Privacy Policy

1. Introduction

Alpha Scout AI ("Alpha Scout," "we," "our," "us") provides an AI-powered platform that helps local service businesses discover potential opportunities, build and optimize their online presence, and grow through a referral network. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have regarding your data.

By using Alpha Scout, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect only the minimum information necessary to provide our service:

• Account Information: Name, email address, and Google authentication data (when you sign in via Google through Firebase Authentication).
• Profile Information: Your industry, city, ideal client profile, and unique business angle (provided during ICP setup).
• Payment Information: Processed entirely through Stripe — we do not store credit card numbers or billing details on our servers.
• Business & Measurement Data: Information about your business, websites, properties, opportunities/leads, referral-network data, and visibility measurement snapshots that you create through the service.
• Usage Data: Non-identifying analytics (pages visited, features used) to improve our service.

3. Google Sign-In

You may sign in to Alpha Scout using your Google account through Firebase Authentication. This authenticates your identity and gives us access to your name and email address associated with that Google account. Google Sign-In is used for authentication only — it is separate from the optional Google Search Console connection described below.

4. Google Search Console

You may optionally connect your own Google Search Console property to Alpha Scout to access Alpha Scout's visibility measurement and reporting functionality.

When you connect a Search Console property, Alpha Scout requests read-only access using the Google OAuth scope https://www.googleapis.com/auth/webmasters.readonly.

With your authorization, Alpha Scout retrieves analytics for your own, customer-verified Search Console property, including:

• Clicks
• Impressions
• Click-through rate (CTR)
• Average position
• Top-10 queries
• Top-10 pages

This information is used solely to provide Alpha Scout's visibility measurement and reporting functionality, displayed to you in your measurement dashboard.

5. Google OAuth Credentials

To provide the Search Console connection, Alpha Scout stores the OAuth credentials/tokens required for that connection. These credentials are stored server-side and encrypted using AES-256-GCM, with the encryption key protected using Google Secret Manager. Credentials are never exposed through client-accessible storage, dashboard responses, exports, or logs.

6. Google Data Sharing

Search Console data obtained from Google is not sold, rented, or shared with third parties for marketing or advertising purposes. Specifically:

• Search Console data is not sold.
• Search Console data is not used for advertising.
• Search Console data is not used to train AI or machine-learning models.
• Search Console data is not transferred to OpenRouter, Exa, Tavily, Brave, Google Custom Search, or any other third-party AI or search provider.
• Search Console data is not otherwise shared with third parties.

Search Console data is processed and displayed exclusively within Alpha Scout's application to provide your visibility measurement functionality.

7. Google Limited Use

Google user data obtained through Google APIs is used only to provide the user-facing Search Console measurement functionality described above. Alpha Scout's use of Google user data is limited to the purposes described in this policy and is handled consistently with Google's API Services User Data Policy and its Limited Use requirements. You can view Google's privacy policy at https://policies.google.com/privacy.

8. Disconnect and Revoke Google Access

You may disconnect Search Console from Alpha Scout at any time through your account settings. When you disconnect:

• Alpha Scout requests revocation of the authorization through Google's revoke endpoint.
• The stored credential is deleted from Alpha Scout's servers.
• The connected property is marked as disconnected.

You may also revoke Alpha Scout's Google access at any time through your Google Account controls at myaccount.google.com.

9. Data We Do NOT Collect or Sell

Alpha Scout does not and will never sell, rent, or share your personal data with third parties for marketing or advertising purposes. Specifically:

• We do not sell your personal information to data brokers.
• We do not share your data with advertisers.
• We do not use your data for purposes unrelated to providing the Alpha Scout service.
• We do not enrich your data with third-party sources (no PDL, Hunter, Apollo, or similar services).
• We do not access your contacts, messages, or private data outside of Alpha Scout.

10. How We Use Your Data

Your data is used only for:

• Account identification and authentication: To verify your identity when you sign in.
• Service delivery: To configure your ICP, run scans, deliver opportunities, and provide visibility measurement.
• Subscription management: To process payments via Stripe and manage your account status.
• Communication: To send service-related emails (scan summaries, account notifications) — only if you opt in.
• Improvement: To analyze aggregate usage patterns and improve our services.

11. Third-Party Services

We use the following third-party services, each with their own privacy practices:

• Firebase (Google): Authentication, database, hosting, and cloud functions.
• Stripe: Payment processing and subscription management.
• SendGrid: Email notifications (if opted in).
• OpenRouter: AI model inference for embeddings and reply drafts.
• Exa, Tavily, Brave, and Google Custom Search: Web search providers for opportunity discovery (search queries only — no personal data).

12. Data Storage and Retention

Your data is stored securely on Firebase (Google Cloud Platform). We retain your account data for as long as your account is active. After account deletion or 12 months of inactivity, personal data is permanently deleted. Anonymized aggregate data may be retained for analytical purposes.

13. Data Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest, Firebase Authentication for secure access, and server-side API key management. Google OAuth credentials are encrypted using AES-256-GCM with keys protected through Google Secret Manager. No user-facing API keys are required — all AI calls go through our secure cloud backend.

14. Your Rights

You may at any time:

• Access your account data through the app settings.
• Update or correct your profile information.
• Delete your account and associated data.
• Opt out of email notifications.
• Disconnect Google Search Console access and revoke the credential (see Section 8).
• Request a copy of your data by emailing hello@alphascoutai.app.

15. Changes to This Policy

We will notify you of material changes via email. Continued use after changes constitutes acceptance of the updated policy.

16. Contact

For privacy-related inquiries: hello@alphascoutai.app