Privacy Policy
Last updated 15 October 2026
This policy explains what PortyLink collects, why, and what control you have. PortyLink is operated by PortyLink (“we”). Questions: hello@portylink.com.
Our role
For your account details we are the data controller. For data you connect from other services, such as Google Analytics and Search Console, we act as a processor on behalf of the organization that connected it, and only process it to provide PortyLink to that organization.
What we collect
- Account information: your email address, name, and a password hash (passwords are handled by our authentication provider and never stored in plain text).
- Organization data: organization names, memberships and roles, invitations, and the sites you add.
- Google user data: when someone in your organization connects a Google account, we receive OAuth tokens and, on request, report data from Google Analytics 4 and Google Search Console (see below).
- Activity and security logs: actions taken in your organization (for example “added a site”), with the time, IP address and browser type, and records of API and agent requests.
How we use Google user data
PortyLink requests read-only access: analytics.readonly for Google Analytics and webmasters.readonly for Search Console. We use this access only to list the properties you can access and to fetch the reports that you, your team, or the agents and API keys you authorize ask for. We never change anything in your Google accounts.
- We do not sell Google user data or use it for advertising.
- We do not use Google user data to train or improve AI or machine-learning models.
- Our staff do not read your Google data unless you ask us to (for support), it is needed for security, or the law requires it.
- Report results may be cached briefly to stay within Google's rate limits, then deleted.
PortyLink's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
AI agents and integrations
When your organization connects an AI agent (such as Claude, ChatGPT or Cursor) or creates an API key, PortyLink sends that agent or key the data your organization authorized for it, at your instruction. The provider of that agent then handles the data under its own terms and privacy policy. You can see and revoke every agent's access at any time.
Where data is stored and who processes it
Your data is stored in the European Union. We use these service providers:
- Supabase: database and authentication, hosted in Ireland (EU).
- Vercel: application hosting; our servers run in Dublin, Ireland (EU).
- Upstash: short-lived caching of report results (up to a day), encrypted access tokens, and rate-limit counters, hosted in the EU.
We will update this list before adding providers for email delivery or error monitoring.
Security
Data is encrypted in transit. Google refresh tokens are additionally encrypted at rest. Each organization's data is isolated at the database level, and access inside an organization follows the roles you assign.
Retention and deletion
- Account and organization data: until you delete it or close your account.
- Google connections: when you disconnect, we delete the tokens and revoke our access at Google.
- Activity log: 1 year. Request records: 90 days. Cached reports: hours to days.
Your rights
Depending on where you live, including under the GDPR, you can ask to access, correct, export or delete your personal data, or object to its processing. Contact hello@portylink.com. You can also remove PortyLink's access to your Google account at any time at myaccount.google.com/permissions. You may complain to your local data protection authority.
Cookies
We use only the cookies needed to keep you signed in. We don't use advertising or cross-site tracking cookies.
Children
PortyLink is a business service and is not intended for anyone under 16.
Changes
If we change this policy in a way that matters, we'll tell account owners by email before it applies.