Privacy Policy

This Privacy Policy explains how BA VENTURE, operating StrategyTools, collects, uses, and protects information when you use strategytools.app and its services.

Information we collect

Depending on how you use the service, we may collect:

• Account information, such as your name, email address, and authentication details.
• Decision, strategy, and project information that you choose to enter into the tools.
• Usage, device, and technical information needed to operate, secure, and improve the service.
• Subscription and transaction status. Payment card details are handled by our payment provider, not stored by us.
• Newsletter details when you voluntarily subscribe.

How we use information

We use information to provide and personalize the service, save your work, communicate with you, process subscriptions, prevent abuse, maintain security, understand product usage, and improve our tools.

Google sign-in and your connected Google data

Google sign-in, when you choose it, uses basic identity information such as your Google account identifier, email address, name, and profile picture to authenticate you and display your account. The identity permissions are openid, email, and profile. Signing in does not by itself grant access to your Analytics or Search Console data.

Separately, you can authorize access to your own Google Analytics 4 properties and Google Search Console sites and select which resources to connect to a StrategyTools project. We request only read-only Google data permissions: analytics.readonly and webmasters.readonly. We access account and property names and identifiers, site URLs and permission information, and aggregate performance reports. These include Analytics active users, sessions and page views, and Search Console clicks, impressions, click-through rate and average search position. These permissions do not let StrategyTools edit your Google resources.

We access this data to show your own metrics on your Strategy Board, refresh them, compare reporting periods and help you monitor the projects and goals you choose. Only selected properties and sites are saved as project connections. The Google resource picker may list resources your Google account can access so you can make that selection.

Google data use and Limited Use

StrategyTools' use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell or rent Google user data, share it with advertisers or data brokers, use it for advertising or ad targeting, or use it to develop, train or improve generalized AI or machine learning models. We do not share Google data with third parties for their independent purposes. Hosting and storage providers process it only as necessary to operate the user-facing service, subject to the Limited Use requirements. Disclosure may also occur where required by law or necessary for security, as permitted by that policy.

You control whether you copy metrics into other content or authorize an external assistant to read a board containing them. Such user-directed sharing is distinct from connecting Google and is subject to the access you approve. OAuth tokens are never included in board content. Do not share a board or submit its contents to an external service unless you want that service to receive the information.

Google Ads, Business Profile, Merchant Center and YouTube access is not covered by the current Analytics and Search Console authorization. If we add these integrations, we will explain the specific data, purposes and permissions in this policy and the connection flow, and obtain any additional authorization required before accessing that data. This policy does not grant future access.

Google data storage and security

Selected resource identifiers, connection settings and synced daily aggregate metrics are stored in our server-side PostgreSQL database and associated with your account and project. Saved OAuth refresh tokens are encrypted before storage using AES-256-GCM with a server-side credential encryption key. The server exchanges the refresh token for short-lived access tokens when needed to read Google reports. Credentials are not returned in connection-list responses or displayed on the board.

Google authorization callbacks require HTTPS, except local development on localhost. Authorization state is signed, expires after ten minutes and is checked against an HttpOnly browser cookie. Connection and metric endpoints check the signed-in user and project ownership. Temporary setup credentials are also encrypted. These safeguards reduce risk but cannot guarantee absolute security.

Google data retention, disconnecting and deletion

Saved Google connections, refresh tokens and synced metrics are kept while the connection remains in your project. There is currently no automatic age-based deletion schedule for synced metrics. In Settings, open My connections, find the project's Google Analytics or Search Console connection in Business data and choose Disconnect. This deletes that connection's saved authorization and synced metric rows from the active database. If you connected several properties, sites or projects, disconnect each connection you no longer need.

Disconnecting inside StrategyTools does not itself revoke the authorization in your Google account. You can revoke Google access at your Google account permissions page. Revocation prevents further authorized API access but does not automatically delete information already imported into StrategyTools. Use Disconnect as well, or request deletion.

Values previously copied into board cards, saved analyses, chats or exports are separate saved content and are not automatically erased when a connection is disconnected. Delete that content separately or contact support@strategytools.app to request deletion of your account, Google connection data and saved copies under our control. We verify ownership before handling deletion requests. Exports or copies you shared with others must also be removed from those destinations.

Temporary Google setup sessions expire after ten minutes and are rejected after expiry. Completed sessions are deleted; expired records are cleaned up during later authorization callbacks, not by a guaranteed ten-minute physical deletion job. Backup copies, where maintained by our hosting providers, are not covered by immediate active-database deletion; we do not currently promise a fixed backup deletion period. Contact us for a deletion request or retention questions.

Service providers

We use trusted providers to support authentication, hosting and databases, analytics, payment processing, email delivery, and AI-powered features. These providers process information only as needed to provide their services and under their own privacy terms.

Analytics and cookies

We use PostHog product analytics hosted in the EU to understand page usage and key product actions, such as creating or saving an analysis, connecting a metric to a board, authorizing an MCP client, and completing sign-up. When you sign in, PostHog receives your account identifier, email address, name, and account creation date so activity can be associated with your account. We do not send analysis contents, prompts, board contents, tool arguments, or credentials in these events. MCP events include tool and requesting client names. This product analytics is separate from the Google Analytics and Search Console accounts you connect for your projects. Analytics and authentication may use cookies or similar technologies. You can control cookies through your browser settings and, where available, your consent preferences.

With your consent, we also use PostHog for product analytics. PostHog acts as our processor and we use its EU region (Frankfurt, Germany). We record page views and a few product events, such as which tool was opened or that an analysis was saved, to understand which tools are useful. We do not record sessions, and we never send what you type into a tool or the content of your boards. If you are signed in, events are linked only to an opaque account ID, not to your name or email. PostHog stays off until you choose “Allow analytics”, and it is also off if your browser sends a Do Not Track signal. Your choice is stored in your browser, and clearing site data asks you again.

AI-powered features

Some features use AI services to help structure or analyze information you submit. Do not enter sensitive personal information or confidential information unless you are comfortable with it being processed to provide the requested feature.

Legal basis and your rights

Where the GDPR applies, we process personal data on the basis of providing the service, fulfilling a contract, complying with legal obligations, pursuing legitimate interests, or obtaining consent where required. Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing. You may also complain to the Latvian Data State Inspectorate or another supervisory authority.

Retention and security

We retain information only for as long as reasonably necessary for the purposes described here, including legal, accounting, security, and dispute-resolution requirements. We use reasonable technical and organizational safeguards, but no internet service can guarantee absolute security.

Children

StrategyTools is intended for adults and business users. We do not knowingly collect personal information from children.

Contact

For privacy questions, access requests or deletion requests, email support@strategytools.app or contact BA VENTURE by post at:
Inženieru iela 101A
Ventspils, LV-3601
Latvia

You can also review our Terms of Service.