Privacy Policy

Account details: your email address, optional name, and authentication credentials so you can access the product securely.

Website data: the domain and pages you add, page-audit results, customer questions, competitors, and tracking history.

Answer excerpts and sources: when a question is checked, we save the answer excerpt, cited links, provider, and date needed to show mentions and compare results over time.

Optional connected services: if you connect Google Analytics 4 (GA4) or Google Search Console (GSC), we store the OAuth refresh token (encrypted at rest) plus the property or site details you select. We use these only to fetch the metrics needed for the overlay or search-visibility views, and you can disconnect them at any time from Site Settings.

Integration data: if you create API tokens, we store only a one-way hash of the token plus a short visible prefix, never the full token in plaintext after creation. If you configure Slack or outgoing webhooks, we store the destination URL and any signing secret needed to deliver those events.

Operational data: we keep limited service and error logs to maintain reliability, investigate problems, and prevent abuse.

Website analytics: if you allow analytics cookies, we collect page views, referral information, broad device and browser details, and approximate location through Google Analytics 4. We do not send passwords, payment details, or form contents to analytics.

Public support chat: if you use Ask Sikwati, your message and a small set of approved public product notes are sent to OpenAI to produce the reply. Sikwati does not add these chat messages to a customer workspace or use them to train a model. Avoid sharing passwords, payment details, verification codes, or other secrets in the chat.

Email updates: if you subscribe, we keep your email address, the consent you gave, confirmation status, and delivery events such as bounces, complaints, and unsubscribes.

We use this data to audit public pages, check the questions you choose, build reports, send service emails, process subscriptions, and provide support.

We do not sell your customer data, and we do not use your scan or citation history to train any models.

We send marketing updates only after you confirm your subscription. We do not add purchased, scraped, borrowed, or third-party lists.

When you connect Google Analytics 4 or Google Search Console, Sikwati accesses the OAuth tokens, account, property or site identifiers, and read-only analytics or search-performance metrics necessary to provide the integration you requested.

Sikwati uses this Google user data only to display organic-traffic and search-performance information for the connected website. We share or transfer it only to Cloudflare, our application-hosting and database-infrastructure provider, as necessary to operate Sikwati, and to people whom you authorize to access the associated Sikwati workspace so they can view the requested metrics.

Sikwati personnel do not read Google user data except with your explicit permission for support, when necessary to investigate a security incident or abuse, or when required by applicable law.

We do not sell Google user data or disclose it to advertising platforms, data brokers, information resellers, OpenAI or other AI providers, PayPal, Amazon Web Services, or unrelated third parties. We do not use Google user data for advertising, credit or lending decisions, or to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Sikwati's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect either Google integration from Site Settings. Disconnecting removes the stored OAuth credentials for that integration.

OpenAI and Google: tracking sends the customer questions and market context you configure. If you request a drafted improvement or report summary, the relevant page or report information is also sent for that request.

OpenAI also processes messages submitted to the public Ask Sikwati support chat. The chat is limited to public product guidance and cannot inspect customer accounts or workspace data.

Google Analytics 4 (GA4) and Google Search Console (GSC) — only if you opt in by connecting them. We use Google's official OAuth flow and do not see your Google credentials.

Google Analytics 4 may also process limited usage data from the public Sikwati website after a visitor accepts analytics cookies.

PayPal — for paid subscriptions. We store the subscription identifier returned by PayPal so we can manage your plan; we never see or store your payment instrument.

Cloudflare: hosts the application and database and delivers transactional email. Cloudflare receives the technical data needed to provide those services.

Amazon Web Services: Amazon SES delivers confirmed email updates and reports delivery, bounce, and complaint events so we can protect sending reputation and stop mail to invalid or complaining addresses.

Slack — only if you configure a Slack incoming webhook for workspace alerts or test messages.

Your outbound webhook receiver — only if you configure one. In that case, Sikwati sends the event payloads you asked to receive (`webhook.test`, `alerts.created`, `sov.updated`, `scan.completed`) to the URL you provided, optionally signed with your secret.

Sentry — may process scrubbed error diagnostics when error monitoring is enabled.

We retain account and scan data while your account is active so your history and reports remain available.

If you delete a website from your account, we delete its discovered pages, scan results, citation queries, citation results, competitor configurations, and share links. Aggregate alert and audit logs may persist briefly for operational integrity.

Account deletion removes the associated account records and owned website data from the active service, subject to legal obligations. Backup copies may remain for a limited period before they are overwritten. Contact us if you need details about a deletion request.

If you unsubscribe or an address bounces or complains, we retain a suppression record so we do not send marketing email to that address again.

Passwords are stored as bcrypt hashes, never plaintext. Sessions are HTTP-only cookies with the standard NextAuth protections.

Customer access is scoped by account and workspace membership. Restricted administrative access is limited to authorized operators for security, support, and service operations.

Sensitive tokens are protected before they hit the database. GA4 and GSC OAuth refresh tokens plus share-link access tokens are encrypted at rest. API tokens are stored as one-way SHA-256 hashes, and share-link lookup also uses a SHA-256 hash so the plaintext token is not present in any index.

Outbound fetches during scans go through an SSRF guard that resolves hostnames first and rejects private and link-local IP ranges, with the resolved IP pinned for the actual fetch to prevent DNS rebinding.

If you have a privacy or security question, contact hello@sikwati.app.

You can edit or remove tracked prompts, competitors, and websites from inside the app at any time, which removes the associated history.

You can disconnect GA4 or GSC from Site Settings, which removes the stored OAuth credentials for those integrations.

You can revoke API tokens, Slack webhooks, and outgoing webhooks from Settings or Workspace Integrations at any time.

You can revoke any share link you've generated, which immediately makes the report URL inaccessible to anyone holding it.

You can request account deletion by contacting hello@sikwati.app.

You can stop email updates at any time through the unsubscribe link in every message.