Privacy Policy

Sympl Analytics LLC (“Sympl”, “we”, “us”) is a limited liability company registered in Utah, United States. We provide a marketing and sales analytics dashboard that connects to systems our customers already use, standardizes the data, and reports on it.

For any question about this policy, or to make a request about your data, contact symplanalytics@gmail.com.

We handle two kinds of data and our responsibilities differ between them. This distinction matters legally, so we state it plainly rather than blurring the two.

Business data belonging to our customers. When a customer connects Google Search Console, Google Analytics or an advertising account, we process that data on their instructions, as a processor. The customer decides what is connected and why. If you are an individual whose details appear in a customer’s data, that customer is the controller of your data — contact them, and we will support them in responding.

Data we collect ourselves. Account details and platform-request submissions made on our website are collected by us for our own purposes, and for those we are the controller.

Account data. First and last name, email address, password (stored only as a hash by our authentication provider — we never see or store it in readable form), company name, and the data areas you choose to switch on.

Connected platform data. Only from the platforms you connect, and only what the relevant report needs:

• Google Search Console — search queries, page URLs, clicks, impressions, click-through rate and average position for the property you select.
• Advertising platforms via Windsor.ai — campaign name, channel, date, spend, impressions, clicks and conversions.

AI Search Visibility. If you switch it on: your website address, your brand names, the competitors you list, the questions you choose to track, and the answers AI assistants give to those questions each week.

Earlier fit-check submissions. Our website used to offer a fit-check questionnaire. It has been discontinued and we no longer collect it, but we still hold the email address and answers of anyone who completed it while it ran.

Operational data. Access credentials for connected platforms (encrypted, see section 5), a daily count of assistant requests per account, and — for the two pages that accept submissions without a login — the originating IP address, kept only long enough to enforce rate limits and deleted after 48 hours.

Website analytics. On our public marketing pages (home, features, pricing, the legal pages and sign-up), and only if you choose “Accept” on the banner, we use Google Analytics 4 to see which pages are visited and how visitors arrive. It sets cookies in your browser and sends Google your page views, approximate location, device and browser details and a pseudonymous identifier. Until you accept, nothing is requested from Google. We do not load it on the signed-in app, so it never sees your dashboard or connected data. Choose “Decline” or use “Cookie settings” in the footer at any time to change your answer; the choice is remembered in your browser’s local storage.

What we do not collect. We run no advertising trackers and no third-party advertising cookies. Apart from the optional analytics above, the only cookies we set are the ones that keep you signed in and a short-lived token that protects the Google connection flow from interference.

When you connect Google Search Console we request a single scope, webmasters.readonly, which is read-only. We never request permission to change or delete anything in your Search Console account, and we do not have it.

When you connect Google Analytics we likewise request a single scope, analytics.readonly, which is read-only. We use it to list the Analytics properties you can access (so you can pick one) and to read that property’s traffic, channel, landing-page and key-event reports. We never request permission to edit your Analytics account, property or settings, and we do not have it.

How we use it. Solely to produce the search performance and website reports, recommendations and answers shown inside your own dashboard. Nothing else.

Where it goes. Search Console and Analytics data is stored in our database (see section 5). When you ask the built-in assistant a question, the relevant portion of your data is sent to Anthropic’s API to generate your answer, and the answer is returned to you. Likewise, if you ask us to suggest questions for AI Search Visibility, your most-searched queries that don’t contain your brand name are sent to Anthropic’s API so the suggestions reflect how your buyers actually search; you review the suggestions before anything is saved. We state this explicitly because it is a transfer to a third party: it happens only to deliver the feature you asked for, only for your own account’s data, and Anthropic acts as our service provider under contract. Search Console and Analytics data is never sent to the other AI assistants used by AI Search Visibility.

What we never do. We do not use Google user data for advertising. We do not sell it, rent it, or share it with data brokers. We do not use it to train general-purpose AI or machine-learning models, and we do not permit our service providers to do so. We do not allow humans to read it except where you have explicitly asked us to help with a support issue, where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymised.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can revoke our access at any time at myaccount.google.com/permissions, or by removing the connection in your Sympl settings.

Access tokens and API keys for connected platforms are encrypted with AES-256-GCM before being written to the database. The encryption key is held only in our server environment, so the database alone never contains a usable credential.

Every account’s data is scoped to that account. Queries are filtered by account identifier resolved from your logged-in session, and the database enforces the same separation independently through row-level security policies.

Credentials for connected platforms are held only on our servers and are never sent to your browser. All traffic to our site and to the platforms we connect to runs over HTTPS.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your data, we will notify affected customers without undue delay and, where we act as a processor, will support the customer in meeting their own notification obligations.

We use a small number of service providers, each under contract and each with access limited to what their function requires:

• Supabase — database hosting and user authentication.
• Vercel — application hosting and delivery.
• Anthropic — generates the answers given by the in-product assistant, as described in section 4; and, for customers using AI Search Visibility, answers the questions they track and suggests questions from their public website and search data.
• Windsor.ai — retrieves advertising performance data, for customers who connect an advertising platform.
• OpenAI, Perplexity and Google (Gemini API) — answer the questions a customer tracks in AI Search Visibility, so we can report how AI assistants describe their market. Each receives only the question text.

Google, as the provider of Search Console and Google Analytics, is not our service provider for the data you connect — those are your own systems, which you authorize us to read. The one exception is our own website analytics (section 3), where Google Analytics collects visitor data on our behalf, only with your consent.

We will give notice before adding a new service provider that processes customer data. We do not sell personal information, and we have not done so.

Connected platform data is retained for as long as your account is active, so that period-on-period reporting works. Rate-limiting records are deleted after 48 hours. Fit-check submissions collected while the questionnaire ran are kept until you ask us to delete them.

When an account is closed we delete its data, including its stored credentials, within 30 days of the request, except where we are required to retain something by law.

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, to receive a copy in a portable format, and to withdraw consent. Residents of California and other US states with comparable laws have equivalent rights, including the right not to be discriminated against for exercising them.

Email symplanalytics@gmail.com and we will respond within 30 days. Where the data belongs to one of our customers’ connected systems, we will refer you to that customer, who controls it, and assist them in responding.

Our servers are located in the United States. If you are outside the United States, using Sympl involves transferring your data there.

Sympl is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it.

If we change how we handle data we will update this page and revise the date at the top. For changes that materially affect how we use data you have already given us, we will notify account holders by email before the change takes effect.