GSO Privacy Policy

Effective date: [date of publication]

GSO is a service of Tomo Digital Pte Ltd (UEN 202504073N), 6001 Beach Road, #22-01 Golden Mile Tower, Singapore 199589. In this policy "Tomo", "we" and "us" mean Tomo Digital Pte Ltd, and "GSO" means the service at [product URL], including the emails it sends and the reports it produces.

This policy explains what personal data GSO collects, what we do with your Google Search Console and Google Analytics data, who can see it, how long we keep it, and how to have it corrected or deleted. It applies to GSO only. Tomo Digital's website and agency services have their own privacy policy at tomodigital.com.sg.

1. The short version

• We read your Search Console and Google Analytics data for one purpose: to show it in your GSO projects and in the reports you produce from them. Both permissions are read-only. GSO cannot change anything in your Google accounts.
• We do not sell your data, use it for advertising, pass it to data brokers, or use it to train AI models.
• You can disconnect Google at any time from Organization settings. Disconnecting stops all reading at once and deletes the stored token.
• Your data is stored in Singapore.
• Write to privacy@tomodigital.com.sg with any question, request or complaint.

2. What we collect

Your account. Your name, email address and a password when you register. We store the password as a hash, never in a readable form. If you sign in with Google instead, Google gives us your name, email address and profile picture and nothing else. We also keep the sign-in sessions for your account.

Your Organization. The Organization's name, who belongs to it and in which role (owner or member), the invitations owners send, and the email addresses they are sent to.

What you put into projects. The website each project tracks, and the keywords, markets, competitor websites, AI prompts, brand names, notes and settings you enter, together with the email addresses you choose to receive scheduled reports.

Data Google provides about your properties. Described in section 3.

Ranking and AI-answer data collected for your projects from search results and AI assistants. This is data about public search results and public AI answers, described in section 4. It is not data about you or about your website's visitors.

Billing. The plan your Organization is on, its subscription status and renewal date, and the invoices Stripe issues for it. Your card details go directly to Stripe and never reach our servers.

Technical records. Our hosting provider keeps server logs (IP address, browser, time of request) for a short period for security and troubleshooting. GSO sets no analytics or advertising cookies and loads no tracking scripts.

3. Your Google data

This section is written for two readers: you, and Google's reviewers, who check it against the permissions GSO asks for.

3.1 The permissions we ask for

When an owner connects a Google account in Organization settings, GSO asks for two permissions. Both are read-only.

GSO also asks for the account's email address during the connection so it can show which account is connected. Signing in to GSO with Google is a separate, narrower request for your name and email only.

You can grant one permission and refuse the other. GSO then shows only the data it has been allowed to read.

3.2 What we read, and why

From Search Console:

• The list of properties the account can access, so you can pick the one that belongs to each project.
• For each chosen property, daily clicks and impressions, so the project's Traffic view and its reports can show organic search traffic beside keyword rankings.
• The top search queries for the property, with their clicks, impressions, click-through rate and average position, so you can see which searches bring visitors.

From Google Analytics:

• The list of GA4 properties the account can access, so you can pick the one that belongs to each project.
• For each chosen property, daily sessions, users, engagement rate, average session duration and page views for organic search traffic, so the Traffic view and reports can show what the rankings bring in.
• Counts of the events you choose to treat as conversions.
• Breakdowns of organic traffic by channel, source, landing page, page, country, region, city, device type, browser and operating system.
• Sessions referred by AI assistants such as ChatGPT, Perplexity, Gemini and Claude, so GEO Tracking can show whether AI answers send visitors to your site.

All of this is aggregate data as Google reports it. GSO never requests or stores identifiers for individual visitors to your website.

3.3 How we access it

• Google gives GSO a refresh token for the connected account. We store it encrypted with AES-256-GCM, with the key held outside the database. The short-lived access tokens GSO uses to make requests are kept in memory only and are never written to the database.
• A scheduled job reads the previous day's data once a day. A signed-in member of your Organization can also trigger a read the first time they open a date range that has not been collected yet.
• Nobody outside your Organization can trigger a read. Opening a shared report never causes GSO to contact Google.

3.4 Where it is stored and who can see it

• We store Google data in GSO's database, hosted by Railway in Singapore, with the rest of your Organization's data.
• Every member of your Organization can see it in the projects they open.
• Anyone you give a share link to, or send a report to, can see the parts of it that appear in that report. You control who gets links and reports, and you can turn a link off at any time.
• Tomo staff do not look at your Google data except to resolve a support request you have raised, to investigate a security incident, or when the law requires it. We may look at aggregate figures, such as how many properties are connected, to run the service.

3.5 What we never do with it

• Sell it, or pass it to advertising platforms, data brokers or resellers.
• Use it to serve advertising of any kind.
• Use it to assess creditworthiness or for lending.
• Use it to develop, improve or train AI or machine-learning models.
• Send it to our ranking data provider or to our own crawler. They receive the project inputs described in section 4, never your Google data.

3.6 Limited Use statement

GSO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.7 Disconnecting, and deleting what was collected

• To disconnect: an owner opens Organization settings, then Google connections, and chooses Disconnect. GSO stops reading from that account immediately and deletes the stored token. Projects using that account lose their Search Console and Analytics views until an account is connected again.
• You can also remove GSO from your Google account at myaccount.google.com/permissions. GSO can then no longer read anything, even before you disconnect in GSO.
• Data already collected stays in your projects after a disconnect, so your reports keep their history. Deleting a project deletes its Search Console and Analytics data. Deleting the Organization, or asking us to (section 9), deletes all of it.

4. Ranking and AI-answer data, and where it comes from

GSO's SEO Ranking product records where a website appears in search results for the keywords you track. Its GEO Tracking product records whether AI assistants mention a website when asked the prompts you track. This data comes from:

• SE Ranking, a third-party provider, which checks search results and AI answers on our behalf.
• Tomo's own crawler, which runs searches and AI prompts on Tomo's infrastructure.

To do this, GSO sends them what you have entered in the project: the website, the keywords, the competitor websites, the markets, the prompts and the brand names. It does not send them your account details, your Organization's members, or any Google data.

What comes back is data about public search results and public AI answers: positions, the pages that ranked, search volumes, keyword difficulty and the text of AI answers. GSO stores it so that you keep your history. Keyword metrics such as search volume and difficulty are shared across GSO because they describe the keyword, not your project.

5. Who we share personal data with

We share personal data only with the providers below. Each processes it under its own terms and only to provide its part of the service.

Beyond these providers, we share personal data only:

• with the other members of your Organization, and with anyone you send reports or share links to;
• when the law, a court or a regulator requires it;
• with a buyer or successor if Tomo Digital or GSO is sold, after telling you first.

We do not sell personal data, and we have no advertising partners.

6. Cookies and local storage

GSO sets one cookie to keep you signed in, and a second, short-lived cookie while you connect a Google account, to protect the connection from forgery. Both are essential to the service. It keeps your colour-scheme preference in your browser's local storage. It sets no analytics, advertising or third-party cookies.

7. Where your data is stored

GSO runs in Railway's Singapore region, and its database is there. The providers in section 5 process data in their own regions. Where personal data leaves Singapore, we transfer it only to providers bound by terms that protect it to a standard comparable to Singapore's Personal Data Protection Act 2012 (PDPA).

8. How long we keep it

9. Your rights

Under the PDPA you can ask to see the personal data we hold about you, have it corrected, and withdraw consent to its use. Withdrawing consent may mean we can no longer provide the service. You can also ask us to delete your account or your Organization. If you are in the European Economic Area or the United Kingdom, you have the equivalent rights under the GDPR, including the right to receive a copy of your data.

Write to privacy@tomodigital.com.sg. We reply within 30 days. If you are not satisfied with our answer, you can complain to Singapore's Personal Data Protection Commission at pdpc.gov.sg.

10. Security

• Everything between your browser and GSO, and between GSO and its providers, travels over TLS.
• We encrypt Google tokens at rest and store passwords as hashes.
• The database is reachable only from GSO's own services over a private network, not from the internet.
• Only owners can connect or disconnect Google accounts, manage members and change the subscription.
• If a breach affects your data in a way the PDPA requires us to report, we will notify the Personal Data Protection Commission within three days and tell you without undue delay.

11. Children

GSO is a business service. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

The date at the top says when this policy last changed. If a change affects how we use your Google data or your personal data in a material way, we will email your Organization's owners before it takes effect.

13. Contact

Data Protection Officer Tomo Digital Pte Ltd 6001 Beach Road, #22-01 Golden Mile Tower, Singapore 199589 privacy@tomodigital.com.sg