Privacy Policy
What we collect, how we use it, who we share it with, and how we handle Google user data.
This Privacy Policy explains what information Prowlyn collects, how we use and share it, and the choices you have. Prowlyn is operated by All Business Technologies (“ABT”, “we”, “us”), based in Boston, Massachusetts. Our mailing address is One Boston Place, 201 Washington St #2610, Boston, MA 02108. Questions: .
1. Information we collect
You give us
- Account details: your email address and password (stored as a secure hash by our authentication provider), and your plan.
- Sites and settings: the websites, keywords and locations you ask Prowlyn to check, and your preferences.
- Payment details: your card is collected and processed directly by our third-party payment processor. We don't store your full card number.
- Messages: what you send to .
Created when you use Prowlyn
- Audit and report data: results of hunts, rankings, citation checks and other reports for your sites.
- Usage and security data: credit usage, sign-in events, IP address, browser type and security logs, used to run the Service, enforce limits and trial rules, and protect accounts.
- Browser storage: the app uses your browser's local storage to keep you signed in and remember settings such as light or dark theme and your last-viewed site.
- Cookies: we don't use analytics, advertising or tracking cookies on prowlyn.com or in the app, and we don't use third-party analytics scripts. Cloudflare, which delivers our services, may set strictly necessary security cookies to protect against abuse.
From Google, only if you connect it
See section 4.
2. How we use information
- To provide the Service: run audits, show reports, and keep your account working.
- To bill you, run the 7-day trial, and send reminder emails before a trial charge.
- To enforce one trial per card, email or domain, and plan and credit limits.
- To secure the Service: detect abuse, verify account email changes by link or code, and investigate security issues.
- To give support. Our support team may access your account to resolve issues or investigate security concerns.
- To send service emails (for example sign-up confirmation, password reset, security notices and billing reminders).
- To meet legal obligations.
We don't sell your personal information, and we don't use it for third-party advertising.
3. Service providers we share data with
We share data only with providers that help us run Prowlyn, and only as needed for the purposes above.
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database and authentication (United States) | Account details, sites, settings, reports and usage data |
| Cloudflare | Hosting and network delivery of the app, API and website | Requests to our services, including IP address and browser information |
| DataForSEO | Search data (rankings and search results) | The domains, keywords and locations you ask us to check |
| Google APIs | Google sign-in for connecting accounts, Google Analytics 4 and Search Console data (only if you connect them), and PageSpeed Insights page tests | Read-only access to the properties you authorize (see section 4); the public page URLs you test |
DataForSEO also runs the AI-answer checks behind AI citation features, so the queries and brand or domain names you ask us to check are sent to it. We'll add a payment processor when card billing goes live. We keep our list of sub-processors current; you can request the current list, and notice of changes to it, at any time from .
We may also disclose information if the law requires it, to protect the rights, safety or security of our users or ABT, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.
4. Google user data
Connecting Google is optional. If you connect Google Analytics 4 or Google Search Console, Prowlyn asks Google for these permissions:
- Basic profile (openid, email): to identify which Google account you connected.
- Google Analytics, read-only (
analytics.readonly): to read traffic and engagement data for the GA4 properties you choose. - Search Console, read-only (
webmasters.readonly): to read search performance data (queries, clicks, impressions, positions) for the Search Console properties you choose.
How we use it: only to show that data to you inside Prowlyn, in your dashboards, audits and reports for the sites you link. Prowlyn can't change anything in your Google accounts.
How we store and protect it: the access and refresh tokens Google gives us are encrypted (AES-256-GCM) before they're stored with our database provider (Supabase, United States), and are used only to fetch data for your account. Google Analytics and Search Console data is fetched from Google when you view it and shown to you; we don't keep a separate copy of it, apart from basic connection details such as the property you chose and when it last synced, and any reports or exports you choose to create.
Sharing: we don't share Google user data with anyone, except the providers that host and run Prowlyn for us (section 3), as required by law, or as part of a merger or acquisition with notice to you.
Limited Use disclosure. Prowlyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we:
- use Google user data only to provide and improve the user-facing features of Prowlyn that you can see in the app;
- don't transfer it to others except as needed to provide or improve those features, to comply with the law, or as part of a merger, acquisition or sale of assets;
- don't use or transfer it to serve ads, including retargeting, personalized or interest-based ads;
- don't sell it, or use it to determine creditworthiness or for lending purposes;
- don't use it to develop, improve or train generalized or non-personalized AI or machine-learning models; and
- don't let people read it, unless you give us permission for specific data, it's needed for security (such as investigating abuse), it's needed to comply with the law, or it's aggregated and anonymized for internal operations.
Disconnecting and deletion: you can disconnect Google at any time in Prowlyn, or remove Prowlyn's access at myaccount.google.com/permissions. When you disconnect in Prowlyn, we immediately delete the stored Google tokens, so Prowlyn can no longer access your Google data; we keep only which property each site was linked to, so you can reconnect later. To fully remove Prowlyn's access on Google's side as well, also remove it at the link above. To have any remaining connection details deleted, email .
5. How long we keep information
We keep account information, sites, settings and reports while your account is open. After your account is closed or your paid access ends, you have 30 days to export your data. After that, we delete or anonymize your account data, sites and reports within 60 days. Security logs are kept for up to 12 months. Billing and tax records are kept as long as the law requires. Backups are overwritten on their normal cycle. You can ask us to delete your account and data by emailing ; we may keep some records where the law requires it.
6. Security
We use access controls, encrypted connections (HTTPS) and verification steps such as confirming email changes by link or code to protect your information. No system is perfectly secure, so we can't guarantee absolute security. If you think your account is at risk, contact .
7. Your choices and rights
- See and update your account details in the app.
- Ask us for a copy of your personal information, or ask us to correct or delete it, by emailing .
- Disconnect Google at any time (section 4).
- Opt out of non-essential emails. Service and security emails can't be turned off while you have an account.
Depending on where you live (for example California, or the EU or UK), you may have legal rights to access, correct, delete or receive a portable copy of your personal information, to object to or restrict certain processing, and not to be discriminated against for using these rights. We honor these requests from all users. Email ; we'll verify your identity and respond within 30 days, or sooner if the law requires. If you're not satisfied with our answer, reply to ask us to reconsider, and you can also complain to your local data protection authority. We don't sell or share personal information for cross-context behavioral advertising.
8. Where data is processed
Our database and authentication run in the United States (Supabase). Cloudflare delivers our services through its global network, so requests may be handled in other countries. If you use Prowlyn from outside the United States, your information is transferred to and processed in the United States, where data protection laws may differ from yours. Where the law requires, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses offered by our providers.
9. Children
Prowlyn is a business tool and isn't directed at children. We don't knowingly collect personal information from anyone under 18, and you must be at least 18 to use Prowlyn. If you believe a child has given us personal information, contact and we'll delete it.
10. Changes to this policy
We may update this policy. If a change is material, we'll tell you by email or in the app at least 30 days before it takes effect, and we'll update the date at the top.
11. Contact
All Business Technologies (Prowlyn)
One Boston Place, 201 Washington St #2610, Boston, MA 02108
Email: