Privacy Policy
What the app does. StartLab Universal MCP (“the app”) is a private, single-operator tool run by StartLab. With the operator’s authorization it reads Google Search Console data (scope webmasters.readonly), Google Analytics 4 data (analytics.readonly), and Google Tag Manager container data (tagmanager.readonly) for websites the operator manages (its own and its clients’). The app does not write to, modify, or delete data in Google accounts.
What is stored. The app stores: connection records (which Google resource is connected, its status, granted scopes, and verification timestamps); Google OAuth tokens only as encrypted ciphertext, with the encryption key kept outside the database in protected hosting configuration; operator sign-in sessions as one-way digests with set expiry times; and a redacted activity log of connection events that contains no credentials and no report content. Search and analytics report data is fetched live from Google when the operator views it. The app does not store or cache report data; its only in-memory cache holds Google’s public signing keys for up to 5 minutes.
Processors and data flow. The app and its database are hosted by Railway. Google data comes from the Google APIs listed above. The operator can download report data as a JSON file to their own browser (for example for analysis in ChatGPT), and a direct ChatGPT connection is planned; report data leaves the app only through these operator-initiated actions, and any further sharing is the operator’s own act. The app itself does not log request content; the hosting platform keeps standard platform logs (requested paths, status codes, runtime output) for 7 days under its current plan policy. Data is not sold and is not used for advertising.
Use of Google user data. The app’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion. A connection stays active until the operator revokes it in the app, which ends further access. Access can also be revoked at https://myaccount.google.com/permissions at any time. When the operator revokes the last connection that uses a given Google authorization, the app deletes the stored encrypted token for that authorization in the same operation; if that deletion fails, the revocation fails as well (nothing is left half-applied). Connection records and the redacted activity log are kept as history. Deleting a project deletes its connection records and activity log. To request deletion of any data, contact driada.info@gmail.com.
Contact. driada.info@gmail.com