Privacy Policy

Last updated 11 September 2026

letsgetfound.ai helps small businesses get found on Google and in AI assistants. This policy explains exactly what data we collect, what we do with it, and what happens to the Google Analytics and Search Console data you choose to connect.

Who we are

letsgetfound.ai is operated by Metaedge Ventures. If you have a question about this policy or want your data deleted, email hello@letsgetfound.ai.

What we collect

When you run a free scan

• The website address you enter.
• Your email address, if you give it to us.
• The business name and location you enter, so we can look up your Google listing.
• The publicly available pages of the website you asked us to scan.

When you create an account

• Your email address.
• Your password, stored only as a one-way cryptographic hash. We never store or see your actual password.
• A session cookie, so you stay signed in. It holds a random identifier and nothing else — no personal data is stored in the cookie itself.
• Your dashboard layout, so your panels stay where you put them.

When you connect Google (optional)

See Google user data below. Connecting Google is entirely optional — every part of the free scan works without it.

When you visit our own marketing pages

Our home page, our “what you get” page, the sign-up page and these policy pages can use Google Analytics, so we can see how many people visit and which pages they read. It tells us things like which page you landed on, roughly where in the world you are, and whether you came from a search engine. We use it to understand whether our own website is working — nothing more.

We ask first. Google Analytics does not load, and sets no cookies, until you choose “Allow” on the banner. Choose “No thanks” and the tracker is never loaded at all — not loaded and silenced, simply never fetched. Your choice is remembered in your browser's own storage rather than in a cookie, because recording that you declined cookies by setting a cookie would be a strange way to go about it.

You can change your mind at any time: review your cookie choice.

Your signed-in dashboard is not covered by this. We deliberately do not run Google Analytics on any page behind your login, so what you do inside the product is not reported to Google.

Google also publishes a browser add-on that turns Analytics off everywhere you go: Google Analytics Opt-out. Most browsers' tracker-blocking settings also block it, and nothing on this site stops working if you use either.

What we do with it

• Run your scan and show you the results.
• Keep your dashboard up to date.
• Email you about your account and your results.

We do not sell your data. We do not use it for advertising, and we do not share it with advertisers or data brokers.

Google user data

If you connect your Google account, you grant us two read-only permissions. We cannot change, publish, or delete anything in your Google accounts.

Permission	What we do with it
analytics.readonly Google Analytics	Read visitor numbers for the property you select — sessions, and how many arrived from organic search — so your dashboard can show whether your traffic is growing.
webmasters.readonly Search Console	Read search performance for the site you select — clicks, impressions, and the search terms and pages bringing people to you — so we can show what you already rank for and what to work on next.

How we store it

We do not store your Google Analytics or Search Console data. It is fetched from Google each time you open your dashboard, shown to you, and not written to our database.

We do store three things so the connection keeps working:

• The authorisation token Google issues us, held in our database and used only to request the data above on your behalf.
• Which Analytics property and which Search Console site you chose.
• The email address of the Google account you connected, so you can see which account is linked.

How we share it

We do not sell Google user data, use it for advertising, or transfer it to third parties except in one case, which we want to be plain about:

How we protect it

The authorisation token Google issues us is the most sensitive thing we hold, and it is treated that way:

• Encrypted before it is written. Every Google token is encrypted with AES-256-GCM — an authenticated cipher, so tampering is detected, not just decryption failure — using a unique initialisation vector per record.
• The key is not in the database. It is held separately as a server environment secret, so a copy of the database on its own does not reveal any token.
• No plaintext fallback, ever. If that key is missing our software refuses to store the token at all and the connection fails loudly. It is not possible for a Google token to be written to our storage unencrypted.
• Never displayed or logged. Tokens are never shown in the dashboard, never returned by our API, and never written to our application logs.

How to disconnect

You can disconnect Google at any time from your dashboard, which deletes the stored token. You can also revoke our access directly from your Google account at myaccount.google.com/permissions.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Other services we use

To produce your results we send your website address — not your personal details — to these providers:

• DataForSEO — keyword rankings, backlinks, and competitor analysis.
• Google Places — your public Google listing rating and reviews.
• Anthropic — the dashboard chat, and testing how AI assistants answer questions about your industry.

Our application and database are hosted on Railway.

How we protect your data

In transit

Every connection to letsgetfound.ai is encrypted with HTTPS (TLS). Requests made over plain HTTP are redirected to the encrypted version. All calls we make to Google, and to the providers listed above, are made over HTTPS.

At rest

• Google tokens — encrypted with AES-256-GCM under a key stored separately from the database, and never stored unencrypted under any circumstances. See Google user data above.
• Passwords — never stored. We keep only a one-way scrypt hash with a random per-account salt, which cannot be reversed to recover your password. Nobody at letsgetfound.ai can see or retrieve it.
• Your Analytics and Search Console figures — not stored at all. They are fetched from Google when you open your dashboard and discarded after the page is rendered. There is no copy of your Google data in our database to lose.

Access controls

• Signing in creates a session identified by a random value with no personal data in it. Session cookies are marked HttpOnly (unreadable by scripts in the browser), SameSite=Lax, and Secure over HTTPS.
• Every request resolves your data from your own signed-in session. Our API does not accept an account or business identifier from the browser as a way of choosing whose data to return, so one customer cannot request another customer's data.
• Sessions expire after 30 days, and are destroyed immediately when you sign out or change your password.

How long we keep it

Data	Kept for
Your Google authorisation token	Until you disconnect or delete your account. Disconnecting deletes it immediately.
Google Analytics & Search Console figures	Not retained — fetched live and discarded after display.
Account details and scan history	While your account is open.
Sign-in sessions	30 days, or until you sign out.
Password reset links	1 hour, and single use. The link is stored only as a one-way hash, so the reset link cannot be recovered from our database.

If you ask us to delete your account we delete your personal data and your stored Google token within 30 days.

Your rights

You can ask us to show you what we hold about you, correct it, or delete it. Email hello@letsgetfound.ai and we will respond within 30 days.

Children

This is a service for businesses. It is not directed at anyone under 18 and we do not knowingly collect their data.

Changes

If we change this policy we will update the date at the top of this page. If the change is significant we will email account holders.