Privacy Policy

Effective 29 October 2026

Polyoptra shows you the traffic of all your websites on one dashboard, using data from your Google accounts. This policy explains what we collect, what we do with it, and how you can control it. It is written to meet the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Who we are

Polyoptra is run by Eastside Marketing Pty Ltd (ABN 17 698 174 542), Melbourne, Victoria, Australia. In this policy, “we” and “us” mean Eastside Marketing Pty Ltd. You can reach us at hello@polyoptra.com.

What we collect

• Your Google account basics, when you sign in: your name, email address and Google account ID, and the web address of your Google profile picture if Google sends one.
• Your email account details, if you sign up with an email address and password: your name, your email address and whether you have confirmed it. We store a hash of your password (a one-way scrambled form made with scrypt), never the password itself, so neither we nor anyone with access to our database can read it. We also keep the single-use confirmation and reset links we email you, as hashes only, and a short-lived count of recent sign-in attempts (by email address and IP address) to slow down password guessing. We use the same kind of count, by IP address, to limit how often a share page can be opened. These are deleted within a day of expiring.
• Data about the websites you connect. From Google Analytics 4 we read aggregated traffic figures for each property: sessions, engaged sessions, page views, engagement time, key events, and revenue and purchases where a site records them. We also read breakdowns of those figures by channel, referrer, country and city, page and landing page, device, campaign, event and product. When you ask ARGUS-9, we also read Google Ads keywords and search terms, and product add-to-carts and purchases. From Search Console we read search queries and pages with their clicks, impressions and average position. From the Chrome UX Report we read public page-speed measurements (Core Web Vitals) for each site’s domain. We do not ask Google for individual visitor-level data.
• What you enter in Polyoptra: workspace and site names, groups, which sites are hidden, settings, and the invite links you create.
• Share links and branding, if you make them. For each client share link: the label you give it, which site or group it shows, when it expires, whether it has been revoked, how many times it has been opened and when it was last opened. We keep a one-way hash of the link, never the link itself. We also keep the name, logo and accent colour you put on your share pages, and the agency contact email you enter for them. That email is shown on client reports and used as their reply-to address.
• Client report recipients and report pages, if you set up client reports. The email addresses of the people (one to five per report setup) who receive a client’s monthly reports, and the password for its report pages. We store the addresses so the agency’s monthly reports can be sent to them, and the password so we can send it again. Each report page is a monthly copy of the site’s figures, frozen when the report is sent.
• Your questions to ARGUS-9: the questions, its answers, which reports it used, and a count of questions for the monthly allowance.
• Your weekly summary settings: whether you get the summary email for each workspace, the day, hour and time zone you chose, and which weeks one has been sent.
• Billing details, if you subscribe to a paid plan. Payments are handled by Stripe (see below). Stripe collects your billing name, email address, billing address and payment method. We do not see or store your card number. We keep Stripe’s customer and subscription IDs, your plan, its status and renewal date, and your invoices.
• Technical records: the app and its background worker write messages and errors to log files on our server, and our web server may record the technical details of each request, such as IP address and the page asked for. We also keep a record of each data refresh (when it ran and whether it worked).

The Google permissions we ask for

Polyoptra only reads. It cannot change anything in your Google accounts. When you sign in, Google asks you to allow:

If someone joins a workspace from an invite link, we ask them for the first permission only (name, email and account ID), and nothing is connected. Chrome UX Report data is public, so it needs no permission from you.

Google user data and Limited Use

Polyoptra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read it at https://developers.google.com/terms/api-services-user-data-policy.

In plain terms, about the information we receive from your Google accounts:

• We use it to show you your own dashboards and, when you ask ARGUS-9 a question, to answer it.
• We do not sell it.
• We do not use it for advertising, including interest-based or retargeted advertising.
• We do not use it to develop, improve or train artificial intelligence or machine learning models.
• We do not transfer it to anyone else, except as needed to run the service (our hosting provider, and Qwen Cloud when you ask ARGUS-9 a question), to keep it secure, or because the law requires it.
• Our people do not read it, except with your permission, where it is needed for security or to fix a fault, or where the law requires it.

One more thing to know: the data in a workspace is visible to everyone in that workspace. If you invite a colleague, they can see your sites’ figures. That is your choice, and you can remove a member in Settings.

Asking ARGUS-9

ARGUS-9 is the assistant in Polyoptra. When a team member asks it a question, we send the question, and the data from your connected Google accounts, and Polyoptra’s uptime records, needed to answer it (such as site names and addresses, page and product names, search queries, Google Ads keywords and search terms, and their figures), to Qwen Cloud (Alibaba Cloud), which runs the AI model. We use its Singapore region. Qwen Cloud says processing may happen outside Singapore, so your figures may be handled in other countries too. We send nothing to Qwen Cloud unless someone asks a question.

Conversations with ARGUS-9 are kept for 90 days, then deleted. Only the person who asked can see them. Other members of the workspace cannot.

The short version at the top of the weekly summary email is written on our own server. It is not sent to any AI service.

We do not use Google data to train AI models. Qwen Cloud handles it under its own terms.

Payments and Stripe

Paid plans are billed through Stripe (Stripe Payments Australia Pty Ltd, and Stripe, Inc. in the United States). Stripe is the payment processor. When you subscribe, you enter your payment details on a Stripe page, and Stripe processes your billing name, email address, billing address and payment method, and may use them to prevent fraud and calculate tax. Polyoptra never receives or stores your card number. Stripe’s handling of that information is covered by Stripe’s privacy policy. We share your workspace and email with Stripe only to set up and manage your subscription.

Client share links

A share link makes the analytics of the site, or group of sites, you choose visible to anyone who holds the link. That is your choice and you control it. Only a workspace owner can make a link. You pick what it shows, you can have it expire after 30 or 90 days, and you can revoke it in Settings at any time, after which it stops working straight away. Anyone who has the link can open it without signing in, so send it only to people you trust.

A share page shows aggregated traffic, search and page-speed figures for the sites you chose, with the name, logo and colour you set. It does not show your other sites, your Google account, your team members or your settings. We ask search engines not to index it, and the page does not tell other websites where a visitor came from. We count how many times each link is opened and when it was last opened, so you can see whether a client looked.

Client reports

A client report is a monthly report on one site, branded with the agency’s name, logo and colour, that the agency sets up for a client. Only a workspace owner can set one up. It is sent to the client’s email addresses on a schedule, or held for the agency to send by hand. Client report links are password protected. We email the password to each recipient when the report is set up, and the agency can resend it or reset it in Settings, Reports. Anyone who has a link and its password can read every report sent for it. Report pages are not indexed by search engines, and the page does not tell other websites where a visitor came from.

Emails and Resend

If you sign up with an email address, Polyoptra sends you account emails: a link to confirm your address, a notice if someone signs up again with it, password reset links, and a notice when your password changes. Polyoptra also sends a weekly summary email of the workspaces you belong to: how many of their sites are rising, falling or have gone dark, the biggest movers, and the sites that need a look. Owners get it unless they switch it off, and members choose in Settings, Account. Every summary has a one-click unsubscribe link. Account, summary and client report emails are delivered by Resend (Resend, Inc., in the United States). We give Resend the recipient’s email address and the content of each email, only to deliver it. Client report emails go to the agency’s client recipients, and review emails to its owners. Each report email carries the agency’s contact email as its reply-to address, and each password email carries the report password. Resend’s handling of that information is covered by Resend’s privacy policy. We do not send marketing email.

How we store and protect it

• Polyoptra runs on a virtual private server we rent from Hostinger.
• The long-lived Google access token (a refresh token) that lets Polyoptra read your data is encrypted in our database with AES-256-GCM.
• Connections to Polyoptra use HTTPS (TLS). Our session cookies are marked so scripts cannot read them, and are only sent over HTTPS.
• We do not claim any security certification. No system is perfectly secure, and we cannot promise that nothing will ever go wrong.

How long we keep it, and how to delete it

• Billing records. We keep invoices and payment records for 5 years after the transaction, because Australian tax law requires it. Stripe keeps its own records under its policy.
• Traffic and search data is kept while the site stays in your workspace. We fetch up to about 13 months of history for each site. Breakdowns (channels, pages, cities and so on) older than 180 days are deleted automatically. Our technical records of data refreshes are deleted after 90 to 180 days.
• Removing a Google account. A workspace owner can remove a connected Google account in Settings. It disappears straight away, and a minute later (once the undo window has passed) we permanently delete our stored token for it and its link to your sites. Sites you have already imported, and their history, stay in your workspace until you ask us to delete them. We do not tell Google to revoke the permission when you do this, so also revoke it in your Google account (see below).
• Removing a member. When an owner removes a member, that person loses access to the workspace and their sign-ins for it are ended. Their basic profile stays on record in case they belong to another workspace.
• Conversations with ARGUS-9 are deleted after 90 days. Records of the questions asked (who asked, when, and how much of the monthly allowance each used) are kept for 400 days.
• Client reports. Recipient email addresses and report passwords are stored so the agency’s monthly reports can be sent to them, and are deleted when the agency deletes the report setup. Report pages are kept while the agency keeps the report set up.
• Signing out ends your session. A session also ends after 30 days without use. Invite links expire after 7 days.
• Deleting everything. To have your account, workspace and data deleted, email hello@polyoptra.com from the address you sign in with. There is not yet a button for this in the app.
• Backups. We take a database backup every day and keep each for 7 days, and our hosting provider also takes its own backups of the server. Deleted data can remain in backups until they expire, then it is gone. We do not keep it for any other purpose.
• Revoking access at Google. You can withdraw Polyoptra’s access at any time at myaccount.google.com/permissions. Polyoptra then cannot read your Google data any more.

Cookies and similar storage

Polyoptra sets only the cookies it needs to work, with one exception: the Meta Pixel, which tells us whether our ads lead people to sign up. In the app it runs only on the sign-in and sign-up pages, and once on the first page after you create an account, to count the sign-up; never on your dashboards, reports, settings or shared report links. It never sends Meta anything from your Google accounts, and Meta’s automatic collection of page details is switched off. Meta sets its own cookie (_fbp) and handles this data under its own privacy policy. The app loads no other third-party scripts.

Our marketing site, polyoptra.com, uses Google Analytics and the Meta Pixel on every page to count visits, see which pages are read and measure our ads. Google Analytics sets its own cookies (_ga and _ga_*) and Google processes that visit data under its own privacy policy. You can block both with your browser’s settings, Google’s opt-out add-on, or your ad preferences on Facebook and Instagram.

• wm_session: keeps you signed in. It lasts up to 30 days and is renewed while you use Polyoptra.
• wm_workspace: remembers which of your workspaces is open. It lasts up to 30 days.
• wm_oauth: holds a security check while you sign in with Google. It lasts 10 minutes and is only sent to the sign-in pages.
• wm_setup: set only for the person installing and setting up Polyoptra, after they enter the setup code. It lasts 1 hour.
• po_new_account: set when you create an account, so the next page can count the sign-up for the Meta Pixel. It holds nothing but “1”, is removed as soon as that page reads it, and lasts at most 10 minutes.

Your browser also keeps three small settings for Polyoptra in its local storage: your light or dark theme, whether the animated ARGUS-9 is on, and which newly found sites you have dismissed. They never leave your browser.

Sending information overseas

Your data is stored on a server rented from Hostinger in its Jakarta, Indonesia data centre, so it is held outside Australia. If we move the server to another country, we will update this policy. We also send requests to Google’s services, which operate worldwide. If you pay for a plan, Stripe processes your billing details in Australia, the United States and other places where it operates. Resend delivers the emails Polyoptra sends (account emails, the weekly summary, and the client report, password and review emails, which carry clients’ email addresses and report passwords) from the United States. If you ask ARGUS-9 a question, Qwen Cloud (Alibaba Cloud) processes it in its Singapore region, and possibly in other countries. We do not disclose your information to anyone else overseas.

Your rights and complaints

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@polyoptra.com. If you think we have mishandled your information, tell us first and we will try to fix it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We may update this policy. The date at the top shows when the current version took effect. We will post any new version on this page, and if a change matters, we will take reasonable steps to let you know before it applies.