Privacy Policy

This Privacy Policy describes how Ventric Systems Ltd (“Ventric”, “we”, “us”) collects, uses, stores, and shares personal data when you use GapStack at insight.ventric.co.uk (the “Service”). It is written specifically for this product so Google reviewers, customers, and staff can see exactly what Connect (Google Search Console and Google Analytics) and sign-in involve.

Contact for privacy requests: hello@ventric.co.uk · 0330 551 9400. We aim to respond within one month. Related marketing-site policy: ventric.co.uk/privacy-policy.

Company status. Ventric Systems Ltd is a UK business. When Companies House registration details are finalised we will add the company number and registered office here.

1. What GapStack is

GapStack is a business software product for digital agencies and their teams. It helps staff monitor SEO (search engine optimisation), GEO (generative-engine / AI-answer visibility), and AI search visibility for client websites, for example whether a brand is named or recommended in AI answers, how pages rank in Google Search, and related reporting. It is not a consumer social app and is not directed at children.

2. Who we are (roles)

For UK data protection law, Ventric Systems Ltd is the data controller for account, authentication, billing, and product-usage data we collect to operate Insight.

When an organisation connects Google Search Console (GSC) or Google Analytics 4 (GA4) for a site they manage, that organisation (or their client, as applicable) remains the controller of the underlying Google property data. GapStack acts as a processor / service provider so authorised users can view Search and Conversions reporting inside the product. We do not sell that data, and we do not use it to market to visitors of the connected website.

3. Data we collect: summary

In plain terms, Insight handles these categories:

• Account & authentication data: email, name, Clerk user ID, organisation membership, session cookies (via Clerk). We do not store passwords.
• Google OAuth connection data: encrypted refresh / access tokens, Google account email used to Connect, selected GSC property and GA4 property identifiers, connection timestamps, sync status / error messages.
• Google Search Console metrics we sync: for the bound property: query, page, country/device dimensions where available, clicks, impressions, CTR, average position, and related Search Analytics rows needed for Insight’s Search reporting.
• Google Analytics 4 metrics we sync: for the bound property: sessions, users, key events / conversions, channel and landing-page aggregates, and related Data API report rows needed for Insight’s Conversions reporting.
• Workspace / product configuration: sites, domains, competitors, prompts, settings, roles, and similar data users enter so Insight can run AI-visibility and SEO workflows.
• Billing data: handled primarily by Stripe (customer and subscription identifiers, plan status). We do not store full card numbers.
• Technical logs: IP address, user agent, request path/time, and security or error logs needed to operate and protect the Service.

4. Clerk authentication: what we store and why

Sign-in and sign-up are provided by Clerk (clerk.com). Clerk processes email addresses, authentication factors you choose (for example password, OTP, or Google sign-in to Clerk), and session tokens. Insight receives the authenticated user’s email, display name (if provided), and Clerk user ID so we can create or update a user row in our Postgres database, attach organisation memberships, and authorise access to the correct sites.

Session cookies set by Clerk keep you signed in. Theme and UI preference cookies (for example light/dark and sidebar state) are used only for product UI. We do not use advertising cookies or third-party ad trackers on Insight.

Clerk’s own privacy documentation applies to data Clerk processes as our authentication provider. Insight does not receive or store your Clerk password.

5. Google OAuth (GSC + GA4 Connect): collection and use

Connecting Google is optional and initiated only when an authorised user clicks Connect Google (or Reconnect) on a site’s Integrations page. Google shows Google’s consent screen. Insight requests read-only scopes only:

• openid, email, profile: identify which Google account connected
• https://www.googleapis.com/auth/webmasters.readonly: list Search Console properties and read Search Analytics
• https://www.googleapis.com/auth/analytics.readonly: list GA4 properties and read Analytics Data / Admin APIs for reporting

How we use Google user data: solely to provide user-facing Connect, property binding, scheduled and manual sync, and Search / Conversions (and related) dashboards inside GapStack for the organisation that connected the account. Use is consistent with Google’s API Services User Data Policy, including the Limited Use requirements.

We do not request Google Ads, Gmail, Drive, Docs, or write/modify scopes. We do not change settings on your Google properties. We do not sell Google user data. We do not use Google user data for advertising. We do not use connected GSC/GA4 data to train generalised / public AI models.

Token storage: OAuth access and refresh tokens are encrypted at rest (AES-256-GCM) with a dedicated application encryption key, so background jobs can refresh metrics without asking you to reconnect every day. We also store the Google account email shown on Integrations, the selected property IDs, and sync metadata.

6. Why we use personal data (lawful bases)

• Contract / steps prior to contract: create accounts, authenticate users, provide dashboards, Connect and sync, support, and billing for the Service you request.
• Legitimate interests: security, preventing abuse, diagnosing failures, improving reliability and performance, balanced against your rights.
• Legal obligation: tax, accounting, and responding to lawful requests from authorities.

7. Retention

• Clerk sessions: according to Clerk session lifetime and your sign-out actions.
• Account / membership records: while your organisation uses Insight, then for a reasonable wind-down period for support and disputes; billing records typically up to six years where required for UK tax/accounting.
• Google OAuth tokens: until you Disconnect in Insight, revoke access in your Google Account permissions, or the connection is otherwise invalidated. Disconnect destroys stored token ciphertext for that connection.
• Synced GSC/GA4 history: retained for the site so historical reporting remains available after a reconnect. Clearing history or deleting a site are separate, labelled actions; Disconnect alone does not silently wipe all past synced metrics.
• Application logs: typically short operational windows (days to weeks) unless needed longer for security investigation.

8. Sharing and subprocessors

We share personal data only with providers that help us run Insight, under contracts where required:

• Clerk: authentication and session management
• Vercel: application hosting
• Neon: Postgres database hosting
• Stripe: subscription billing (when you pay)
• Google: OAuth and GSC/GA4 APIs when you Connect
• AI model and SEO data vendors used for Insight features you enable (for product functions). We do not pass your Google OAuth tokens to those vendors for advertising or resale.

Some providers process data outside the UK. Where required, transfers rely on appropriate safeguards (for example UK IDTA / Standard Contractual Clauses or an adequacy decision). We may disclose data to professional advisers under confidentiality, or when legally required.

Human access to Google user data inside Ventric is limited to staff or subprocessors who need it to operate, secure, or support the product (for example diagnosing a failed sync).

9. Your choices: Disconnect, revoke, delete

• Disconnect Google in Integrations stops Insight from using that OAuth grant and destroys stored tokens for the connection.
• You may revoke Insight at any time in Google Account → Third-party access.
• To request access, correction, export, or deletion of personal data we hold as controller, email hello@ventric.co.uk.

10. Your rights (UK GDPR)

You may have rights to access, rectification, erasure, restriction, objection, and (where applicable) portability, and the right to complain to the Information Commissioner’s Office. Please contact us first at hello@ventric.co.uk so we can resolve issues quickly.

11. Security

We use HTTPS in production, encrypt OAuth tokens at rest, restrict administrative access, and apply role-based access inside the product. No method of transmission or storage is perfectly secure. If a breach were likely to result in a high risk to your rights, we would notify the ICO and, where required, affected individuals.

12. Children

Insight is a B2B tool for agencies and professionals. It is not directed at children under 16, and we do not knowingly collect their personal data.

13. Changes to this policy

We will update the “Last updated” date when this policy changes. Material changes to how we use personal data already collected will be communicated where practicable (for example in-product notice or email).

Related: Terms of Service · GapStack home.