Privacy Policy

This Policy applies to all users of the Service: the agency operator (Heartland Digital staff and contractors), agency client organizations whose marketing data is displayed in the Service, and individual end-users of those client organizations who view dashboards or manage integrations.

2.1 Information you provide directly

• Account details: name, business email address, organization name, role within the organization, and the password you choose when registering or accepting an invitation.
• Organization profile: organization display name, industry, logo image (if uploaded), primary domain (used to validate which Google properties belong to which client), and configurable preferences such as the revenue-source-of-truth toggle.
• Marketing data you upload: CSV or XLSX files containing your marketing performance data (impressions, clicks, spend, leads, conversions, revenue, channel, platform, campaign name, landing page URL, etc.).
• Communication records: any messages you send us when you contact support.

2.2 Information we receive from Google (with your authorization)

When an authorized operator at your organization chooses to connect a Google account to the Service, you will be redirected to Google's standard OAuth 2.0 consent screen. You will see exactly which Google scopes the Service is requesting and can approve or decline. If you approve, Google sends us:

• An OAuth refresh token and short-lived access tokens for the authorized scopes.
• Your basic Google profile: the email address, display name, and profile picture associated with the Google account you signed in with (only because you granted openid, userinfo.email and userinfo.profile scopes; these let us display "Connected as <your name>" on the integrations page).
• Read-only marketing data retrieved by our backend from the four Google APIs listed in Section 5 below, scoped strictly to the properties / sites / customers / locations you explicitly select inside our property picker. We never read data from Google properties you did not pick.

2.3 Information collected automatically

• Usage data: pages visited within the dashboard, features used, dates and times of access, interaction events.
• Device and connection data: browser type and version, operating system, screen size, IP address, approximate geographic location derived from IP.
• Cookies and similar technologies: a session cookie holds your authentication token, and a viewing-organization cookie remembers which client organization an elevated user has switched to. We do not use advertising cookies or third-party tracking cookies.
• Audit logs: we record administrative actions inside the Service (connecting / disconnecting a Google account, running a manual sync, changing organization settings) with the user, timestamp, and a brief description.

• To provide, operate, and maintain the Service and authenticate you between sessions.
• To display your marketing performance, aggregated and per-channel, inside dashboards you and your organization's authorized users can view.
• To pull, on your behalf and within the scopes you approved, daily metrics from Google APIs and store them in the Service so reports remain available without re-querying Google on every page load.
• To send service-related transactional emails (account invitations, password resets, scheduled report digests you have opted into, and notifications when a Google connection is broken and needs to be re-authenticated).
• To monitor and improve performance, reliability, and security; detect and prevent abuse, fraud, and unauthorized access.
• To comply with legal obligations, respond to lawful requests, and enforce our Terms & Conditions.

We do not use information received from Google APIs to develop, improve, or train generalised AI or machine-learning models. We do not display advertising in the Service and we do not use any data, Google-sourced or otherwise, to serve ads.

Specifically, we commit that:

• Use of Google user data is limited to providing or improving user-facing features of the Service that are visible and prominent in the requesting application's user interface.
• We do not transfer Google user data to others except as necessary to provide or improve user-facing features that are visible and prominent in the requesting application's user interface, or as required by law.
• We do not use Google user data to serve advertisements, including any retargeting, personalised, or interest-based advertising.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, are doing so for security purposes (e.g. investigating abuse), to comply with applicable law, or for internal operations and even then only when the data have been aggregated and anonymised.

The unified Connect Google flow asks Google to grant the following scopes. You may approve or decline each on the consent screen, although declining any of the API scopes will prevent the corresponding channel from working inside the Service.

We do not sell personal information. We do not share Google user data with third parties for marketing purposes. We share information only in these limited cases:

• Within your organization: users belonging to the same client organization as you may see the same dashboards and aggregated data, scoped by role (super-admin, manager, admin, viewer, client).
• Service providers (sub-processors): hosting infrastructure, managed database, and transactional email delivery providers we use to operate the Service. These providers are bound by contract to process data only on our documented instructions and to maintain appropriate security.
• Legal obligations: when required to comply with law, valid legal process, or a lawful government request, or to enforce our Terms & Conditions, or to protect the rights, safety, and property of Heartland Digital, our users, or the public.
• Business transfers: if Heartland Digital is involved in a merger, acquisition, or sale of assets, information may be transferred subject to the acquirer continuing to honour this Policy.

• Application data is stored in a managed PostgreSQL database operated by our hosting provider. Database access is restricted to the application service account and requires authenticated connections over TLS.
• OAuth refresh tokens received from Google are encrypted at rest using AES-256-GCM before being written to the database. The encryption key is held in the application's runtime environment, separate from the database, so a database-only exposure cannot decrypt tokens.
• OAuth access tokens are short-lived (approximately one hour) and are also stored encrypted.
• All web traffic to the Service is served over HTTPS. All server-to-Google API traffic uses TLS.
• Passwords for Service accounts are hashed with bcrypt and never stored in plain text.
• Role-based access controls scope every database read and write to the organization the requesting user belongs to. Elevated roles (super-admin, manager) can switch between organizations via an explicit, audit-logged action.
• Administrative actions are recorded in an immutable activity log.
• We review security practices periodically and apply patches and dependency updates promptly.

• Account and organization records: retained for as long as the account is active and for a reasonable period afterwards (typically up to 12 months) to support reactivation, dispute resolution, and our legitimate business interests.
• Marketing data retrieved from Google APIs: retained for as long as the corresponding connection is active. If you remove a property or disconnect the Google account, you may also request deletion of the underlying metric rows (see Section 9).
• OAuth refresh tokens: deleted as soon as you disconnect Google or remove the Service's authorization from your Google account; we also call Google's token-revocation endpoint at the same time.
• Sync audit logs (sync_jobs): automatically pruned after 90 days.
• Administrative activity logs: retained while the operator account is active.
• Backups: we keep encrypted backups of the database for a rolling window (typically up to 30 days) to support disaster recovery. Deletion requests are reflected in live data immediately and in backups as they are rotated.

• Access: you can view your account information and your organization's data inside the Service at any time.
• Correction: you can update your profile and organization settings inside the Service or by emailing us.
• Deletion: you can request deletion of your account and the data we hold about you by emailing the contact address at the end of this Policy. We will respond within a reasonable timeframe and, where the request is granted, delete the relevant records from live systems and let backups rotate out.
• Withdraw your Google authorization at any time:
  • Inside the Service: open the Integrations page and click Disconnect Google. This calls Google's token-revocation endpoint and deletes the refresh token, access token, and all per-property connection records.
  • From Google directly: visit https://myaccount.google.com/permissions and remove the Heartland Digital Marketing Dashboard from your authorized third-party applications. The next sync attempt will then fail with invalid_grant, the connection will be marked broken, and the refresh token row will be marked inactive.
• Opt out of non-essential email: scheduled report digests can be configured or turned off in the Service settings. Transactional emails (re-authentication notices, account invitations) cannot be turned off while you have an active account.

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may process and store information in countries other than the country in which the information was originally collected, including in jurisdictions that may have different data-protection laws. Where required by applicable law, we put in place safeguards (such as Standard Contractual Clauses) for cross-border transfers of personal data.

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policy of every website you visit.

We may update this Policy from time to time. Material changes will be notified inside the Service or by email to the administrative contact for your organization at least seven days before they take effect. The "Last updated" date at the top of this Policy will reflect the latest revision. Continued use of the Service after a revision takes effect constitutes acceptance of the updated Policy.

For privacy questions, data-access or data-deletion requests, or any concerns about how Heartland Digital handles your information, contact us at:

Heartland Digital
Email: service@heartland-digital.com