Privacy Policy
How we collect, use, and protect your data.
Last updated: May 12, 2026
1. Who we are
They Will Know Me ("we", "us", or "our") operates the website theywillknow.me. This privacy policy explains how we handle personal data when you use our service.
Data controller: They Will Know Me
Contact: privacy@theywillknow.me
2. Data we collect
2.1 Account data
When you sign in with Google OAuth, we receive your Google account email address and profile name. We use this solely to identify your account. We do not receive or store your Google password.
2.2 Google Analytics 4 and Search Console data
With your explicit consent, we request read-only access to your GA4 property and Search Console site. We pull metrics such as sessions, page views, queries, impressions, CTR, and position data for the past 90 days. This data is used only to generate your SEO/GEO report and is not shared with third parties.
2.3 Usage data
We collect standard server logs including IP address, browser type, pages visited, and timestamps. This data is used for security, debugging, and aggregate analytics. Logs are retained for 30 days.
2.4 Payment data
Payment processing is handled entirely by Stripe. We never see or store your credit card number. We retain a Stripe customer ID linked to your account to manage your subscription.
3. How we use your data
- To authenticate you and maintain your session
- To generate your SEO and GEO strategy report
- To process your subscription payments via Stripe
- To send you transactional emails (report ready, billing receipts)
- To improve the service through aggregate, anonymized usage analysis
We do not sell your data. We do not use your data for advertising. We do not share your data with any third party except the processors listed in Section 5.
4. Legal basis for processing (GDPR)
- Contract performance: Processing necessary to deliver the service you signed up for (account management, report generation).
- Legitimate interest: Security logging and fraud prevention.
- Consent: Access to your Google Analytics and Search Console data, and the use of analytics cookies (GA4, Google Tag Manager, PostHog). You can revoke analytics consent at any time via the cookie banner, and revoke Google data access from your Google account settings.
5. Third-party processors
| Processor | Purpose | Data shared |
|---|---|---|
| Supabase | Database and authentication hosting | Account data, report data |
| Stripe | Payment processing | Email, billing address |
| Google OAuth | Authentication | Profile name, email |
| Vercel | Hosting and infrastructure | Request logs |
| Google Analytics 4 / Tag Manager | Traffic and usage analytics (consent-based) | Anonymized IP, page views, events |
| PostHog | Product analytics (consent-based) | Usage events, page views |
All processors are bound by data processing agreements and comply with GDPR. Analytics processors (Google, PostHog) only receive data after you accept analytics cookies.
6. Data retention
- Account data: retained for the lifetime of your account plus 90 days after deletion
- Report data (your GA4/Search Console metrics): retained for 12 months
- Server logs: 30 days
- Billing records: 7 years (legal requirement)
7. Your rights under GDPR
If you are in the European Economic Area, you have the following rights:
- Access: Request a copy of all data we hold about you
- Correction: Request correction of inaccurate data
- Erasure: Request deletion of your account and associated data
- Portability: Receive your data in a machine-readable format
- Objection: Object to processing based on legitimate interest
- Restriction: Request that we pause processing of your data
To exercise any of these rights, email privacy@theywillknow.me. We will respond within 30 days.
8. Cookies
We use strictly necessary session cookies for authentication. With your consent, we also use analytics cookies (Google Analytics 4, Google Tag Manager, and PostHog) to measure usage and improve the Service. No analytics cookie is set before you accept, and you can withdraw consent at any time via the cookie banner. For full details, see our Cookie Policy.
9. International transfers
Your data may be stored on servers in the United States (Supabase, Vercel). These transfers are covered by Standard Contractual Clauses approved by the European Commission.
10. Changes to this policy
We may update this policy to reflect changes in the service or legal requirements. Significant changes will be notified by email at least 14 days in advance. The current version is always available at this URL.
11. Contact
For any privacy-related question or request, contact us at privacy@theywillknow.me.