Your privacy, protected.

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support.

• Account information (name, email address, company name)
• Brand and website URLs you submit for analysis
• Usage data and in-product analytics (pages visited, features used)
• Communication preferences and support correspondence
• OAuth tokens obtained when you connect third-party services (GA4, GSC) — stored encrypted and never exposed client-side

Forzeo offers an optional Google Analytics 4 connector that lets you see how much traffic AI assistants (ChatGPT, Perplexity, Gemini, Claude, Copilot, and others) are sending to your website. Connecting GA4 is entirely optional and requires your explicit authorisation via Google's OAuth 2.0 + PKCE flow.

What we access when you connect GA4:

• Read-only access to your GA4 properties — we list your available GA4 accounts and properties so you can choose which one to connect. We never modify your GA4 configuration.
• AI referral traffic metrics — via the GA4 Data API we query sessions, engaged sessions, engagement rate, conversions, active users, and average session duration, filtered to referral traffic originating from AI assistant domains (e.g. chatgpt.com, perplexity.ai, claude.ai, gemini.google.com).
• Date-level breakdowns — data is retrieved for the last 30 days and stored per brand, per date, per AI source so you can track trends over time.
• Connected Google account email — stored to identify which Google account authorised the connection and to display it in your dashboard settings.
• OAuth refresh token — stored securely in our backend (Firebase/Google Cloud) so we can silently refresh access on your behalf without requiring you to re-authenticate. Tokens are never sent to your browser.

How we use this data:

• Display your AI Traffic Analytics dashboard — showing which AI platforms drive traffic, session quality, and conversion trends.
• Correlate AI mention data (from Forzeo's prompt tracking) with actual referral sessions to measure GEO impact.
• We do not sell, share, or use your GA4 data to train any models or for any purpose other than displaying it back to you.

You can disconnect GA4 at any time from your dashboard Connectors tab. On disconnection, your OAuth tokens are immediately deleted from our systems. Synced traffic logs are retained for 90 days and then automatically purged. You can also revoke access directly via your Google Account permissions page.

Forzeo offers an optional Google Search Console connector that enriches your Web Health dashboard with real search performance data for every page on your site. Like GA4, connecting GSC is entirely optional and requires your explicit authorisation via Google's OAuth 2.0 flow.

What we access when you connect GSC:

• List of verified GSC properties — we retrieve the sites you have verified in Search Console so you can select which property to link to your brand.
• Sitemap data — we fetch your submitted sitemaps (up to 5 sitemaps, 500 URLs) and parse them to extract all submitted page URLs and their lastmod dates.
• Search analytics metrics per URL — via the Search Console API we query clicks, impressions, click-through rate (CTR), and average position over the last 90 days for each page in your sitemap.
• Connected Google account email — stored to identify the authorising account and displayed in your dashboard settings.
• OAuth refresh token — shared with the GA4 connection (a single Google OAuth grant covers both services when you authorise via the same flow), stored securely on our backend.

How we use this data:

• Display per-page SEO performance (clicks, impressions, CTR, average position) in your Web Health dashboard alongside our own crawl signals.
• Identify pages in your sitemap that are not yet indexed or have no impressions, so you can prioritise content improvements.
• Cross-reference sitemap coverage against our own crawl results to highlight pages that have not been crawled by Forzeo yet.
• We do not sell, share, or use your GSC data to train any models or for any purpose other than displaying it back to you.

You can disconnect GSC at any time from your dashboard Connectors tab. On disconnection, your OAuth tokens are immediately deleted from our systems. You can also revoke access directly via your Google Account permissions page.

We use the information we collect to:

• Provide, maintain, and improve our platform and services
• Send you technical notices, security alerts, and support messages
• Respond to your comments, questions, and support requests
• Analyse aggregate usage patterns to improve user experience
• Process payments and manage your subscription
• Comply with legal obligations and enforce our terms of service

We retain your data only for as long as necessary to provide our services or as required by law.

• Account data — retained while your account is active and for a reasonable period after deletion to comply with legal obligations.
• GA4 AI traffic sync logs — retained for 90 days per sync cycle, then automatically purged.
• GSC search analytics data — fetched on demand (not stored long-term); each fetch covers the preceding 90-day window from Google's API.
• OAuth tokens (GA4 & GSC) — deleted immediately upon disconnection from the Connectors tab or upon account deletion.

We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes TLS encryption in transit, encrypted storage for OAuth tokens, server-side access controls via Firebase Security Rules, and regular security reviews. OAuth refresh tokens for GA4 and GSC are stored exclusively on our backend and are never transmitted to the browser.

You have control over your data at all times:

• Disconnect integrations — disconnect GA4 or GSC at any time from the Connectors tab in your dashboard. Tokens are deleted immediately.
• Revoke Google access — revoke Forzeo's Google OAuth access at any time via myaccount.google.com/permissions.
• Access & portability — request a copy of the data we hold about you by contacting us at contact@forzeo.com.
• Deletion — request deletion of your account and associated data at any time by contacting us.

If you have any questions about this Privacy Policy, please contact us at contact@forzeo.com