Privacy Policy

1. Data we collect

Account data: name, email address and password (hashed) when you create your account.

Project data: the brand names, domains, keywords and competitors you configure for tracking.

Google data (with your explicit authorization): see section 2 below.

Technical data: standard access logs (IP address, browser) required for the security and proper operation of the service.

2. Google data — Search Console, Google Analytics and Business Profile

If you choose to connect your Google accounts, Kaiku requests the following permissions (scopes). The first two are read-only; the third is optional and is requested only if you wish to track your Google Business Profile listing:

• https://www.googleapis.com/auth/webmasters.readonly — read access to your Google Search Console data (search queries, clicks, impressions, positions, list of your properties).
• https://www.googleapis.com/auth/analytics.readonly — read access to your Google Analytics 4 data (sessions, pages viewed, conversions, list of your properties).
• https://www.googleapis.com/auth/business.manage — access to your Google Business Profile listings: reading performance (impressions, clicks, calls, direction requests), the searches that displayed the listing, and reviews; the only write performed is publishing, editing or removing a reply to a review that you write or explicitly approve in Kaiku. No other listing information is modified.

What we do with it:

• Display this data in your Kaiku dashboard;
• Cross-reference it with your visibility in AI engines (ChatGPT, Perplexity, Gemini, Google AI Overviews) to produce analyses and recommendations intended for you;
• For the business listing: keep the history of its performance, searches and reviews in your project, produce analyses (including AI-generated analyses), and publish to your listing the review replies you approve.

What we never do with it: we do not sell this data, we do not use it for advertising purposes, we do not transfer it to third parties, and no human views it — except with your explicit consent as part of a support request, or where required by law.

Retention and deletion: Google access tokens are encrypted at rest. Retrieved data is cached in our database to display your reports. You can disconnect your Google accounts at any time from Kaiku's settings or revoke access at myaccount.google.com/permissions. Deleting your Kaiku account results in the deletion of your tokens and of the cached Google data within 30 days.

3. Sharing, transfer and disclosure of Google data

We never sell, rent or transfer your Google data to third parties for advertising, data brokerage, credit assessment or lending purposes. Your Google data is shared, transferred or disclosed only in the following limited cases:

• Subprocessors (infrastructure providers): Vercel (interface hosting), Railway (application server hosting) and Supabase (authentication and database) process and store the data solely on our behalf, for the sole purpose of operating Kaiku, and are bound by contractual confidentiality and security obligations. The infrastructure is located in the United States and Canada. None of these providers uses your Google data for its own purposes.
• Collaborators you invite: if you share a Kaiku project with other users (owner/editor/viewer roles), the reports displaying your GSC/GA4/Business Profile data in that project are visible to them. This sharing is entirely under your control and can be revoked at any time.
• Legal obligation: where required by law, a court order or a valid legal process.
• Business transfer: in the event of a merger or acquisition, your data would remain protected by this policy and you would be notified before any transfer.

Outside these cases, no Google data is shared, transferred or disclosed to anyone. Your Google data is never used to train artificial intelligence or machine learning models, whether generalized or personalized.

4. Data protection (security mechanisms)

We protect your data, including sensitive Google data, through the following mechanisms:

• Encryption in transit: all communications use HTTPS/TLS 1.2 or higher, including exchanges with Google APIs.
• Encryption at rest: the database is encrypted at rest (AES-256); Google OAuth tokens are subject to additional application-level encryption.
• Access control: per-user data isolation at the database level (Row Level Security) — each user can access only their own data and the projects that have been explicitly shared with them.
• Least privilege: we request only the Google scopes required for the features described in section 2 — read-only for Search Console and Analytics; the optional Business Profile scope is used in write mode only to publish the review replies you approve.
• Secrets management: API keys and credentials are stored in secured environment variables, never in the source code.
• Restricted human access: no employee views your Google data, except with your explicit consent during a support request or where required by law.
• Incident notification: in the event of a security incident affecting your data, we will notify you as soon as possible and no later than 72 hours after becoming aware of it, in accordance with Law 25 (Québec).

5. Cookies

Kaiku uses only cookies that are essential to its operation (authentication session, language and project preferences). No advertising or third-party tracking cookies are used.

6. Your rights

You may request access to, correction of or deletion of your personal information by writing to info@tangramhq.com. We respond within 30 days, in accordance with Law 25 (Québec) and the applicable laws on the protection of personal information.

7. Changes

Any substantial change to this policy will be announced on this page with a new update date.