Privacy Policy

Charpen (PG&J)(“we,” “us”) operates a multi-client SEO/GEO monitoring platform used by our agency to monitor and report on the search and local-presence performance of client businesses that have authorized us to access their data.

With each client’s explicit authorization via Google OAuth, we access the following Google data belonging to that client:

• Google Search Console — clicks, impressions, average position, and queries/pages.
• Google Analytics (GA4) — sessions, users, conversions, and traffic channels.
• Google Business Profile — location performance (views, searches, calls, direction requests) and reviews.

We access this data only for properties a client connects, and only after they grant consent. We also store the basic account information of our own team members who sign in.

We use this information solely to display monitoring dashboards, generate performance reports, and raise alerts for the client whose data it is. We do not use it for advertising or any purpose unrelated to providing that client’s reporting service.

If a team member connects their Google account so the platform can send client reports and notifications from their address, we use the gmail.send permission only to send messages that the team member composes or triggers from within the platform. We do not read, search, or store the contents of any mailbox, and we do not access received mail. This is the narrowest Gmail permission available for sending.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not transfer it to others except as necessary to provide or improve the service, to comply with law, or as part of a merger or acquisition.

OAuth refresh tokens are encrypted at rest. Tenant data is isolated per organization and protected by database row-level security. Access is restricted to authorized team members. Data is transmitted over TLS.

We retain a client’s data for as long as they remain an active client. On request or on offboarding, we revoke the relevant Google authorizations and delete or export that client’s data. Clients may also revoke our access at any time from their Google Account permissions page.

Questions about this policy or your data: privacy@charpen.io.