Privacy Policy

Valtrivo (“Valtrivo”, “we”, “us”) provides website auditing, marketing performance and business reporting software for small and medium-sized businesses at valtrivo.io. This Privacy Policy explains what information we collect when you use our website and application, how we use it, who we share it with, and the choices you have.

The Valtrivo service is operated by Valtrivo, LLC, a limited liability company organized in Nebraska, United States.

For privacy questions, requests and legal notices, email support@valtrivo.io.

Information you provide

• Account details: your name, email address and password. Passwords are handled by our authentication provider and stored only as a secure hash.
• Agreement records: when you create an account, the versions of the Terms of Service and this Privacy Policy you agreed to, and the time you agreed. We keep these records for as long as your account exists, and they are deleted with it.
• Workspace and business details: business name, website, industry, timezone and country you enter during setup or in Settings.
• Team details: the email address and role of people you invite to your workspace.
• Support content: messages, tickets and attachments you send us, and questions you ask the Support Assistant.

Information from services you connect

When a workspace Owner or Admin connects Google Analytics, Google Search Console, Google Ads, QuickBooks Online or Meta Ads, we receive authorization tokens and the reporting data described in sections 4, 5 and 6. Google Business Profile is coming soon (see section 4). You choose which services to connect, and each connection can be removed at any time.

Information collected automatically

• Usage information, such as pages visited, features used, and coarse product events (for example, that a free audit started or completed). These events never include the URL you audited, your email address or tokens.
• Technical information, such as browser type, device type, and IP address, which we use for security and rate limiting. For the public Website Audit we store only a one-way hash of your IP address.
• Records of usage against your plan allowances, such as the number of reports generated in a month.

• To create and secure your account, sign you in, and manage your workspace and team roles.
• To show the dashboards, Business Overview, Growth Recommendations and PDF reports you request from the data sources you connect.
• To run the Website Audit you request and show its results.
• To process subscriptions and billing through Stripe.
• To respond to support requests and keep the Help Center useful.
• To enforce plan allowances, prevent abuse, and keep the service secure and reliable.
• To understand, in aggregate, how the public website and product are used so we can improve them.
• To comply with legal obligations.

We do not sell personal information, and we do not use the business data you connect to show you advertising.

Valtrivo connects to Google services only when a workspace Owner or Admin chooses to connect them. Each Google product is a separate connection with its own authorization. Valtrivo requests the following permissions (“scopes”):

Google Business Profile reporting is available on the Performance and Intelligence plans. Valtrivo requests the business.manage permission only when an Owner or Admin connects Business Profile, and uses it only to read the data listed above. Valtrivo never edits listings, posts updates or replies to reviews.

How Google data powers your reports

Google data is used only to provide features you can see in Valtrivo: the Google Analytics, Organic Search and Google Ads dashboards, the Business Overview that brings them together, Growth Recommendations based on your connected data, PDF reports you choose to generate, and scheduled report emails that workspace members opt in to receive. Report figures are requested from Google when you view or refresh a dashboard, generate a report, or a scheduled report you set up is prepared.

Scheduled report emails are a feature in development and are not yet being sent. When they are switched on, they will go only to workspace members who opt in, and each email will include an unsubscribe link.

Where Google data is stored

Valtrivo stores Google-derived data in its database and private file storage, hosted by Supabase, in the following places. Each is limited to the workspace that connected the data.

• Encrypted Google access and refresh tokensUntil you disconnect the Google product or the workspace is deleted
• Connection details (product, selected property, site or account, status, authorizing Google account email)Until you disconnect the Google product or the workspace is deleted
• Cached Google API responses, used to load dashboards faster and limit requests to Google30 days, and deleted immediately when you disconnect that Google product
• PDF reports you generate (a snapshot of the figures shown) and their report historyUntil you delete the report or the workspace is deleted
• Growth Recommendations and the evidence behind them (figures and trends that triggered each one)Current recommendations until the workspace is deleted; analysis history 25 months
• Scheduled report email records (recipient, send status and the recommendations included)25 months

Deletion when you disconnect, or when you delete a report, happens immediately. Automatic deletion after the 30-day and 25-month periods is being enabled in stages, as described in Security and retention.

Scheduled report emails are delivered by Resend and contain the figures and recommendations they summarize. Once an email is delivered, the copy in the recipient's inbox is outside Valtrivo's control.

Sharing of Google data

Google data is visible to members of the workspace that connected it, according to their role. We do not sell Google user data or transfer it to advertising platforms, data brokers or information resellers. We do not use it for advertising, retargeting or personalized ads, to determine creditworthiness or for lending purposes, or to train generalized artificial intelligence or machine learning models. Google data is not sent to the Support Assistant. It is processed by our hosting and database providers only to operate Valtrivo for you.

Human access

Valtrivo personnel do not read your Google data unless you give us permission (for example, when you ask Support to investigate a specific report), when it is necessary for security purposes such as investigating abuse, or to comply with applicable law.

Limited Use

Valtrivo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.

Disconnecting Google

An Owner or Admin can disconnect any Google product from the Integrations page. Disconnecting immediately:

• revokes Valtrivo’s access with Google, unless the same Google account still authorizes another Google product connected to that workspace;
• deletes the stored tokens and the connection record; and
• deletes the cached Google API responses for that connection.

PDF reports already generated, Growth Recommendations and their history, and scheduled report email records are part of your workspace's history and are not deleted when you disconnect. They are kept for the periods listed above, and you can delete PDF reports at any time or ask us to delete the rest. You can also remove Valtrivo's access from your Google Account permissions page.

QuickBooks Online is available on the Intelligence plan. When an Owner or Admin connects it, Valtrivo requests the Intuit com.intuit.quickbooks.accounting permission and reads company details and financial reports (profit and loss, balance sheet and cash flow) to display Financial Performance in your workspace. Valtrivo does not create, edit or delete transactions or other records in QuickBooks.

QuickBooks tokens are encrypted before storage. Disconnecting QuickBooks revokes the token with Intuit (unless another of your workspaces still uses the same company connection) and deletes the stored connection.

Meta Ads reporting is being rolled out gradually and is not yet available in every workspace. When an Owner or Admin connects it, Valtrivo uses Facebook Login and requests only the Meta ads_read permission. The connection is read-only: Valtrivo cannot create, edit, pause or pay for ads, and does not post to Facebook or Instagram on your behalf.

What we retrieve

• Your app-scoped Meta user ID and name, and the permissions you granted.
• The ad accounts you can access (name, currency and time zone), so you can choose one for each business.
• Campaign, ad set and ad names and status, and performance figures such as spend, impressions, reach, frequency, clicks, results, purchase value and return on ad spend.
• The names of Facebook Pages that run ads in the ad account you selected.

How it is used

Meta data is used only to provide features you can see in Valtrivo: the Meta Ads and combined advertising dashboards, Business Overview, Growth Recommendations and PDF reports for the workspace that connected it. It is visible only to members of that workspace. We do not sell Meta data, use it for advertising or to build profiles of people, share it with data brokers, or use it to train artificial intelligence models, and we process it in line with the Meta Platform Terms and Developer Policies.

Protection and retention

Meta access tokens are encrypted by Valtrivo before storage, are readable only by our servers and are never sent to your browser. We store the connection record, the encrypted token, your ad account and Page choices, and cached Meta reporting responses for short periods so dashboards load quickly. We keep these only while the connection exists.

Disconnecting and deleting Meta data

• An Owner or Admin can disconnect Meta Ads on the Integrations page. This revokes Valtrivo’s access with Meta and deletes the stored token, connection record, ad account choices and cached Meta data for that workspace.
• If you remove Valtrivo in your Facebook settings (Settings & privacy → Apps and websites), Meta notifies us and we delete the stored tokens for your connections and ask the workspace to reconnect.
• If you send a data deletion request from Facebook, we delete every Meta Ads connection made with your Facebook account, in all workspaces, together with its tokens, ad account choices and cached data. Meta then shows you a confirmation code and a link where you can check the status of your request.

PDF reports already generated are part of the workspace's history and are not deleted automatically; an Owner can delete them from the Reports page. You can also ask us to delete Meta data by contacting us as described below.

Paid subscriptions are processed by Stripe. Card and bank details are entered directly with Stripe and are never stored on Valtrivo's servers. For subscriptions purchased through Stripe Managed Payments, Stripe, through its Link service, acts as the merchant of record and uses the name, email, billing address and payment details you enter at checkout to complete the sale, calculate tax, send receipts and invoices, and provide payment support. We keep your Stripe customer ID, subscription plan and status, billing period and payment events so we can manage your workspace's access. Stripe's and Link's use of your information is described in the Stripe Privacy Policy. If you ask Stripe or Link to delete your Managed Payments data, Stripe may cancel subscriptions sold through Managed Payments and delete the related billing records it holds, and your workspace then moves to the Free plan.

Anyone can audit a public web page without an account. The page address you enter is sent to the Google PageSpeed Insights API, which loads the page and returns performance, accessibility, best-practice and SEO findings. Results for the same address may be cached briefly so repeat audits are faster.

To prevent abuse, we record a one-way hash of your IP address and a random visitor identifier with each audit and delete these records after 7 days. Only audit public pages you are entitled to test.

• Essential cookies: when you sign in, our authentication provider sets cookies that keep you signed in and protect your session. The application cannot work without them.
• Preferences: some interface choices, such as a selected reporting date range, are stored in your browser’s local storage.
• Analytics: in production we use Vercel Web Analytics, which does not set cookies, to measure page views and a small set of conversion events, such as starting a free audit or creating an account. Event properties are limited to coarse values and exclude URLs, email addresses and tokens.
• Google Analytics: on valtrivo.io we also use Google Analytics 4 to understand how visitors find and use our website. It sets first-party cookies (such as _ga) and receives page views with record identifiers and query strings removed (except campaign tags), your approximate location derived by Google, device and browser details, and the same small set of conversion events (completing a free audit, creating an account, starting checkout and activating a paid plan, with the plan name only). It never receives your email address, audit inputs, reporting data, Google or QuickBooks tokens, or payment details. Google signals and ad personalization are turned off, and no advertising cookies are set. Admin pages and links containing one-time tokens are not measured.
• Your choices: if your browser sends a Global Privacy Control signal, we do not load Google Analytics or record campaign attribution. In the EEA, the UK and Switzerland, or when we cannot tell where you are, Google Analytics does not load and nothing is sent to Google until you choose Accept in our cookie banner. Elsewhere it loads by default. Anywhere, you can accept or reject it at any time from Cookie preferences in the site footer; rejecting stops Google Analytics and removes its cookies. Your choice is stored in your browser for 12 months, and a small cookie (vt_consent_region) records only whether your country requires this choice. You can also use Google’s browser add-on to opt out of Google Analytics on every site.

We do not use advertising or cross-site tracking cookies. Learn how Google uses this data at How Google uses information from sites that use its services, and opt out with the Google Analytics opt-out browser add-on.

When you contact Support we store your messages, ticket history and limited workspace diagnostics, such as which integrations are connected, their status and recent error categories, so we can help you.

When the AI Support Assistant is enabled, your question is sent through the Vercel AI Gateway to Google's Gemini model together with relevant Help Center articles, plan information and the workspace diagnostics described above. Google and QuickBooks reporting data is not included. The assistant can be disabled, and you can always ask for a human instead.

We share information with the service providers below only as needed to operate Valtrivo, and they process it to provide their services to us. Google user data is shared only with Vercel, Supabase and Resend, and only to provide the features described in this policy.

• VercelApplication hosting, scheduled jobs, content delivery, and privacy-focused website analytics. Google data passes through Vercel servers when it is requested, processed and shown to you.
• SupabaseAccount authentication, the application database (including encrypted tokens, cached Google API responses, report history and recommendations), and private storage for generated PDF reports.
• GoogleGoogle sign-in authorization, the Google APIs you connect, and PageSpeed Insights for website audits.
• IntuitQuickBooks Online authorization and financial report data, when you connect QuickBooks.
• StripeSubscription checkout, payment processing, invoices and billing records.
• Vercel AI Gateway and Google (Gemini)Generating answers in the in-app Support Assistant, when the assistant is enabled. Receives your question, Help Center articles, plan information and connection status labels; never Google or QuickBooks reporting data.
• ResendEmail delivery for support and team invitations, and for scheduled report emails once that feature is switched on. Report emails contain the figures they summarize, which can include Google-derived metrics.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets. Google user data obtained through Google APIs is never transferred for any other purpose, and would be transferred as part of a merger, acquisition or sale of assets only after we obtain your explicit prior consent.

Data is encrypted in transit using HTTPS. Google, QuickBooks and Meta OAuth tokens are additionally encrypted by Valtrivo before storage, are readable only by our servers, and are never sent to your browser. Access to workspace data is enforced by row-level security and role checks on the server, so members only see the workspaces they belong to, and only Owners and Admins can connect or disconnect data sources. No system is perfectly secure, and we cannot guarantee absolute security.

We keep account, workspace, billing and report information while your account and workspace exist, and delete it when you ask us to (see below). We are putting the following retention periods into effect. Automatic deletion is being enabled in stages, so until it is active some records older than these periods may still be stored. You can ask us to delete them at any time.

• Public Website Audit run records (hashed IP and visitor identifier)7 days
• Support Assistant conversations90 days after the last message
• Help Center search records180 days
• Closed support tickets2 years after closing
• Support Assistant usage and cost records400 days
• Cached Google API responses30 days
• Growth Recommendation analysis history25 months
• Scheduled report and email delivery records25 months

Billing and payment records may be kept longer where the law requires us to keep them for tax or accounting purposes.

• Update your name and password in Account Settings, and your business details in Business Settings.
• Disconnect any Google product, QuickBooks or Meta Ads from the Integrations page. This revokes access and deletes the stored tokens, connection record and cached responses.
• Request deletion of your Meta Ads data from your Facebook settings, as described in the Meta Ads section above.
• Delete PDF reports you no longer need from the Reports page.
• Unsubscribe from scheduled report emails using the link in any report email.
• Remove team members from Team Settings (Owners and Admins).

Deleting your workspace or account

Deletion of a workspace or account is handled by request. The workspace Owner can ask us to delete the workspace by contacting us as described below. After we confirm the request comes from the Owner, we delete the workspace together with its connections, tokens, cached Google data, reports, recommendations and report email records, and revoke its Google and QuickBooks access. We keep only the billing records the law requires us to keep.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to or restrict certain processing. To make a request, support@valtrivo.io. We will verify your request and respond within the time required by applicable law. Requests about a workspace's data should generally come from that workspace's Owner.

Valtrivo and its service providers may process information in countries other than the one where you live. Where required, we rely on appropriate safeguards for those transfers.

Valtrivo is a business service and is not directed to children. We do not knowingly collect personal information from children under 13, or under the minimum age required in their country. If you believe a child has provided us information, support@valtrivo.io and we will delete it.

We will update the “Last updated” date when this policy changes and notify account Owners of material changes. If we change how we use Google user data, we will update this policy and ask for your consent before using that data in a new way.

For questions about this Privacy Policy or your information, support@valtrivo.io.