SiteLine is the product at siteline.tools, operated by Aglet Technologies. Aglet is the controller of the personal information described in this policy. Questions go to [email protected]. Registered-office details are available on request at that address. This describes how the product works. If a court or regulator requires a different reading, that reading wins.
Information we collect
Account information: name, email, and a password stored only as a one-way hash. Two-factor secrets and passkey public keys are stored when you turn them on.
Every account has a personal team that owns sites, Google connections, and analytics domains. Multi-member collaboration is implemented but off by default.
Google account connection: the Google account email, OAuth access and refresh tokens encrypted at rest, and the Search Console properties that account can access.
Search Console data: clicks, impressions, and average position by date, search type, query, page, country, device, and search appearance. CTR is computed when a report is shown. It is not stored as its own column.
Cookieless web analytics: page URL, path, hostname, referrer, event name, up to 10 property keys, UTM parameters, and coarse device, browser, and OS hints. Country is stored when the request includes it. The raw IP is not stored. The visitor identifier is a daily hash.
Billing: Stripe processes payments. SiteLine stores the Stripe customer id, subscription status, trial and renewal dates, plan, and card brand plus last four digits. Card numbers and security codes go to Stripe and are not stored here.
API and MCP: tokens are stored hashed. Usage logs record which token or client called which tool, which site, when, and the result status.
Technical logs for the SiteLine app itself (sign-in, dashboard, settings) include IP address and user agent for security. That is separate from the analytics hash.
Cookieless analytics
The tracker does not set a first-party analytics cookie. Collect requests use fetch with credentials omitted, so the SiteLine session cookie is not sent with the beacon.
IPv4 addresses are truncated to /24 and IPv6 addresses to /48, then hashed with the user agent and a daily rotating salt. The hash resets each UTC day. The same person is not recognised across days.
Every analytics site has a hostname allowlist. Events from other hosts are rejected. Known bot user agents are dropped before they count.
A consent banner is not required for this analytics cookie, because there is none. You remain responsible for your own legal basis, privacy notice, and any other tracking you add.
How information is used
SiteLine uses it to import and display Search Console data, record analytics you enable, export CSV, and answer AI clients you connect. It is also used to authenticate you, prevent abuse, run the subscription, send service email, answer support, and comply with law. Marketing email is not sent unless you opt in.
Google user data and Limited Use
The only Google scope is webmasters.readonly. SiteLine cannot change Search Console or the Google account.
SiteLine's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, not sold, and not used to train generalised AI models. It is transferred only to provide the features you use, including AI clients you authorise, to infrastructure providers, for security, to comply with law, or as part of a merger with notice. No person at Aglet reads it unless you ask for help with specific data, security requires it, the law requires it, or it has been aggregated and anonymised.
You can revoke access in SiteLine or in the Google Account's third-party access settings.
AI agents
Data is sent only to AI clients you connect, by approving OAuth or by creating an API token. SiteLine does not send your data to an AI provider on its own initiative. Once a client receives data, that provider handles it under its own terms. Revoke the client or delete the token to stop further access.
Sharing
Personal information is not sold. Processors include Stripe for payments, Cloudflare for service email and for DNS, TLS, and abuse protection in front of the app, and cloud hosting for compute and databases. The current hosting location is available from [email protected]. Disclosure also happens when the law requires it, to protect users or Aglet, or to a successor in a merger, in which case this policy continues to apply.
Retention
Account information and imported Search Console data are kept while you have an account. That is how history outlasts Google's 16-month window. Raw analytics events are kept for 13 months, then deleted. Daily rollups are kept while access is active, then for a 30-day grace period, then purged.
Deleting the account deletes imported Search Console data, analytics sites and events, API tokens, and client authorisations, and revokes Google access. Stripe subscriptions are cancelled immediately. Billing records are kept as tax law requires.
Security, cookies, and rights
Data is encrypted in transit with TLS. Google OAuth tokens are encrypted at rest. Passwords and API tokens are hashed. Two-factor authentication and passkeys are available.
The SiteLine app uses a session cookie, a form-security token, and preference cookies. It does not use advertising cookies. The tracker you install on your site does not set an analytics cookie.
Depending on where you live, you may access, correct, export, or delete personal information, object to certain processing, and withdraw consent. Most of that is in settings. Otherwise email [email protected]. SiteLine is not directed to children under 16.
Aglet Technologies, SiteLine, siteline.tools, [email protected].