Oftheard runs twelve-week SEO and AI visibility campaigns for businesses and the agencies that work for them: it checks a business’s website, tracks the searches and questions its buyers ask on Google, Bing and the AI assistants, and writes page drafts from facts the business has confirmed. To do that it needs an account, a site to check, and the searches and questions to track. This page says what happens to each of those. Where it says “we”, it means Oftheard, Chennai, Tamil Nadu, India, the operator of oftheard.in, reachable at hello@oftheard.in.
What we collect
| Kind | What it is | Where it comes from |
|---|---|---|
| Account | Your name, email address and a password, or the name and email your Google account shares when you sign in with Google. An agency account also holds the agency’s name, website and logo. Passwords are stored only as a salted hash; the password itself is never stored. | You, at sign-up |
| Business details | For each business on the account: its name, website, place and country, what it sells, its contact details, its competitors and their websites, the goals of its campaign, who approves its pages, and a map pin if you set one. For a business an agency holds, the owner’s name and business email. This is what a check and a campaign are aimed at. | You, or your agency, at setup and in settings |
| Google data you connect | If you connect a business’s Google Search Console and Google Analytics from its campaign: the email of the Google account that connected, the property and site matched, a read-only token for those two services, and the figures read from them. Described in full under Your Google data. | Google, with your consent, only if you connect it |
| WordPress connection | If you connect a business’s WordPress site: its address, the WordPress user name, and an Application Password you create in WordPress. Described under Publishing to WordPress. | You, only if you connect it |
| What the product makes | Site check results; the searches and questions tracked, with their Google and Bing rankings; the AI answers to each tracked question, with the sources they used; the competitors’ results on the same searches; the business’s fact sheet, the lines the owner has confirmed; page drafts, their checks and who approved them; the weekly reports; and the usage counts for the plan. | Produced when you run a check or a campaign |
| Owner consent | When an agency holds a business: the owner’s business email, the code sent to it to confirm the campaign, and when the owner agreed or withdrew. | The owner, by the emailed code |
| Payments | For each twelve-week round: the plan, the amount, how it was paid (card, UPI or net banking) and Razorpay’s order and payment references, and the bill made from them, which keeps the name, address and email it was billed to as they were on the day. Card, UPI and bank details are entered in Razorpay’s own checkout and never reach us. | Razorpay, when you pay |
| Booking requests | If a business turns on the booking page of its public profile: the name, email, phone number and note a visitor sends with a booking request, held for that business. | The visitor, on the booking page |
| Messages | Your name, email and message when you write to us. | You, when you write in |
| Technical | Your IP address and browser identifier, in server logs, used for rate limiting and to stop abuse. No advertising pixels, no fingerprinting; the one analytics tag is described under Cookies. | Your browser, on each request |
Cookies and browser storage
We set two kinds of cookie. The first keeps you signed in: a signed token that lasts up to thirty days, is marked HttpOnly and SameSite, and is sent only over HTTPS on the live site. Two cookies of the same kind carry a Google sign-in or a Google connection back to your account and expire within ten minutes. None of them is used to track you across other sites, and none is shared with anyone.
The second comes from Google Analytics, which we use to see which pages are read and where visitors arrive from. It sets cookies named _ga and _ga_… that tell a returning visit from a new one for up to two years. Google Analytics 4 does not record or store IP addresses, and we have advertising features switched off. They are set only if you allow them when the site asks, and you can change your choice at any time; the site works the same either way. A browser that sends the Global Privacy Control signal is treated as a no without being asked.
Two things are kept in your browser's own storage and never sent to us: the theme you chose, and your answer to the cookie question. Clearing your browser data clears them.
If you sign in with Google, Google sets its own cookies on its own domain under its own policy.
How we use it
- To do what you asked: run the site check, track the searches and questions every week, write the page drafts, publish the ones that are approved, and show you the reports and the history.
- To run your plan: record which plan each business is on and the twelve-week round it has paid for, and count reports, checks and drafts against that round’s allowance.
- To email you: sign-in and confirmation codes, password reset links, a business owner’s consent code, and the messages about a campaign that you or your agency asked for.
- To answer you: reply to messages you send us by email.
- To keep the service up: rate limiting, abuse prevention, and fixing faults.
- To show you the business’s own Google figures: clicks and impressions from Search Console, visits and key events from Analytics, and the searches the site already shows up for, read from the properties you connected and shown on that business’s pages.
- To see how the site is used: which pages are read and where visitors come from, in aggregate, through Google Analytics. Nothing in it names you.
We do not sell personal data, we do not run advertising, and we do not use your data to train any model.
Who else handles it
Oftheard is built on other companies' services. Each one sees only what it needs for its part.
| Service | What it does for us | What reaches it |
|---|---|---|
| Google Cloud Firestore | The database your account and its businesses live in, in Mumbai (asia-south1) | Your account, the business details and everything the product makes |
| Google Cloud Run | Runs the server, in Mumbai (asia-south1) | Every request, and the stored reports |
| Cloudflare | The front door for oftheard.in: DNS, TLS and routing; and Turnstile, the “I am human” check asked before a code or a reset link is emailed | Every request, including your IP address |
| Google Sign-In | The “Sign in with Google” button and prompt | Your Google account, when you choose it |
| Google Analytics | Counts page views and where visitors come from | The pages you open, your browser and rough location; never your email or account |
| Google Analytics Data and Admin APIs, Search Console API | Find and read the properties you connected, read-only | The token you consented to and the property or site name; only if you connect them |
| OpenAI, Google Gemini, Perplexity | The AI assistants asked the tracked questions each week | The tracked questions, phrased as a buyer in the business’s country would ask them. Never your email or account details. |
| OpenAI, Google Gemini, Anthropic Claude (through Google Vertex AI, or Anthropic directly) | Write page drafts and review them | The business’s own page, the pages that rank for that search, the business’s confirmed facts and the tracked question. Never your email or account details. |
| DataForSEO | Fetches Google results pages from the business’s city and Bing results pages for India, Google’s AI Overviews and AI Mode, Claude’s answers, and how often each search is made | The tracked searches and questions, and the place they are asked from |
| Razorpay | Takes the payment for a twelve-week round | The amount, the business’s name, your email, and what you enter in Razorpay’s own checkout |
| Resend | Sends the emails the service sends: codes, reset links, an owner’s consent code, and reports you choose to send | The recipient’s address and the message |
| Google Places | Checks a business listing against the website, only for sites that declare a physical address | The business name and address on the site being checked |
| Chrome UX Report, PageSpeed Insights | Speed and field data for the site being checked | The site's address |
| Optional lookups | India Post PIN data, OpenStreetMap, Wikidata, Common Crawl, Bing Webmaster Tools, Google Autocomplete (the searches people make), Open PageRank (a domain authority score) and Google Maps (the profile’s map pin), each switched on separately | The address or domain of the site being checked, its competitors’ domains, the services and town searched for, and the place you search for on the map |
None of these is given your data for its own purposes. The AI assistants answer the questions; they are not told whose account asked.
What checking a site involves
A check reads the public pages of the site you name, the way a search crawler does: about seventy requests for a homepage check, more for a whole-site pass. It changes nothing on the site. The report keeps the findings and the short excerpts needed to show them, such as a title, a heading or a few lines of text. It does not keep copies of the pages.
Anyone can run the free site check from the front page before making an account. That result is kept on the server for up to six hours, so that an account made in that time can take it on. A campaign also reads the public pages of the business’s competitors, and of the pages that rank for its searches, in the same way.
A report can be given a share link. Anyone holding that link can open the report without signing in, so treat the link as public. It works until you turn it off or delete the business. If the business’s Google Search Console or Analytics is connected, the report includes its total clicks, impressions, visits and key events at the start of the campaign and now.
Publishing to WordPress
If you connect a business’s WordPress site, Oftheard keeps the site’s address, the WordPress user name and the Application Password you made for it. The password is stored encrypted, is never sent back to the browser, and is used only to publish a page draft once it has been approved, or to undo a page it published. When the business owner approves the business’s pages, nothing is published before they have. Before a page is replaced, its old title, content and excerpt are kept so it can be put back. Oftheard never touches the home page, the menus or any other page.
Press Disconnect in the business’s settings to delete the stored password, or revoke the Application Password in WordPress yourself at any time, under Users → Profile.
Agencies and business owners
An agency account can hold up to fifty businesses for its clients. Before a campaign runs for a client, the business owner agrees to it with a six-digit code sent to the owner’s business email: an address at the business’s own domain, or one shown on its website. The code works for fifteen minutes and is kept only as a one-way hash. The owner can withdraw consent the same way, which stops the business’s campaigns, and can sign in to see the same weekly numbers. The agency and the owner both see that business’s data.
AI crawler reads
If you install the crawler sensor, a short snippet in your Cloudflare worker or a small WordPress plugin, your site sends us one line each time a known AI crawler fetches a page: the time, the path, the crawler's name and the response status. Nothing is sent about human visitors, no address of anyone is kept, and the records are used only to show you which crawlers read which pages. Removing the snippet or the plugin stops the sending at once; revoking the business’s key in Oftheard does the same.
Your Google Analytics and Search Console data
From a business’s campaign you can connect its Google Search Console and Google Analytics, so the campaign shows the business’s own clicks, impressions and visits at the start and now, and the searches the site already shows up for. Both connections are optional, and the rest of the product works without them.
What we ask for. Two read-only permissions, and the email address of the Google account you choose: to view your Google Analytics data (analytics.readonly) and to view Search Console data for your verified sites (webmasters.readonly). Nothing in either service can be changed by us. Consent is asked for on Google's own page, and only the account you choose there is connected.
What we read. From Analytics: the list of properties the account can see and their web streams, to find the business’s own property, and then its total visits and key events over the last 28 days. From Search Console: the list of sites the account can see, then the site’s total clicks and impressions over the last 28 days, and the searches that showed the site over the last 90 days with their clicks, impressions and average position (the 200 most seen). Nothing else is read, and nothing about individual visitors reaches us, since neither service provides it.
What we keep. On the business’s record: the email address of the Google account that connected, the property and site matched, the figures read when you connected (the start) and the latest figures, and the searches read from Search Console. Beside it, never sent to the browser: a token that lets the server read those two services again without asking you each time. The figures are read again when asked for, and no more than once every twelve hours.
What we do with it. Show it on the business’s own pages and its report, and offer the Search Console searches as ones its campaign can track. It is not sold, not used for advertising, not used to train any model, and not read by a person except to fix a fault you have reported. Who does and does not receive it is named in full under who we share it with. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting. Press Disconnect on the business’s Google row. That asks Google to revoke the token and deletes it at once. The figures already read stay on the business as its start and latest numbers until the business or the account is deleted. You can also remove the access from your Google account at myaccount.google.com/permissions, after which the server can read nothing further. Deleting the business or the account deletes all of it.
Google Business Profile. Oftheard does not ask for access to a Business Profile and never changes or posts to one. A business’s profile is shown only.
Who we share your Google data with
This section is about the data described just above: what is read from the Google Analytics property and the Search Console property you connect, the token that reads them, the email of the Google account that connected, and the figures derived from any of it. Google asks every application to say plainly who receives that data. Here is the whole of it.
We do not sell it, rent it or trade it. We do not transfer it to anyone for advertising or any other marketing purpose. We do not use it, and we do not allow anyone else to use it, to develop, improve or train any model, ours or another company's, including any artificial intelligence or machine learning model. No person reads it — nobody here and nobody elsewhere — except with your explicit consent while we look into a fault you have reported, or where security requires it to investigate abuse or a breach, or where the law requires it.
Three parties handle it, each only as far as its part needs, each acting on our instruction and never for purposes of its own:
| Who | Why they have it | What reaches them |
|---|---|---|
| You, and the others on that business | It is the business’s, and showing it is the whole point of the connection | All of it, on that business’s signed-in pages. For a business an agency holds, that is the agency and the business owner. The totals also appear on the business’s report and its share link, if you make one |
| Google LLC, as Google Cloud Run, Mumbai (asia-south1) | Runs our server, which is what calls the Google APIs. The data passes through it as the request is served | Everything read from your property, for the length of the request that serves it. What stays on the server afterwards is one line of our own running log — that a connection was made, for which account, and whether a Search Console and an Analytics property were found — and nothing of the figures themselves |
| Google LLC, as Cloud Firestore in Mumbai (asia-south1) | The database your account lives in | The refresh token, the connected Google account’s email, the property and site matched, and the figures. Held under your account and served only to the people on that business once signed in |
Nobody else, with one exception that is yours to make or not, and it is worth being exact about it.
Your Analytics figures never leave. They are not sent to Gemini, OpenAI, Perplexity, Anthropic, DataForSEO or any other provider, at any time, for any reason. Nothing read from your Analytics property goes anywhere but the business’s own pages and its report.
Search Console is different in one respect, and only if you choose to track one of its searches. The searches the site already shows up for are offered when you pick the searches a campaign tracks. A search you pick becomes one of the campaign’s tracked searches, and from then on its text is sent each week to the AI assistants and to DataForSEO, and to the model that writes its page draft, because asking them is what tracking a search is. Editing a search first does not change where it came from. What is never sent with it is everything else: not the impressions, the clicks, the positions or the pages, not the property, not your email, and nothing that identifies you or any visitor to your site. A search you never pick is sent nowhere.
Beyond that, nobody. Not our own website analytics. Not any advertising network, data broker, enrichment service or marketing tool. Not another customer of ours. A report can be given a share link, as said above. It carries the totals described there, and nothing else read from Google: no searches, pages, property names or token.
Two things could move it further, and both are named here rather than left to be assumed. The law: if a binding legal demand, a court order or a regulator's direction requires disclosure, we will disclose only what is required, and we will tell you unless we are forbidden to. A change of ownership: if the service were sold or merged, we would ask for your consent before your Google data moved to the new operator, and refusing would disconnect it and delete it rather than transfer it.
All of it stops when you press Disconnect, which deletes the token and the figures and asks Google to revoke our access, or when you remove the access yourself at myaccount.google.com/permissions.
How long we keep it
- Account, businesses, campaigns, reports, page drafts and payment records: for as long as the account exists, or until you delete the business.
- A free site check run before an account: up to six hours.
- Share links: until you turn the link off or delete the business.
- Crawler read records: ninety days.
- Connected Google data: the token until you press Disconnect or the business or account is deleted; the figures and searches read until the business or the account is deleted.
- WordPress connection: the encrypted password until you disconnect WordPress or delete the business; the old version of a replaced page until the business is deleted.
- An owner’s consent code: fifteen minutes, as a one-way hash. The record that the owner agreed, for as long as the business exists.
- Messages: until answered, and then for up to a year as a record of the correspondence.
- Server logs: for a short period, under the log retention of the hosting provider.
You can delete the account and everything under it yourself, from the account settings, by typing your email to confirm; it is deleted from the database at once. Or write to hello@oftheard.in from the address on the account: deletion is then done within thirty days, and confirmed by reply. A copy of your data can be requested the same way.
Your rights
Under the Digital Personal Data Protection Act, 2023 and any other law that applies to you, you can ask what personal data we hold about you, have it corrected, have it erased, and withdraw consent for anything that rested on it. Write to hello@oftheard.in. Mail is read by a person and acknowledged within one working day, and requests are resolved within the time the law sets. If you are not satisfied with the answer, you may raise it with the Data Protection Board of India.
Security
Everything travels over HTTPS with strict transport security. The sign-in cookie cannot be read by script. Passwords are stored only as a salted hash, never as the password itself, and a WordPress Application Password is stored encrypted. Access to the stored data is limited to the people who run the service. No system is beyond fault; if a breach affects your data we will tell you and the authority as the law requires.
Children
The service is for businesses and the people who work in them. It is not meant for anyone under eighteen, and we do not knowingly hold data about them.
Changes to this page
The date at the top changes when the policy does. A change that matters to you, such as a new processor or a new use of data, is announced on this page and by email to account holders before it takes effect.
Contact
Questions, requests and complaints about personal data go to hello@oftheard.in, or through the contact page.