Privacy Policy

Instant Reporting Engine (“the Service”) is operated by Isonic Media, a digital marketing agency based in Mohali, India. The Service is used by Isonic Media staff to prepare the periodic performance reports we deliver to our clients, and by those clients to read the reports prepared for them.

This policy explains what data the Service holds, how it is used, how it is protected, how long it is kept, and how it can be removed.

1. Data the Service holds

Account data

• Name and email address of each person given access.
• A password hash. Plain-text passwords are never stored.
• Which client account each person may see.

Reporting data

• Client names, websites and industry.
• Performance figures for each reporting period.
• Screenshots and notes uploaded by agency staff.
• Published reports and the comment threads attached to them.

Data accessed through Google APIs

Where a client authorises it, the Service reads aggregate performance data from that client’s own Google accounts. Access is read-only in every case.

• Google Analytics (analytics.readonly) — period totals for sessions, users, conversions and revenue, and the daily series behind them.
• Google Search Console (webmasters.readonly) — clicks, impressions, click-through rate, average position, and the search queries the site appeared for.
• Google Ads (adwords) — spend, impressions, clicks, conversions and conversion value for the authorised account.
• Google Business Profile (business.manage) — calls, direction requests, website clicks, messages and views from Search and Maps. This scope has no read-only variant; the Service only ever reads.

The Service does not read individual-user records, visitor identities, IP addresses or any other user-level data from these products. It reads aggregate figures only.

2. How data is used

Data is used for one purpose: producing and delivering the performance report for the client it belongs to. It is never used for advertising, never sold, never rented, and never combined across clients.

Specifically, data obtained through Google APIs is not:

• sold, rented or transferred to any third party;
• used for advertising, remarketing or audience building;
• used to train, fine-tune or improve any machine-learning or AI model, whether ours or a third party’s;
• read by any human except where a named client asks us to investigate a problem with their own report, or where the law requires it.

3. How sensitive data is protected

Google account authorisations are the most sensitive data the Service holds, and they are protected by the following specific measures.

Encryption of OAuth credentials

• OAuth refresh tokens are encrypted before they are written to the database, using AES-256-GCM with a 256-bit key.
• That encryption key is held only in the server’s environment configuration. It is not stored in the database, not held in the application source code, and not present in any backup of the database. A copy of the database alone therefore yields no usable credential.
• Access tokens are short-lived, held in memory for the duration of a single request, and never written to disk or to logs.
• Google client secrets and API keys are held in the server environment only, never in the database and never in the application source.

Encryption in transit and at rest

• All traffic to and from the Service is encrypted with TLS 1.2 or above. HTTP requests are redirected to HTTPS.
• All calls to Google APIs are made server-side over HTTPS. Credentials are never exposed to the browser.
• The database is hosted on PostgreSQL with encryption at rest, as are stored files and backups.

Access control

• Every table enforces row-level security in the database itself, not merely in the interface. A client user’s session can only read rows belonging to that client, whatever request is made.
• Only an agency administrator may create or remove logins, or connect or disconnect a Google account. Client users have read-only access to their own published reports.
• Connected Google accounts are never visible to client users.
• Administrative database credentials are held by Isonic Media alone and are rotated if there is any reason to believe they have been exposed.

Automated processing

The Service uses a third-party language model to draft the written commentary in a report. Only the aggregate figures for the period and the notes typed by agency staff are sent for this purpose. No Google account credentials, no personal data and no user-level data are sent. This content is not used to train any model, and the agency reviews and may edit every generated passage before a report is published.

4. Who data is shared with

We do not sell or rent data. Data is shared only with the service providers that run the Service: our database, authentication and file-storage provider; the language-model provider described above; and our hosting provider, which stores the application and serves it over HTTPS.

Each client’s data is visible only to Isonic Media and to the people that client has been given logins for. One client can never see another client’s data.

5. Retention and deletion

• Reports and their figures are kept for as long as the client relationship continues, so that past periods remain available for comparison.
• Disconnecting a Google account deletes the stored refresh token immediately. Figures already published in a report remain, because a published report is a frozen record.
• A client may ask us to delete their account and all associated data at any time. We act on such a request within 30 days.
• Deleting a user account removes that person’s login and personal details.

6. Withdrawing access

A client may revoke the Service’s access to their Google account at any time, without contacting us, at myaccount.google.com/permissions. Access stops immediately. You may also ask us to disconnect it, and we will do so and delete the stored token.

7. Your rights

You may ask us what data we hold about you, ask for it to be corrected, ask for a copy, or ask for it to be deleted. Write to the address below and we will respond within 30 days.

8. Children

The Service is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

9. Changes to this policy

If this policy changes materially, we will update the date at the top of this page and notify account holders by email.

10. Contact

Isonic Media, Mohali, Punjab, India — isonicmedia.ai@gmail.com