Privacy Policy

Last updated: 1 October 2026

WhoSaw ("WhoSaw", "we", "us") is operated by Ahmed Mustafa, an individual based in the Kingdom of Saudi Arabia. This policy explains what information WhoSaw collects, how we use it, and the choices you have. If you have questions, contact us at hello@whosaw.app.

Summary

• WhoSaw reads your Google Analytics data read-only to show you simplified reports. We never change anything in your Google account.
• We do not sell your data, use it for advertising, or use Google user data to train AI models.
• You can disconnect Google or delete your account at any time.

1. Information we collect

1.1 From your Google account

When you sign in with Google and grant access, we receive:

• Basic profile: your name, email address, profile picture and Google account ID (scopes openid, email, profile).

• Google Analytics data (read-only): through the https://www.googleapis.com/auth/analytics.readonly scope, we read:

  • the list of Google Analytics accounts and properties you can access, and their settings (such as time zone and website URL);
  • aggregated reporting data for the property you choose, such as visitor counts, visits, traffic sources, pages, devices, countries, cities and key events.

  Google Analytics reports are aggregated. We do not receive or store data that identifies individual visitors to your website.

• An OAuth refresh token, which lets WhoSaw fetch updated reports without asking you to sign in each time.

1.2 Information you give us

• Your website domain, the page or event you mark as a conversion, the label you use for conversions, and key pages you select.
• The questions ("prompts") you choose to track in AI assistants, and brand names or aliases you enter.
• If you use the Agency plan's bring-your-own-key feature, the OpenAI or Perplexity API keys you provide.
• Messages you send to us.

1.3 Information from your public website

To check whether AI assistants can read your site, we fetch publicly available pages of the domain you connect (for example your homepage, pricing page and most visited pages) and your robots.txt file. We store the text extracted from these pages and the results of the checks.

1.4 Billing information

Payments are processed by our payment provider. We receive your plan, billing status and a customer reference from our payment provider. We do not receive or store your full card number.

1.5 Technical information

We use a single session cookie to keep you signed in. We keep basic server logs (such as request time, IP address and errors) for security and troubleshooting. We do not use advertising or third-party tracking cookies.

2. How we use information

We use your information only to provide and improve the features you use:

• to show your analytics dashboard, weekly brief and email summary;
• to detect changes and write plain-language insights about your site's performance;
• to check whether AI crawlers can access your site and what they can read;
• to run the AI prompts you track and report whether your brand is mentioned;
• to send you service emails, including your weekly brief, which you can unsubscribe from;
• to manage your plan and billing;
• to keep the service secure and fix problems.

3. Google user data: our commitments

WhoSaw's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described in this policy.
• We do not sell Google user data, use it for advertising, or transfer it to data brokers or information resellers.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
• We do not allow humans to read your Google user data, except: with your explicit permission (for example when you ask for support), when necessary for security purposes such as investigating abuse, to comply with applicable law, or when the data is aggregated and anonymized for internal operations.
• We transfer Google user data to third parties only as needed to provide the service (see section 4), to comply with law, or as part of a merger or acquisition with notice to you.

4. Service providers we share data with

We use the following providers to run WhoSaw. They process data on our behalf and only for the purposes below.

When we send aggregated metrics to OpenAI to write insight sentences, we send only the numbers needed for that sentence, not your raw reports, and we only use AI providers whose API terms do not permit them to use this data to train their models.

If you use your own API keys on the Agency plan, your tracked prompts are sent to OpenAI or Perplexity under your own account and their terms.

We do not sell personal information to anyone.

5. How we protect data

• OAuth refresh tokens and your own API keys are encrypted at rest with AES-256-GCM, using a key stored separately from the database.
• All connections to WhoSaw use HTTPS.
• Access to production systems is limited to the operator of WhoSaw.

No system is perfectly secure, but we take reasonable measures to protect your information and will notify affected users of a breach as required by law.

6. How long we keep data

• Account and settings: while your account is active.
• Cached Analytics reports: WhoSaw does not keep its own copy of your Analytics history. It asks Google Analytics for reports when you view them and keeps short-lived cached copies, for up to 7 days, to make the dashboard faster. Weekly brief snapshots are kept while your account is active so past emails can be viewed again.
• AI check and prompt results: while your account is active.
• After you delete your account: we delete your account data, cached reports and tokens within 30 days. Backups are overwritten within a further 30 days. We may keep billing records for as long as tax law requires.

7. Your choices and rights

• Disconnect Google: you can revoke WhoSaw's access at any time at myaccount.google.com/connections. WhoSaw will then stop fetching new data.
• Delete your account: email hello@whosaw.app from the address you signed up with, or use the delete option in the app when available. Deleting your account deletes your Google tokens and cached data as described above.
• Access, correct or export: you can ask for a copy of your personal data or ask us to correct it.
• Emails: every weekly brief email includes a one-click unsubscribe link.

Depending on where you live, including under the Saudi Personal Data Protection Law and the EU General Data Protection Regulation, you may have additional rights, such as objecting to processing or complaining to a data protection authority. To exercise any right, email hello@whosaw.app. We will respond within 30 days.

8. International transfers

WhoSaw is operated from Saudi Arabia. Our database is hosted in the European Union, and some providers listed above may process data in other countries, including the United States. We rely on our providers' contractual and security commitments to protect data when it is transferred.

9. Children

WhoSaw is a business tool and is not directed to anyone under 18. We do not knowingly collect personal information from children.

10. Changes to this policy

If we make material changes, we will update the date above and notify you by email or in the app before the changes take effect.

11. Contact

Ahmed Mustafa, operator of WhoSaw Kingdom of Saudi Arabia Email: hello@whosaw.app