1. Who we are
Regenious (“we”, “us”) is a software service operated by Regenious at regenious.com. It helps search-engine-optimisation (SEO) agencies view their clients’ website and local search performance in one dashboard and create branded reports. You can reach us at privacy@regenious.com.
2. Agencies and their clients
Our customers are agencies (“workspaces”). Each agency decides which websites, Google properties and business locations it connects and which people in its team can see them. For data an agency puts into Regenious about its own clients, the agency is the controller and we process that data on its behalf and only on its instructions. For account data of the people who sign up and use Regenious, we are the controller.
An agency may only connect a client’s Google properties with that client’s permission. It can do this in one of two ways: the client gives the agency access to the property in Google (for example as a Search Console or Analytics user) and the agency connects it, or the agency sends the client a secure connect link and the client signs in with Google and grants access themselves. Either way, Google shows the consent screen to the person signing in, and access can be removed at any time by disconnecting in Regenious or at Google.
3. Data we collect
- Account data: name, work email, phone (optional), job title, company name, hashed password, two-factor settings and the role you are given.
- Workspace content: client names, websites, business locations, tags, report templates, notes, tasks and their comments, team chat messages and the files sent in them, logos and brand colours you upload. Team chat messages are visible only to the two team members in the chat and are kept until they delete them or the workspace is deleted.
- Google data: performance data from the Google products you connect — described in detail in section 4.
- Sign-up answers: how you heard about Regenious (optional), and the campaign tag of the link you first arrived from (for example “linkedin”), if there was one. Used only to learn which channels bring agencies.
- Billing data: plan, invoices and payment proofs you upload. Card payments are made on Paddle's checkout, so we never receive or store card numbers.
- Technical data: IP address, browser user agent, sign-in times, security events and error logs, used to keep accounts secure and the service running. Emails in logs are masked and secrets are removed before anything is stored.
- Partner program: if you apply as a partner — your name, email, company and country (optional), where and how you will promote us, your sign-in history, the clicks on your referral link (counted per day, without IP addresses), the agencies you referred (partners only see a shortened name) and the account your commission is paid into, stored encrypted. Kept while you are a partner and afterwards as long as tax and accounting law requires for payouts. If an agency signs up with a partner's code, we keep which partner referred it, to give its discount and pay the commission.
- Free tools (Local SEO Audit): the website you enter, the optional business phone and postal code, the results and a one-way hash of your IP address, kept for 30 days to show the report and limit abuse, then deleted. If you ask for the report by email, we send it once and keep the address with the report for the same 30 days; it is not added to any mailing list. The form uses Cloudflare Turnstile to tell people from bots, which processes your browser and connection details under Cloudflare's privacy policy.
- Demo bookings: if you book a demo — your name, email, agency name, and optionally its website, your phone and what you would like to see, the time and your time zone, the campaign link you came from and a one-way hash of your IP address. We use them to hold the meeting and email you about it (confirmation, the meeting link, changes). Other visitors never see your booking. Kept for one year after the meeting, then deleted. The form uses Cloudflare Turnstile as above.
4. Google user data
When you choose Connect Google, you sign in on Google’s own page and grant Regenious access to specific Google products. We only request the scopes below, and only the ones needed for the features you use:
| Google product & scope | What we access and why |
|---|---|
Google Search Consolehttps://www.googleapis.com/auth/webmasters.readonly | Read search performance (clicks, impressions, CTR, average position, queries, pages, devices) and URL Inspection index status for the sites you choose to connect. |
Google Analytics 4https://www.googleapis.com/auth/analytics.readonly | Read website traffic reports (sessions, users, channels, landing pages, events and key events — for example phone clicks and forms sent) and which events are marked as key events, for the GA4 properties you choose to connect. |
Google Business Profilehttps://www.googleapis.com/auth/business.manage | Read the locations you manage and their performance (calls, direction requests, website clicks, Search and Maps views, search keywords), reviews and posts, so they can be shown in dashboards and reports. Publish, only when a member of your team does it (or schedules it): replies to reviews and posts (text, an optional photo and button) on the locations you choose — and edit or delete those replies and posts when a member asks. We never edit or delete your listing details. Only requested when you choose to connect Business Profile. |
Google Tag Managerhttps://www.googleapis.com/auth/tagmanager.readonly | Read the containers you can see and, for the ones you link to a client, their published version (tags, triggers, variables) and unpublished workspace changes, to check that Google Analytics, phone-click and form tracking are set up correctly and to show when a new version is published. Read-only: we never create, change or publish anything in Tag Manager. Only requested when you choose to connect Tag Manager. |
We also receive your Google account email address and a basic profile identifier, to show which Google account is connected.
How Google data is used
- To show dashboards, charts, tables and index status for the clients you map each property to.
- To create the reports, PDF files, CSV exports and alerts that you or your team ask for.
- To keep the data current: a background process refreshes it once a night and when you press “Sync now”.
- To write an optional AI summary when you add one to a report: the report’s aggregated figures (totals, changes, top search queries, channels and index counts) are sent to our AI provider, which returns a short text summary. No tokens, email addresses or other personal data are sent. Reports without an AI summary send nothing.
We use Google data only to provide these user-facing features in Regenious, and for no other purpose.
What we never do with Google data
- We never sell it, rent it or give it to data brokers or advertising platforms.
- We never use it to serve advertising, including personalised or retargeted ads.
- We never use it to develop, improve or train generalised or non-personalised AI or machine-learning models.
- Search Console, Analytics and Tag Manager access is read-only: we never change anything there. On Google Business Profile we only publish what your team writes and chooses to publish — replies to reviews and posts, sent when a member presses Publish or at the time they scheduled. We change or remove a review reply or a post only when a member of your team edits or deletes it. We never edit or delete your listing details (name, address, hours, categories).
- No person at Regenious reads your Google data, except (a) with your explicit permission for a support request, (b) when needed for security purposes such as investigating abuse, (c) to comply with law, or (d) when the data is aggregated and anonymised for internal operations.
Storage of Google data
Access and refresh tokens are encrypted with AES-256-GCM before they are stored. Performance data is stored in our database in the workspace of the agency that connected it, and is visible only to that agency’s permitted team members and to the people they share a report with.
5. Limited Use disclosure
Regenious’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
This means Google data is used only to provide user-facing features of Regenious; it is never sold, never used for advertising, never used to train generalised AI models, and is only transferred to others as described in section 7 or as required by law.
6. How we use data in general
- To provide, secure and support the service (sign-in, two-factor codes, password resets, invitations).
- To send service emails: security notices, invitations, report links and billing messages.
- To detect, investigate and fix errors and abuse.
- To meet legal, tax and accounting obligations.
We do not use your data for advertising and we do not sell personal data.
7. Sharing
We share data only in these cases:
- Inside your workspace: with team members your agency invited, according to their role and client access.
- When you share a report: anyone with a share link you created can view that one report until the link expires or you revoke it.
- Service providers that host or run parts of the service for us under contract and confidentiality (for example server hosting, email delivery and file storage). They may use the data only to provide their service to us.
- Payments (Paddle): card and online payments are processed by Paddle.com as Merchant of Record. Paddle receives the billing name, email, address and payment details you enter in its checkout, and handles them under its own privacy policy. We receive only the subscription status and invoices, never card details.
- AI provider (DeepSeek): only when you add an AI summary to a report, the aggregated report figures described in section 4 are sent to it to write that summary. Nothing else is sent, and it is not given access to your Google accounts.
- Legal reasons: when required by law, or to protect the rights, safety and security of our users or the public.
- Business transfer: if Regenious is merged or acquired, with the same protections continuing to apply, and with notice to you.
Google user data is only transferred to others in the cases allowed by the Limited Use requirements above.
8. Security
- All traffic uses HTTPS. Google tokens and other secrets are encrypted at rest (AES-256-GCM, rotatable keys).
- Passwords are hashed; two-factor authentication is available; sessions are rotated and bound to the device.
- Every database query is limited to the agency that owns the data, and members can be restricted to assigned clients.
- Uploaded files are kept in private storage and served only through short-lived signed links.
- Access by our staff is limited, logged in an audit trail, and used only for support and security.
No system is perfectly secure. If we learn of a breach that affects your data, we will notify you without undue delay.
9. Retention and deletion
- Disconnecting Google (Integrations page) stops all syncing at once, revokes our access at Google and deletes the stored tokens. You can also revoke access at myaccount.google.com/permissions.
- Google performance data already imported is kept while your workspace is active so that historical reports keep working. You can ask us to delete it at any time.
- When a workspace is closed, or on a deletion request, we delete its Google data, tokens, reports and files within 30 days, and remove them from backups within a further 30 days.
- Error and security logs are kept for up to 90 days.
- Invoices may be kept longer where tax law requires it.
See the data deletion page for step-by-step instructions.
10. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict its processing, and to complain to your data protection authority. Email privacy@regenious.com and we will reply within 30 days. If your data was added by an agency you work with, we will pass your request to that agency and help them answer it.
11. Cookies
We use only cookies that are needed for the service to work: a session cookie to keep you signed in, and short-lived cookies that protect the Google sign-in flow. We do not use advertising cookies.
On our public website only (not inside agency workspaces or client portals) we use Google Analytics to count visits and see which pages are useful. It sets its own cookies and sends Google your pages viewed, browser and approximate location — not your name or email. You can block it with any ad or tracker blocker, or Google's opt-out add-on.
On our public website, when you arrive from a link with a campaign tag (for example from one of our social posts), your browser keeps that tag in its local storage for 30 days so it can be sent with your sign-up. It holds only the tag and the time — nothing about you — and is never shared with third parties. You can clear it by clearing your browser’s site data.
The same goes for a partner's referral link: the partner code is kept in your browser's local storage for 90 days so your sign-up gets the partner discount. Partners who sign in to their dashboard get a session cookie like everyone else.
12. Children
Regenious is a business tool and is not meant for anyone under 16. We do not knowingly collect data from children.
13. Changes to this policy
If we change this policy we will update the date at the top, and for important changes we will tell workspace owners by email before the change takes effect. We will ask for your consent again before using Google user data in a new way.
14. Contact
Questions or requests about privacy: privacy@regenious.com. General support: contact page.