This policy explains what personal data SaaSMaestro (“SaaSMaestro”, “we”, “us”) collects when you visit our website or use the service, why we collect it, who we share it with, how long we keep it and the choices you have. It applies to everyone who uses SaaSMaestro: account owners, team members invited to a workspace, and people who receive reports by email.
If anything here is unclear, or you want to exercise any of your rights, email hello@saasmaestro.com.
Contents
Who we are and our role
SaaSMaestro is a dashboard that brings Google Analytics 4 and Google Search Console data for many websites onto one screen, flags issues and sends scheduled reports.
For your account details, and for how we run and secure the service, we are the controller of your personal data. For the analytics data and other content you bring into a workspace, the workspace owner decides what is connected and who sees it, and we process that data on their behalf as a processor. If you are a team member or report recipient and have questions about a workspace’s data, the workspace owner is usually the best first contact, though you can always contact us too.
What we collect
Information you give us
- Account details: your name, email address and password. Passwords are stored only as a one-way hash; we never see or store the password itself.
- Workspaces and teams: the workspaces you create or join, their names and settings, your role in each (owner, admin, member or viewer), and the email addresses of people you invite, along with the status of each invitation.
- Sites and groups: the website names and domains you add, the groups you organise them into, and the sites you mark as favourites.
- Content you create: timeline notes, checklist progress, report layouts and preferences, and report schedules, including the email addresses you schedule reports to be sent to.
- Messages to us: anything you send us when you contact support, including your email address and the content of your message.
Information from Google, with your permission
- Google account connection: when you connect a Google account we receive OAuth access and refresh tokens and basic identifying details of that Google account (such as its email address), so we can show which account is connected. Tokens are encrypted at rest.
- Google Analytics 4 data: the list of GA4 properties your Google account can see, and aggregated daily metrics for the properties you add, such as sessions, users, engaged sessions, conversions, and breakdowns by page, source and similar dimensions.
- Google Search Console data: the list of Search Console sites your Google account can see, and aggregated performance data for the sites you add, such as clicks, impressions, average position, and top queries and pages.
This data is aggregated reporting data as provided by Google’s reporting APIs. We do not request or receive raw, event-level data about individual visitors to your websites. Search queries shown in Search Console reports are aggregated by Google and are not linked to identifiable people.
Information collected automatically
- Log data: our servers record standard request information, such as IP address, browser user agent, the pages requested, timestamps and error details. We use it to keep the service secure, investigate problems and prevent abuse.
- Session data: when you sign in we store a session record (including your IP address and user agent) so you stay signed in, and a security token that protects forms against cross-site request forgery.
- Usage within the app: the actions you take that the service needs to remember, such as your current workspace, when a site was last synced and when a report was last sent.
We do not use third-party analytics, advertising pixels or tracking scripts on our website or in the app.
How we use it
- To provide the service: creating and managing your account and workspaces, syncing your Google data on a regular schedule (currently every few hours) and on demand, calculating trends and issues, and displaying dashboards, insights and reports.
- To send the emails you ask for: scheduled reports, issue alerts and digests, team invitations, and account emails such as email verification and password resets.
- To generate exports: CSV and PDF exports that you or your team members request.
- To keep the service secure and reliable: authenticating you, preventing fraud and abuse, monitoring performance, diagnosing errors and keeping backups.
- To support you: responding to questions and requests you send us.
- To meet legal obligations: complying with applicable law and responding to valid legal requests.
We do not sell your personal data, share it for cross-context behavioural advertising, or use it to build advertising profiles. We do not use your Google data, or any other customer data, to train artificial intelligence or machine learning models.
Legal bases for processing
Where data protection laws such as the UK GDPR or EU GDPR apply, we rely on the following legal bases:
- Contract: to provide the service you signed up for, including account management, syncing, reports and emails you request.
- Legitimate interests: to keep the service secure, prevent abuse, fix problems and improve how SaaSMaestro works, in ways that do not override your rights.
- Consent: to access your Google data, which you grant through Google’s consent screen and can withdraw at any time.
- Legal obligation: where we must keep or disclose data by law.
Google user data
SaaSMaestro’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- Read-only scopes: we request only
analytics.readonly (Google Analytics) and webmasters.readonly (Search Console). SaaSMaestro cannot create, change or delete anything in your Google accounts, properties, tags or settings.
- Limited use: we use Google user data only to provide and improve the user-facing features of SaaSMaestro that you can see in the app, such as dashboards, issue detection, reports and exports.
- No transfers except as described: we do not transfer Google user data to others except as needed to provide the service (for example to our hosting provider, or in a report you schedule), to comply with law, or as part of a merger or acquisition with notice to you.
- No advertising: we never use Google user data to serve advertisements, including retargeting, personalised or interest-based ads.
- No human access to your Google user data, unless you give us explicit permission for a specific purpose (such as a support request), it is necessary for security purposes such as investigating abuse, to comply with law, or the data has been aggregated and anonymised for internal operations.
- No sale of Google user data, and no use of it to determine creditworthiness or for lending purposes.
You can revoke SaaSMaestro’s access at any time from the Connections page, or from your Google account permissions. Revoking access stops further syncing immediately. Metrics already synced remain in your workspace until you delete the relevant sites or your account.
Emails we send
- Service emails such as email verification, password resets and team invitations. These are necessary to operate your account.
- Issue alerts and digests about the sites in your workspace, such as a daily alert when something looks broken and a weekly digest. Workspace admins set the defaults, and you can turn any of them off for yourself in workspace settings or with the unsubscribe link in each email.
- Scheduled reports sent to the recipients a workspace member chooses. Recipients do not need a SaaSMaestro account. If you receive a report you didn’t expect, contact the sender or email us and we will stop sending it.
- Important notices about changes to the service, these terms or this policy, sent to account owners.
We do not send marketing email without your consent.
Who we share data with
Within your workspace. Data in a workspace is visible to its members according to their role. Reports you schedule are delivered to the recipients you choose, and exports can be downloaded by workspace members.
Service providers. We use a small number of providers to run SaaSMaestro, who process data only on our instructions and under contracts that require them to protect it:
- Hosting and infrastructure: servers, databases and backups where the service and your data are stored.
- Email delivery: sending account emails, alerts and reports.
- Google: when you connect a Google account, we exchange data with Google’s APIs on your behalf. Google’s handling of your data is governed by Google’s own privacy policy.
- Bunny Fonts: our pages load the Inter typeface from fonts.bunny.net, which receives your IP address and browser details in order to deliver the font files. Bunny Fonts does not use cookies or log personal data for tracking.
An up-to-date list of the providers that process personal data is available on request.
Legal and safety reasons. We may disclose information if we believe in good faith it is required by law, court order or a valid request from a public authority, or necessary to protect the rights, safety or property of our users, the public or SaaSMaestro.
Business transfers. If SaaSMaestro is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will tell you before your data becomes subject to a different privacy policy.
International transfers
Our providers may process data in countries other than the one you live in. Where personal data from the UK, EU or EEA is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
Cookies and similar technologies
We use only cookies that are strictly necessary for the service to work, so we don’t show a cookie banner:
- Session cookie (
saasmaestro-session): keeps you signed in and remembers your current workspace. It expires when the session ends or after a period of inactivity.
- Security cookie (
XSRF-TOKEN): protects forms against cross-site request forgery.
- Remember-me cookie: set only if you tick “Remember me” when signing in, so you stay signed in across browser sessions. Signing out removes it.
We do not use advertising, analytics or social media cookies. Your browser may also store small preferences locally, such as interface settings; these never leave your device.
Security
We use technical and organisational measures appropriate to the data we hold, including:
- encryption in transit (HTTPS) for all traffic to and from SaaSMaestro;
- encryption at rest for Google OAuth tokens, and one-way hashing for passwords;
- read-only access to Google, so a compromise of SaaSMaestro could not be used to change your Google properties;
- role-based access within workspaces, and isolation between workspaces;
- restricted access to production systems, limited to people who need it to run the service.
No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities where the law requires it, without undue delay. If you believe you have found a security issue, please report it to hello@saasmaestro.com.
Retention and deletion
- Account data is kept while your account is active.
- Synced metrics are kept while the site remains in your workspace, so you can see long-term trends. Deleting a site removes its stored metrics, breakdowns and notes.
- Google tokens are deleted when you disconnect the Google account or delete your account. If Google tells us a token has been revoked, we stop using it.
- Invitations are kept until they are accepted or cancelled.
- Sessions expire automatically after a period of inactivity, and server logs are kept for a limited period (typically no more than 90 days) unless needed to investigate a security incident.
- Deleting your account from your profile page removes your personal data from our live systems. Before deletion you choose a new owner for any workspace you share with others, so your team keeps its data; workspaces only you belong to are deleted along with their sites, metrics and notes. Copies in backups are overwritten in the normal backup cycle, typically within 30 days.
- Legal holds: we may keep limited data for longer where the law requires it or to establish, exercise or defend legal claims.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data;
- export your data in a portable format;
- object to or restrict certain processing, including processing based on legitimate interests;
- withdraw consent at any time, including by disconnecting Google, without affecting processing that already took place;
- not be discriminated against for exercising your privacy rights.
Much of this you can do yourself: update your details on your profile page, export site data as CSV, disconnect Google on the Connections page, and delete your account from your profile. For anything else, email hello@saasmaestro.com. We may need to verify your identity, and we will respond within 30 days. If your request concerns data in a workspace you don’t own, we may refer it to the workspace owner.
California residents: we collect the categories of personal information described in “What we collect” for the business purposes in “How we use it”. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use sensitive personal information for purposes beyond providing the service.
Children
SaaSMaestro is a business tool and is not directed to children. You must be at least 16 years old (or the age of digital consent where you live, if higher) to create an account. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as SaaSMaestro changes or the law requires. When we do, we will update the date at the top of this page. If a change is significant, we will email account owners before it takes effect.
For any privacy question or request, email hello@saasmaestro.com. If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to your local data protection authority, such as the Information Commissioner’s Office in the UK or the supervisory authority in your EU country.