Privacy policy

This policy explains how Abstract Infosys (“Abstrora”, “we”) handles personal data when you visit abstrora.com or use the Abstrora app at app.abstrora.com (together, the “Service”). We are the data controller for account data. For data inside your projects (for example your website, Google Ads or Analytics data), we process it on your behalf to provide the Service.

1. What we collect

Account and billing

• Name, email address and a password (stored as a one-way hash), or your Google profile if you sign in with Google.
• Team, project and role information you add.
• Billing details: your plan, invoices and credit usage. Card payments are handled by Stripe; we never see or store full card numbers.

Your projects

• Website addresses you add and what our crawler finds on those pages, audit results and Lighthouse scores.
• Data from services you connect (see section 4), WordPress connection details, and content you create such as briefs, drafts, notes and approvals.
• A record of changes you approve, who approved them and when (for example Google Ads changes), so they can be reviewed and undone.

Technical data

• Server logs: IP address, browser, pages requested and time. Passwords, tokens and similar secrets are removed from these logs.
• Security checks: Cloudflare Turnstile on sign-up processes your browser and IP address to detect bots.

This website (abstrora.com) sets no tracking or advertising cookies. It remembers your light/dark theme choice in your own browser only.

2. Why we use it (and our legal bases)

We do not sell personal data, and we do not use it for third-party advertising.

3. Who we share it with

We use these service providers to run Abstrora. They may process personal data only on our instructions and only to provide their service:

We may also disclose data if required by law, to protect our users or the Service, or to a buyer if the business is sold — in which case this policy continues to apply.

4. Google user data

When you connect a Google account, Abstrora asks only for the access its features need:

• Google sign-in: your name, email address and profile picture.
• Search Console (read-only): search queries, clicks, impressions, positions and page data for properties you choose.
• Google Analytics (read-only): reports and settings for the properties you choose.
• Google Ads: reports for the accounts you choose, and changes you or your team explicitly approve (for example adding negative keywords). Nothing is changed in your Google Ads account without a person approving it, and approved changes can be undone.

These are the Google OAuth scopes Abstrora requests, each only when you connect that service:

How we use it: only to show you reports, findings and proposed changes inside Abstrora, and to apply changes you approve.

How we share it: only with the AI model provider when you use an AI feature that needs it, with AI assistants you connect yourself, and with our hosting and backup providers. We do not sell it, use it for advertising, or use it to train general AI models.

How we protect and keep it: Google access tokens are encrypted at rest. Report data is cached briefly (up to 24 hours) to avoid repeated requests, and results you save, such as analyses, are kept as described in section 6. Disconnecting a Google service deletes its stored access, and you can also revoke access at myaccount.google.com/permissions.

Abstrora’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Security

Passwords are hashed; connected passwords and API keys (WordPress, Google, AI providers) are encrypted at rest; all traffic uses HTTPS; each project sees only its own data; and backups are encrypted. No system is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach affects it.

6. How long we keep data

• Account data: while your account is open, then deleted within 30 days of your request to close it.
• Audit history: the most recent audits for each project are kept; older page snapshots are trimmed automatically.
• Google Ads, Analytics and Search Console analyses: up to 90 days.
• Backups: rolling encrypted copies, overwritten within about two weeks.
• Billing records: as long as tax and accounting law requires.

7. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. You can correct your details and disconnect services yourself in the app. To make a request, email [email protected]; we answer within 30 days. You may also complain to your local data protection authority.

8. International transfers

We and our providers may process data in countries other than yours, including Nepal, the United States and the European Union. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.

9. Children

Abstrora is a business service for people aged 18 and over. We do not knowingly collect data from children; if we learn we have, we delete it.

10. Changes to this policy

We’ll update the date above when this policy changes, and email account holders at least 14 days before any significant change takes effect.

11. Contact

Abstract Infosys, Kathmandu, Nepal — [email protected]