LS-Labs

SEO Pulse Privacy Policy

Effective: ; updated: | 繁體中文

Scope

This policy explains how the hosted version of SEO Pulse, operated by LS-Labs (the service that AI apps such as Claude and ChatGPT connect to at pulse.lslabs.tw), handles your data.

The open-source local version installed from GitHub runs on your own computer. Its data does not pass through LS-Labs and is outside the scope of this policy.

This is an English translation of the Traditional Chinese policy. Both versions describe the same practices.

Data we receive from Google

When you sign in with your Google account, SEO Pulse requests only the following scopes, all read-only:

  • openid, email: to identify your account. SEO Pulse accepts only email addresses that Google has verified, and on every request it checks that the account may use the hosted service. Per-user usage limits are counted against a keyed hash of your Google account ID, not your email address.
  • Search Console read-only: to read search performance for the properties you have access to, in order to produce reports.
  • Google Analytics read-only: to read traffic data for the GA4 properties you have access to, in order to produce reports.

SEO Pulse does not change your website, Search Console or Google Analytics settings.

Storage and retention

  1. Google grants and reports are not stored. LS-Labs servers do not store your Google authorization on disk or in a database, and do not store Search Console or GA4 data.
  2. Your authorization is held by your AI app. Your Google authorization (refresh token) and your email address are encrypted with a server key and placed inside the connection credential held by your AI app. They are decrypted in server memory only while a request is handled, to call Google and to check that the account may use the hosted service.
  3. In-memory caching. Server memory holds only two kinds of data: short-lived Google access tokens, for up to 1 hour, and tool results (including reports) for identical parameters, for up to 15 minutes. Both are lost when the server restarts.
  4. Security counters. To enforce usage limits across servers and to prevent authorization codes from being reused, Firestore stores keyed hashes of account identifiers, call times and counts, and digests of authorization codes. These records contain no email addresses, Google tokens, tool parameters or reports. Usage records expire 24 hours after the end of their UTC day, and authorization code records expire 60 seconds after the credential expires; the platform then deletes them asynchronously.
  5. Hosting platform logs. The service and its security counters run on Google Cloud in the asia-east1 (Taiwan) region. Cloud Run automatically records standard request logs such as request time, URL and status code, kept for Google Cloud's default 30 days. SEO Pulse itself does not log tool parameters, report contents or authorization data.

Credential lifetimes

  • Access credential: 1 hour.
  • Refresh credential: 30 days, rotated each time it is used.
  • After 30 days without use, you need to sign in and authorize again.

Who receives data

  • Google: SEO Pulse reads data through Google APIs.
  • The AI app you connect, such as Anthropic's Claude or OpenAI's ChatGPT: it receives the report results returned by the tools. See "Data controls in AI apps" below.

LS-Labs does not sell your data, does not use it for advertising, does not use it to train models, and does not use it for LS-Labs research or articles. LS-Labs staff do not read your Google data unless you explicitly agree to it for troubleshooting, it is needed for a security investigation, or the law requires it.

Data controls in AI apps

Tool results enter the conversation in the AI app you use. They can include site URLs, page URLs, search queries, clicks, impressions, sessions and traffic sources. Once the results reach the AI app, how long they are kept, whether they are used to improve or train models, and how to delete them are governed by that service's policies and your account settings. LS-Labs cannot control or delete them.

Before connecting, make sure your AI app account settings meet your own or your organization's requirements for website traffic data. If you do not want this data to enter a third-party AI service, do not connect the hosted version.

Google API Services User Data Policy

SEO Pulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

  1. Remove the SEO Pulse connection in your AI app.
  2. Remove SEO Pulse on the third-party connections page of your Google Account.

Revocation takes time to take effect after you revoke access at Google: while it propagates on Google's side, the short-lived Google access token SEO Pulse already holds (up to 1 hour) and the in-memory result cache (up to 15 minutes) may remain valid. Delete any content already sent into an AI app conversation in that AI app.

Contact

For questions about this policy, email me@lslabs.tw.

Related pages: SEO Pulse, Terms of Service (Traditional Chinese)