Analytics Tools Privacy Policy

01

Scope of This Policy

This policy explains how LEV Wigs’ internal analytics tools access, use, store, and share Google Search Console and Google Analytics data. It applies to the reporting connection and related internal analysis workflows described below.

This page does not replace our general Site Privacy Policy, which explains how LEV handles data collected from website visitors, wholesale inquiries, and orders — for example data sent through contact forms and cookies used by the website itself. If you are a visitor, buyer, or wholesale customer of levwigs.com, that page is the one that applies to your data. This page covers only the internal analytics tools described below.

02

The Applications Covered

The Google OAuth application is registered as “B2B Data Dashboard”, and the desktop OAuth client is named “LEV SEO Readonly”. The name shown by Google may vary by authorization screen. These names identify the connection used in LEV’s internal reporting workflow.

These tools are used only by authorized LEV internal operators. They are not a public login service, they are not available to website visitors, and they do not provide visitor-facing login or customer account integration.

The connection runs as a local process on the operator's own computer (a local "stdio MCP" connection) that our local coding and analysis workflows — such as Codex and Claude Code — can call on to pull reports.

The toolset is used under LEV's own Google account authorization. It is not presented as a publicly verified application, and this page makes no claim of Google verification or certification.

The Google account used for authorization may have access to more than one website or Analytics property. The connection does not itself restrict access to levwigs.com. Operators must select the correct property and access only data they are authorized to use for the relevant internal task.

03

Data the Tools Can Read

The tools request only two read-only Google authorization scopes:

• https://www.googleapis.com/auth/webmasters.readonly — Google Search Console performance data
• https://www.googleapis.com/auth/analytics.readonly — Google Analytics (GA4) reporting data

Within these scopes, the tools can read:

From Google Search Console: the search queries for which levwigs.com pages appeared, the pages that were shown, and their clicks, impressions, and average ranking positions.

From Google Analytics (GA4): traffic sources, aggregated user and session metrics, engagement metrics, configured event counts, and accessible property and data-stream configuration. An event count, including an event named generate_lead, does not by itself verify successful backend form delivery, a qualified inquiry, or a sale.

Read-only means exactly that. This connection cannot publish or edit website content, cannot change Analytics settings, and cannot submit changes in Search Console.

The tools do not read Gmail or any other Google account content, account passwords, or payment data, and the two scopes listed above do not grant access to such data.

04

How the Data Is Used

Report data pulled by the tools is used only for LEV's internal purposes:

• Internal reporting — how levwigs.com pages perform in Google Search and how traffic behaves in GA4.
• SEO diagnosis — identifying which queries, pages, and content areas need attention or repair.
• Content planning — deciding what to write, improve, or restructure next.

We do not sell this data, we do not transfer it to advertisers, data brokers, or resellers, and we do not use it for advertising, retargeting, or to determine credit-worthiness. Our use of the data is limited to the practices described in this policy, in line with what the Google API Services User Data Policy requires of applications. If we materially change how the tools use Google user data, we will update this page before the new use begins.

05

How Credentials and Report Data Are Stored

Two different kinds of data are involved, and they are stored separately.

OAuth credentials. OAuth credentials are stored in a restricted directory on the operator’s computer and used by the local authorization client to authenticate with Google. They are not embedded in the public website or included in AI prompts or report documents. Credential values and private storage locations are not published.

Report data. Search Console and GA4 figures pulled by the tools are saved into local working files and internal LEV working documents on the operator's computer, where they are used for the analysis purposes described in Section 4.

06

Third-Party and AI Processing Boundaries

The Google reporting connection runs on the operator’s computer. Selected report extracts, queries, page URLs, metrics, and related analysis may also be sent to externally hosted AI services through Codex or Claude Code.

Codex and Claude Code are the interfaces used by the operator; the service processing a request depends on the account, model provider, and configuration in use. Running the reporting connection locally does not mean that all report processing remains on the computer.

External processing may involve transmission, provider-side processing, and storage of prompts, responses, or service logs. The applicable provider terms and account settings govern retention, deletion, and any use for model improvement. This policy does not promise zero retention, local-only processing, or that every provider configuration excludes model training.

Before sending Google report data to an AI service, operators must check that the provider’s terms and the selected account settings permit the intended use and are consistent with this policy and applicable Google requirements. If that cannot be established, operators must keep the report out of that service and continue the analysis locally.

Operators must limit submitted information to what the analysis requires. OAuth client secrets, refresh tokens, passwords, and unnecessary customer information must not be included in prompts. Report data must not be sold or used for advertising, retargeting, or general-purpose model training.

07

Data Retention and Deletion

There is currently no automatic deletion period for locally stored reports, and we do not claim one. Local report files and internal working documents are kept until an operator deletes them. If you need an existing local report deleted, contact us through the channel in Section 10 and we will handle the request.

Search Console and GA4 data that remains inside Google's own services is retained under Google's own policies, which this page does not override.

Deleting a local report does not delete copies in AI conversations or external service logs. Those copies require separate handling under the relevant provider’s retention and deletion controls. This policy does not claim that LEV can delete provider-held copies merely by deleting a local file.

08

Revoking Access

An authorizing operator can revoke the tools' access at any time through their Google Account's third-party connections page: Google Account → Security → Third-party apps with account access (also shown as "Your connections"), then removing the connection associated with the application (the displayed name may vary). Google's own instructions are available in the Google Account help center.

Two different operations are involved, and it is worth keeping them apart:

• Revoking access stops further access using that Google authorization.
• Deleting existing reports removes report files that were already saved locally before revocation. This is a separate, manual step (see Section 7).

Revoking access does not delete reports that already exist.

09

Security Measures

• Only the two read-only scopes listed in Section 3 are requested; no write or publish permission is requested or held.
• OAuth credentials are kept in a restricted directory on the operator's computer — never on the website — and their location and values are not published.
• Use of the tools is limited to authorized internal operators.
• The operator's computer is protected by that computer's own user-account security; we do not publish further configuration details.
• If a credential is ever believed to be compromised, it is revoked through the Google Account page described in Section 8, and any affected reports are reviewed.

10

Changes to This Policy and Contact

We may update this page to keep it accurate. Changes take effect when the new version is published on this page with an updated "Last updated" date. Material changes to how Google user data is used will be documented here before the new use begins.

Questions about this policy, requests to delete existing local reports, or concerns about the tools can be sent through our contact page.