Privacy Policy

Updated November 10, 2026

This policy describes how AI Web Bot handles information when you use the public site and the signed-in workspace. AI Web Bot is an invitation-only workspace for the websites, search, and reports a team already runs.

Account information

Sign-in is handled by Clerk. We receive the name, email address, and organization membership needed to open your workspace and to send a sign-in code when email verification is turned on. We do not sell that information.

What you put in the workspace

Messages, site instructions, and files you submit are stored so the team can review them. A site change does not go live until someone on the team with permission approves it.

Google data you connect

Connecting Google is optional. If you connect an account, AI Web Bot requests access only for the products you turn on:

  • Google Analytics, to read and manage the properties you select
  • Search Console, to read search data and request indexing
  • Business Profile, to manage the locations you connect
  • YouTube, to read analytics and channel data you connect
  • Google Sheets, to read spreadsheets you connect
  • Tag Manager, to read the containers you connect, create draft changes in a separate AI Web Bot workspace, and publish them only after you confirm
  • Google Ads, to read performance and to create or edit campaigns in the ads accounts you connect; new campaigns are created paused, and changes are made only after you confirm

We use that data to show reports and to carry out the work you ask for inside your organization. We do not sell Google user data, and we do not use it to serve ads. We do not use Google user data to develop, improve, or train generalized AI or machine learning models. Google data is sent to the AI agent service only as needed to carry out the task you request, and it is not retained by that service for training. AI Web Bot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who else sees it

People in your organization can see the workspace you share with them. We use service providers to run the product, including hosting, database, sign-in, and the AI agent service that carries out the work you ask for. They process data for that purpose. We share information when the law requires it.

Data security and protection

We protect your information, including data from Google products you connect, with these measures:

  • Encryption in transit. The site and workspace are served only over HTTPS, and plain HTTP requests are redirected to HTTPS. Our servers call Google APIs over HTTPS.
  • Encrypted Google tokens. Google access and refresh tokens are encrypted with AES-256-GCM before they are saved to our database. The encryption key is kept in server configuration, separate from the database. Tokens are decrypted only on our servers, when needed to call Google for your organization, and are never sent to your browser.
  • No tokens given to the AI agent. The AI agent that does the work does not receive your Google tokens. It gets a short-lived, signed credential that works only for your organization, and our servers make the Google API calls.
  • Access control. Every workspace request requires a signed-in account and membership in the organization. Google connections are stored per organization, and the workspace shows their data only to members of that organization. Only organization admins can connect a Google product.
  • Logging. Our Google sign-in and token handling does not write tokens or authorization codes to logs. Error reports sent to our monitoring tools pass through a filter that removes credential-like values and contact details.

How long we keep it

Account and workspace data stays while the organization uses AI Web Bot. Google tokens stay stored, encrypted, while that Google connection exists. When an organization admin disconnects a Google product in the workspace, we delete its stored tokens right away. If the person who connected it has no other Google products connected, we also ask Google to revoke AI Web Bot's access. You can revoke access at any time from your Google Account permissions; after that, the stored tokens no longer work. To ask us to delete other data, contact us at the address below.

Contact

Questions about this policy go to julius@islaintel.com.