Secret Systems application

Privacy Policy

Effective 22 September 2026 · applies to app.secretsystems.io and the modules served under it (Website, CRM, Content Studio). The public marketing website at secretsystems.io has its own policy.

Who we are

Secret Systems (“we”, “us”) provides the Secret Systems application: a business dashboard for the clients whose websites we build and operate. Contact: info@secretsystems.io.

What the application does

Signed-in clients use the application to see the status of their website, the leads their website collects, search performance, change requests and billing, and — where included in their plan — to run their CRM (jobs, customers, timers, job photos) and Content Studio. Secret Systems staff can view a client's workspace for support through an audited, read-only “view as client” context.

Information we collect

• Account: your email address and sign-in details (magic link or password, handled by our authentication provider). We never see or store your password in readable form.
• Business records: the business name, contact details, onboarding questionnaire answers and files you give us to build and run your website, and the roles of the people you invite.
• Website leads: submissions made through forms on your own website (name, contact details, message and the page they came from), stored so you can follow up.
• CRM and Content data (if included): the customers, jobs, time entries, photos, videos and content you create in those modules. Photos and videos are stored in a private bucket and shown only through short-lived signed links.
• Billing: subscription and invoice records mirrored from Stripe. Card details are entered on Stripe's pages and never reach our systems.
• Technical: standard request logs (IP address, browser, timestamps) kept by our hosting providers for security and reliability.

Google user data

The application uses Google APIs in exactly one way: Google Search Console, and only when you connect your website's Search Console property through Google's consent screen. We do not use the Google Ads API, Google Analytics APIs, Gmail, Drive, Calendar or Google Business Profile APIs.

• Scopes requested: webmasters.readonly to read Search Console data for your property. If you ask us to submit your sitemap for you, we request webmasters (read and write) instead; it is used only to list and submit sitemaps for that property.
• What we access: the list of Search Console properties your Google account can see (to let you pick your website's property), and for the property you choose, daily search analytics: the page URL, search query, device type, clicks, impressions, click-through rate and average position.
• What we store: the property you connected and its connection status; the daily analytics rows above, tied to your website; and the OAuth refresh token needed to keep syncing. The refresh token is stored encrypted in our database's secret vault, is never available to browsers or to other clients, and is used only by our server-side sync to fetch your property's data.
• How we use it: to show search performance in your dashboard, to find SEO opportunities for your website, and to record the results of changes we make to your site. We do not use Google data for advertising, do not build profiles from it, and do not use it to train models.
• Sharing: we do not sell or share Google user data with third parties. It is processed only by our infrastructure providers (Supabase for the database and functions, Vercel for hosting) acting on our instructions. Secret Systems staff may see it in your dashboard when supporting you.
• Your control: you can revoke our access at any time from your Google Account permissions page (myaccount.google.com/permissions). On revocation we stop syncing, and you can ask us to delete the stored analytics and connection by emailing info@secretsystems.io; we delete them within 30 days.

Secret Systems' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

During onboarding we may also ask whether you have a Google Business Profile or Google Analytics, record the public link to your Business Profile, and record your written authorisation (name, role and time) for us to help manage that profile on your behalf. Those answers are stored with your questionnaire; they do not give the application any API access to Google.

How we use information

To provide and support the application and your website, to show you your own data, to send sign-in and service emails, to bill you, to keep the service secure, and to meet legal obligations. We do not sell personal information.

Who can see your data

Only people you have added to your business, Secret Systems staff for support, and the providers named below. Every client's data is isolated in our database by row-level security; one client cannot read another client's records.

Third-party services

• Supabase — database, authentication, file storage and server-side functions.
• Vercel — hosting of the application and of client websites.
• Stripe — payments and invoicing.
• Resend — delivery of sign-in and service emails from auth.secretsystems.io.
• Google — Search Console data, only as described above.

Data retention

We keep your account and business data while you are a client and for as long as needed afterwards for legal, billing and support reasons. When a plan or module ends, that module's data is not deleted automatically; you can ask us to export or delete it. Search Console data is deleted on request as described above.

Security

Data is encrypted in transit, credentials and tokens are kept in server-side secret stores, browsers only ever hold a publishable key plus your own session, and access to every record is enforced in the database.

Your choices and rights

You can review most of your data inside the application, revoke Google access from your Google Account, and email us to access, correct, export or delete your information. Depending on where you live you may have additional rights under local law; we honour them on request.

Changes

We will post updates to this page and change the effective date above. Material changes to how we use Google data will be communicated to connected clients before they take effect.

Contact

Secret Systems · info@secretsystems.io