Privacy Policy

Your account and workspace

PageSoar stores your account name and sign-in details, workspace membership and role, settings, and records of activity such as sign-ins and administrative changes. Sign-in and security records can include an IP address and browser information. Passwords are stored as hashes, not as readable passwords.

Your workspace holds the website information PageSoar reads, audits, proposed edits, saved results and change history. Connected site credentials (a WordPress pairing, a Ghost key or a repository deploy key) let PageSoar read your site and publish the changes you approve. Workspace members can see data according to their roles; PageSoar administrators have access to operate and support the service.

Connecting Google

Connecting Google is optional. The hosted sign-in asks for two read-only permissions:

• Search Console: list the sites your Google account can access and read search and indexing information for the site you select, including queries, page URLs, clicks, impressions, click-through rates and positions (webmasters.readonly).
• Google Analytics: list the accounts and properties you can access and read reports for the property you select, including landing pages, traffic sources, sessions, engagement and conversion or revenue metrics (analytics.readonly).

PageSoar uses these figures to identify pages needing attention, guide suggestions, build reports and measure results after changes. These permissions do not let PageSoar edit your Search Console or Analytics settings. The hosted Google connection does not request access to Gmail, Drive or Google Ads.

Google handles your Google password. PageSoar receives an authorization grant and stores its tokens in the workspace’s encrypted credential store so it can refresh access and read reports without asking you to sign in for each request.

Connecting Meta Ads

Connecting Meta Ads is optional. It uses an access token that you create yourself in Meta Business Settings and paste into the workspace. PageSoar asks for one read-only permission:

• Meta Ads: read campaign, ad set and ad performance for the ad account you choose, including spend, impressions, clicks, results and the breakdowns Meta reports by placement and age group (ads_read).

PageSoar uses these figures to show what your ads bought, which campaigns, ads and audiences work and which do not, and to draft campaigns for you to create. The token cannot create, edit or pause a campaign, and PageSoar sends Meta no write request. The token is stored in the workspace’s encrypted credential store and can be removed on the Connect screen at any time; revoking it in Meta Business Settings ends access immediately.

Processing and service providers

Hosted PageSoar runs on Fly.io. Its storage holds account and workspace records. When you use AI writing or analysis features, relevant website content, your instructions, and Search Console query and performance context can be sent to Anthropic through PageSoar’s model service to produce the suggestions shown in your workspace. The model service also records usage and cost totals.

Website URLs and search terms used for market or page-speed checks are sent to the services that perform those checks, including DataForSEO and Google PageSpeed. Connecting Google does not publish your reports to other customers. Report files you download can be shared by whoever holds them.

For supported sales spreadsheet uploads, PageSoar reads transaction rows, removes recognized name and email columns, and stores the sales lines rather than the original workbook.

Messages, cookies and demo activity

Contact forms and connector requests store the details you submit so PageSoar can review and respond to them. These can include your name, email, company, website and message. When email delivery is configured, a notification is also sent to PageSoar’s inbox through its mail provider.

PageSoar uses cookies for sign-in sessions and form security, and browser storage for preferences such as appearance. If you type your website into the home page’s “See it on your site” box, PageSoar reads that page’s title and description once (nothing else is kept from it) to pick examples from your industry, and remembers your choice in a cookie for 30 days; the usual examples link clears it. The home page also counts, without any cookie or identifier, how often each set of examples is shown and how often the demo is opened from one. Your network address is matched on our own server against a public list of which organisation each network belongs to, only to choose examples for a bank, hospital, university or similar; the address is not sent to anyone and not kept. The sample tour records progress and feedback so PageSoar can see where visitors stop and respond to requests. Do not put customer records or secrets into contact or connector-request forms.

Disconnecting, stored data and deletion

In your workspace, open Connect and disconnect Google to remove PageSoar’s stored Google sign-in grant and selected properties. This does not revoke the grant at Google. To remove access there as well, open your Google Account’s third-party connections, select PageSoar and remove its access. Google explains how to manage these connections.

Disconnecting or revoking access does not delete previously collected reports, audits or history from PageSoar, and does not remove files you downloaded. Those stored records can remain after you disconnect. To request deletion of your account or workspace data, or ask what is stored, email hello@pagesoar.com and identify the account or workspace. PageSoar will need to verify that you are entitled to make the request.

For privacy questions or corrections, use the same address: hello@pagesoar.com.

Google API Services: Limited Use

PageSoar’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Search Console and Analytics data is used only to provide and improve the features you see in your workspace; it is never sold, never used for advertising, never used to train generalized AI or machine-learning models, and is read by a person at PageSoar only with your permission, for security, or where the law requires it.

Why we may use it (GDPR and UK GDPR)

Where European or UK data protection law applies: we use account, workspace and billing information to perform our contract with you; sign-in and security records, and replies to messages, for our legitimate interest in running a safe service and answering you; and Google data only because you chose to connect it, which you can undo at any time. For personal data inside a customer’s workspace, the customer decides why it is processed and PageSoar processes it for them under the Data Processing Addendum.

Sign-up, contact forms and the email we send

Sign-up. The trial form keeps your name, work email, company, website, plan and billing period, the network (IP) address the form came from, and which version of the Terms you accepted and when. We use them to set up your workspace and to show what you agreed to.

Contact us and the demo tour. These keep your name, email, company, website and message, and on the demo tour’s closing form also your role, how interested you are, how far through the tour you got and how many chapters you finished. We use them to reply and to see where the tour loses people.

Email to customers. We send account email you need (setting a password, invitations, a reset, what happens to your workspace when a payment fails) and, to workspace members, a weekly results email. Every weekly email has a link at the bottom that stops it, and your Account page has the same switch. Account email cannot be turned off while you have an account, because it is how the service works. Paddle sends receipts itself.

Alerts to our staff. When a message, a connector request or a trial sign-up arrives, PageSoar sends a short alert with the sender’s name, email and message (or the new customer’s name, email and plan) to a staff member’s phone. It goes through Nowlark, a notification service run by Skail Consulting LLC on Fly.io, and Apple’s push service delivers it to the phone. Nowlark deletes it after the history length set on that account.

Passkeys and single sign-on

Passkeys. When you add a passkey, your device makes a key pair for PageSoar only. We keep the public half, the device's identifier for it, the name you gave it, and when it was added and last used. The private half never leaves your device or password manager, and we cannot sign in with what we keep. Remove a passkey on your Account page and it is deleted.

Single sign-on. A workspace can ask us to sign its people in through its own identity provider, such as Okta. We keep that provider's address, the client ID and secret the workspace gave us (the secret encrypted) and the email domains it covers. When you sign in that way, the provider tells us your email address, whether it has verified it, your name and its own identifier for you; we use them only to find your existing account. The provider is chosen and run by your workspace, not by us, so it is not on our subprocessors list.

The free website check

The free website check reads the public pages of the website address you type, on a temporary server that is deleted the moment the check ends. It reads what any visitor or search engine can read and changes nothing on the site. We keep the address and the result, the report, for 30 days, at an address only you are given. We count checks per network address in memory, to keep the tool fair, and do not store that address.

The check asks for your email address together with the website address, because a check can take a few minutes and the results are sent to you when it finishes. We keep the address you give, send the report once (or, if the check could not read the site, one email saying so), and record the business as one that asked for it. A person at PageSoar may write to you once about it; we say so beside the button. Our basis for sending the report is your request, and for that one follow-up our legitimate interest (Article 6(1)(f)). Every email has a link that stops all further email to that address: the address then goes on the do-not-contact list below, the one record we keep for good. The business record, with what you agreed to, is deleted on the schedule for businesses we write to (90 days if we never write, 24 months after the last step).

When the full report is opened, and when it is saved as a PDF, our server tells Google Analytics so, to count how often a report is read. Nothing is set in your browser for it, no cookie and no script from Google. What is sent is the event and a number made from the report, never your email address, the website address, your network address or anything about your device, and each report is counted at most once every half hour. Our basis is our legitimate interest in knowing whether the reports are useful (Article 6(1)(f)).

Heat maps: visitors to our customers’ websites

A PageSoar customer can put a small PageSoar script on its own website to see, in total, how far visitors scroll and where they click. If you visit such a site, this is what the script sends and what we keep. The website’s owner chose to use it and is responsible for telling you; we keep the counts for them, as their processor under the Data Processing Addendum.

• What is kept: the page’s path (the part of the address after the domain, without anything after a ? or #), whether the browser window is phone, tablet or desktop sized, its width, the height of the page, how far down the page the visitor scrolled and how much of it the first screen showed, and for each click its position on the page and which element was clicked, named by its tag, id and class names and its place among its neighbours, never by its text, with whether it looked clickable, whether the page answered the click within a second and whether it was clicked several times in quick succession, and the earlier pages of the same website shown in the same browser tab, at most 9, so the routes between pages can be counted, and, when the website marks the page as running an A/B test, the name of the test and of the version the visitor was shown, as the website names them, at most 3 tests a page.
• What is never kept: what anyone types into a form, the text on the page, the visitor’s network (IP) address, cookies, the browser’s identifying details (user agent), the address the browser reports the visitor came from (the referrer), so never a page on another website, or anything that links one visit to another. A click inside a form field is recorded only as “masked”, with no element named. Your network address is used for a moment, scrambled and in memory only, to stop one browser flooding the counts, and is never written down.
• No cookies: the script sets no cookie. Your browser tab holds, in its own session storage, the last pages of that website it showed and, where the website counts only some visits, whether this tab is counted. The tab forgets both when you close it, and neither names you.
• How to say no: The script does not run, and our server discards anything it is sent, when the browser sends Do Not Track or Global Privacy Control. A site’s consent banner can keep it off before it loads (window.pagesoarHeat = {optOut: true}) or stop it at any time (pagesoarHeat.stop()).
• How long: each page view’s row 7 days; the daily counts the maps and the routes between pages are drawn from, 90 days.
• Your rights: nothing kept names you or ties one visit to the next, so we cannot pick out your rows to show or delete. Write to the website’s owner, or to hello@pagesoar.com and we will pass your request on.

Businesses we write to

We write to a small number of businesses we think PageSoar can help. If you received such an email, this is what we hold and why.

• Where your address came from: your business publishes it on its own website, usually its contact page. We use only addresses a business publishes, such as info@ or sales@, never one we guessed or bought.
• What we keep: the business’s web address and country, the published address and the page it is on, the results of a free check of the public website, and each step we took (drafted, sent, replied).
• Why: to offer PageSoar to a business it may help. Under GDPR and UK GDPR our basis is legitimate interest (Article 6(1)(f)), in telling a business about a service relevant to its work.
• How long: a business we never wrote to is deleted after 90 days; one we wrote to, 24 months after the last step.
• How to object: reply “no” to any of our emails, or write to hello@pagesoar.com. We stop at once and do not write again. We keep your address or domain on a do-not-contact list with the date and reason, only so we never write again; it is the one record we keep for good.

Who else receives it

The companies that process data for us are on the subprocessors list, with what each receives and where. Data is stored in the United States; where it moves from the EU or UK, the transfer relies on the European Commission’s standard contractual clauses or an equivalent safeguard. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

How long it is kept

Account and workspace data is kept while the workspace is open. After a workspace closes its data is kept until an admin asks for it to be deleted or we delete the workspace. Billing records are kept by Paddle as tax law requires. We answer a verified request to delete within one month. The rest is deleted on a schedule PageSoar runs by itself:

• Sign-in and security records (the activity log, with the IP address of each sign-in, and ended sessions with their IP address and browser): 12 months.
• The IP address a sign-up form was sent from: blanked after 12 months.
• A sign-up form that never reached a payment: 90 days.
• Contact us and demo tour messages: 24 months.
• Businesses found for outreach and never written to: 90 days. Those written to: 24 months after the last step.
• A free website check, its report and the email address asked for it: 30 days.
• Heat maps from a customer’s website: each page view’s row 7 days; the daily counts the maps and the routes between pages are drawn from, 90 days.
• The do-not-contact list: kept for good, so an objection is always honoured.

Your rights

Depending on where you live, including under GDPR, UK GDPR and the California Consumer Privacy Act, you can ask to know what we hold about you, get a copy, correct it, delete it, restrict or object to its use, or move it elsewhere. We will not treat you differently for asking. Write to hello@pagesoar.com; an authorised agent may ask for you. If you are in the EU or UK you can also complain to your data protection authority. If your data is in a workspace another business runs, we will pass your request to them.

Cookies, children and changes

The cookies PageSoar sets are all needed for it to work; they are listed on the cookies page. PageSoar is not meant for anyone under 16. When this policy changes in a way that matters, we update the date above and tell workspace admins by email.

Who is responsible

Skail Consulting LLC (Skail Studio) runs hosted PageSoar and is responsible for the data described here. Contact: hello@pagesoar.com.

Post: Skail Consulting LLC, 14205 SE 36th St Ste 100, Bellevue, WA 98006

Report a security issue

Found a vulnerability? The Security page says where to write and what happens next. Give us time to fix it before telling anyone, and do not access data that is not yours.

Changes

• 17 October 2026: Heat maps: when a website marks a page as running an A/B test, the script also sends the test's name and the version the visitor was shown, so each version can have its own map.
• 16 October 2026: Heat maps now count the routes between a website's pages: the script sends the earlier pages of that website seen in the same browser tab, and the tab forgets them when it closes.
• 15 October 2026: Adds heat maps: what PageSoar's script on a customer's website sends about its visitors, what is never kept, how to say no, and how long the counts are kept.
• 8 October 2026: Adds passkeys and single sign-on: what is kept for each, and what a workspace's own identity provider tells us when you sign in through it.
• 28 September 2026: The free website check counts, in Google Analytics and without a cookie, when its full report is opened and when it is saved as a PDF: what is sent and what is not.
• 28 September 2026: The free website check asks for your email address with the website address, so the results can be sent to you when the check finishes: what we keep and why.
• 28 September 2026: Adds the free website check: what it reads, what it keeps for 30 days, and the email you can ask for.
• 25 September 2026: Adds businesses we write to, what the sign-up and contact forms keep, customer email, how staff alerts are delivered, and how long each record is kept.
• 25 September 2026: Adds Google Limited Use, GDPR bases, recipients and your rights.