Privacy policy

Version of October 27, 2026. Applies to the MCP connector at https://organiqgeo.com and to the Organiq dashboard at https://app.organiqgeo.com (and to the organiqgeo.com domains once active). Written in plain language; points still pending legal review are marked. The Portuguese version is the reference for users in Brazil. legal review pending

1. Who processes your data

Organiq is operated by Youssef Mattar (individual, Brazil) until the company is incorporated. legal review: replace with company name, tax id and address; appoint the DPO. Contact for privacy matters and requests: youssefpmat@gmail.com.

2. What we collect

Google account (sign-in): e-mail, name, picture and the sub identifier, through the openid email profile scopes.
Google Search Console (read-only), scope webmasters.readonly: the list of properties your Google account can see and your permission level; and, only for the properties you activate, clicks, impressions, CTR and position by day, query, page, country, device and search type, plus sitemap status. The history is stored in our own database to show trends beyond Google's 16-month window.
Google Analytics 4 (read-only, optional), scope analytics.readonly: daily sessions by source/medium, landing page, device, country and sessions referred by AI assistants. You can decline this scope; everything else works without it.
Bing Webmaster Tools (optional, when you provide the key).
Tokens: the Google refresh token is stored encrypted (AES-256-GCM) and decrypted only in memory to call Google APIs. Connector OAuth tokens and API keys are stored as hashes only.
Billing through Stripe: we never see or store card numbers; we keep the customer and subscription identifiers, plan, status and dates. Stripe receives e-mail, name and, if provided, billing address and tax id.
Technical logs: IP address, user agent, timestamp, tool name, duration and account, for security and rate limits; deleted within 90 days.
Cookies: one dashboard session cookie (httpOnly, 30 days) and local preferences. No advertising or third-party analytics cookies.

3. What we do not collect

The connector does not receive the text of your conversation with the AI assistant: only the tool arguments (property, dates, filters). We do not read e-mail, files or any other Google account data beyond the scopes above. We do not sell data, use it for advertising, or train AI models on your properties' data.

4. How we use it

To provide the service (daily sync, history, analyses shown in the dashboard and the connector); to operate the account (sign-in, sessions, keys, plan limits, billing, support); for security (abuse, rate limits, incidents); and for service communications. Marketing only with consent.

5. Legal bases (LGPD / GDPR)

Performance of the contract; legitimate interest for security and limits; legal obligation for tax records; consent for the optional GA4 scope and for marketing. legal review: confirm the mapping and the GDPR wording for users outside Brazil.

6. Who we share with (processors)

Google LLC: sign-in and the Search Console and GA4 APIs (USA).
Netlify, Inc.: hosting of the dashboard, the connector and the serverless functions (USA).
Neon, Inc.: the Postgres database that holds the history (USA).
Stripe, Inc.: payments, invoices and the billing portal.
Anthropic, OpenAI, Cursor or the provider of the AI assistant you use: only when you connect Organiq to it; the assistant receives the responses of the tools you call, under that provider's policy.
Microsoft: Bing Webmaster Tools, if you connect it.

International transfers rely on each processor's contractual clauses and certifications (LGPD art. 33). legal review: validate the transfer mechanism and sign DPAs. Authorities receive data only under a valid legal order.

7. Retention

Property data: while the property exists in the account. Deactivating keeps the history; deleting the property or the account erases it.
Deleted account: removed immediately from the main database (account, connections and tokens, keys, sessions, properties and history); provider backups expire within 30 days.
Technical logs: up to 90 days.
Billing records: for the period required by tax law, at Stripe. legal review: confirm the period and what remains at Stripe after deletion.

8. Your rights and how to exercise them

Confirmation, access, correction, anonymization, portability, erasure, information about sharing and withdrawal of consent; we answer within 15 days. Delete the account: in the dashboard, Settings → Plan and billing → Delete account (immediate), or through https://app.organiqgeo.com/exclusao-de-dados. Revoke Google access: myaccount.google.com/permissions (sync stops immediately). Other requests: youssefpmat@gmail.com, from the registered e-mail. You may also complain to the Brazilian data protection authority (ANPD) or your local authority.

9. Security

TLS everywhere; encrypted refresh tokens; tokens and keys stored as hashes; revocable sessions; minimal read-only scopes; database access restricted to the operator; no tokens in logs or URLs. Relevant incidents are reported to you and to the authority within the legal deadlines.

10. Google API Services User Data Policy

Use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements: Search Console and GA4 data is used only to provide the Organiq features you see, is not transferred to third parties beyond what this policy describes, is not used for advertising, and is not read by humans except with your consent, for security, or as required by law.

11. Minors and changes

The service is for professionals and businesses, not for people under 18. Material changes are published here with a new date and, when they affect processing, announced by e-mail. Current version: October 27, 2026.