics, or the queries and metrics for the specific page being refreshed. The results are shown only to your workspace.

We never send your account information — your name, email address, password or the data we receive from Google sign-in — to our AI providers.

What we do not do with Google user data

We do not sell Google user data.
We do not use or transfer Google user data for advertising, including retargeting, personalised or interest-based advertising.
We do not use Google user data to determine creditworthiness or for lending purposes.
We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models, and our AI providers process it under terms that do not allow them to use it to train their models.
We do not allow humans to read Google user data, unless you give us your consent for specific data (for example when you ask for support), it is necessary for security purposes (such as investigating abuse), it is required by law, or the data has been aggregated and anonymised for internal operations.

How we store and protect it

Google user data is stored in our database on secured servers. OAuth access and refresh tokens are encrypted at rest, are never displayed and are never written to logs. All data is sent over encrypted (HTTPS/TLS) connections. Search Console data is visible only to members of the workspace that connected it.

How we share it

We share Google user data only:

with our AI providers (Anthropic and OpenAI), limited to the summary described above and only when AI features are on for your workspace, to generate results for you;
with our hosting and infrastructure providers, which store and process data on our behalf to run the Service; and
when required by law, or as part of a merger, acquisition or sale of assets, in which case the data remains subject to this policy.

We do not share Google user data with anyone else.

How long we keep it and how to delete it

Search Console data is kept while the connection is active and is updated regularly while you stay connected.
When you disconnect Google Search Console in your project, we immediately revoke our access at Google and delete the stored tokens and all imported Search Console data.
Deleting a project, workspace or your account also deletes the related Google user data.
Google sign-in data is kept while your account exists. You can unlink Google in Settings → Security, and it is deleted with your account.
You can also remove WebGrowthEngine's access at any time in your Google Account at myaccount.google.com/permissions.

Limited Use disclosure

WebGrowthEngine's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use the information we collect to:

provide, operate and maintain the Service, including audits, reports, AI features and integrations you turn on;
create and secure your account, and authenticate you;
process payments and manage your subscription;
send service emails, such as email verification, password resets, invitations, receipts and important notices about the Service;
respond to your requests and provide support;
keep the Service secure, prevent fraud and abuse, and enforce our terms;
understand and improve how the Service is used, using aggregated usage information; and
comply with legal obligations.

Where the law requires a legal basis, we rely on: performing our contract with you; our legitimate interests in running a secure and reliable service; your consent (for example for analytics and marketing cookies, which you can withdraw at any time); and legal obligations.

AI processing

Some features use AI models from Anthropic and OpenAI to produce suggestions such as business details, content reviews, content drafts, growth plans, outreach emails and reply sorting. To do this, we send the information the feature needs: for example readable text from public pages of the website being analysed, business details you have entered, lead details for outreach, and, if connected, the limited Search Console summary described above. We never send your account information — your name, email address, password or the data we receive from Google sign-in — to our AI providers, and we never send payment details.

Our AI providers process this data on our behalf to return results, under terms that do not permit them to use it to train their models. AI results are labelled as suggestions and are not used to make decisions about you that have legal or similarly significant effects.

Workspace owners can turn AI processing off at any time in Settings → Privacy. If your workspace uses its own AI provider key, requests are sent to that provider under your own agreement with them.

How we share information

We do not sell or rent your personal information. We share it only as follows:

Service providers that process data on our behalf under contracts that protect it:
- cloud hosting and infrastructure providers, which run our servers and databases;
- email delivery providers, which send our service emails;
- Stripe, which processes payments (card details are entered directly with Stripe and never stored by us);
- Anthropic and OpenAI, which provide AI models;
- Cloudflare, which provides bot protection (Turnstile) on sign-up and on the free scan;
- search data providers, which receive only website addresses and keywords, not personal information, to return rankings and link data.
Services you connect or instruct us to send data to, such as your email server, your CRM, webhooks or API clients you set up, and people you share a report with.
Your workspace: information in a workspace is visible to its members according to their roles.
Legal reasons: when required by law or legal process, or to protect the rights, safety and security of our users, the public or WebGrowthEngine.
Business transfers: if WebGrowthEngine is involved in a merger, acquisition or sale of assets, in which case your information remains subject to this policy.

Lead finder and email outreach

The lead finder collects business contact details that companies publish on their own websites, and, where enabled, from licensed business-contact data providers. When you add leads and send outreach emails through the Service, you decide whom to contact and what to send, and you are responsible for complying with applicable anti-spam and data protection laws. Every outreach email includes an unsubscribe option, and unsubscribed addresses are not contacted again. If you have received an email sent through WebGrowthEngine and want your details removed, contact us at info@webgrowthengine.com.

Visitor analytics for your website

If you add our visitor analytics script to your website, we process visits to your website on your behalf. It uses no cookies and stores no IP addresses: a visitor is counted with a hash of the IP address and browser that uses a salt changed every day, so the same person cannot be recognised across days or across websites. Approximate location is looked up from the IP address when the visit starts, and the address is then discarded. You are responsible for informing visitors to your website about this analytics.

Cookies

We use cookies that are strictly necessary for the Service to work: a session cookie to keep you signed in, a security token to protect forms, an optional "keep me signed in" cookie, and a cookie that remembers your cookie choices. If you change the language, a cookie remembers your choice.

On our public website we may also use analytics tools (Google Analytics or Google Tag Manager) and marketing tools (Meta Pixel), but only if you consent. You can change your choice at any time with the "Cookie settings" link in the footer. These tools are not loaded in the logged-in application. Our cookie policy lists every cookie we use.

How long we keep information

We keep information only as long as needed for the purposes described in this policy:

Information	How long we keep it
Account and workspace data	While your account is active; deleted when you delete your account
Google Search Console and Bing data	While connected; deleted immediately when you disconnect
Copies of crawled web pages	14 days (the audit results are kept)
Audits older than your plan's report history	Deleted 30 days after falling outside the history
Instant scans run without an account	90 days
Accounts whose email was never verified	30 days
Individual visits recorded by visitor analytics	90 days (daily totals are kept for reports)
Contact form messages	2 years
Records of cookie choices	2 years
AI usage records (tokens, cost and status only)	400 days
Security and activity log	1 year
Processed payment notifications	90 days
Your data export files	7 days
Invoices	7 years, as required for bookkeeping, also after an account is deleted

How we protect information

We use administrative, technical and physical safeguards appropriate to the data we handle, including encryption in transit (HTTPS/TLS), encryption at rest for OAuth tokens, mailbox passwords and API keys, hashed passwords, optional two-factor authentication, role-based access within workspaces, restricted staff access and activity logging. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach where the law requires.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict its processing, and to withdraw consent at any time. In WebGrowthEngine you can:

export your data in Settings → Privacy;
delete your account in Settings → Privacy;
turn AI processing off for a workspace you own in Settings → Privacy;
disconnect Google Search Console, Bing or other integrations in your project or workspace settings;
unlink Google or GitHub sign-in in Settings → Security; and
change your cookie choices with the "Cookie settings" link.

For any other request, contact info@webgrowthengine.com. We will respond within 30 days. You may also complain to your local data protection authority.

International transfers

We and our service providers may process information in countries other than your own, including the United States. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, notify you by email or in the Service before they take effect.

Contact us

WebGrowthEngine Email: info@webgrowthengine.com Website: webgrowthengine.com