Privacy Policy
Solvir SEO (“the Service”, “we”, “us”) lets you read your own Google Search Console data from an AI assistant such as Claude, through the Model Context Protocol (MCP). This policy explains which data the Service accesses, how it is used, where it is stored, who receives it, and how to delete it. The Service is operated by Chen Xuanzhao, a sole proprietor based in Shenzhen, Guangdong, People's Republic of China, who is the data controller.
Summary
- What we access: read-only Google Search Console data for the sites your Google account can see, plus your Google account ID, email address and name.
- Why: only to answer the questions you ask through your AI assistant about your own websites' Google search performance.
- Sharing: results go only to the AI assistant you connected, at your request. We do not sell Google user data, use it for advertising, or share it with anyone else.
- AI: Google user data obtained through Google APIs is not used to develop, improve, or train generalized or non-personalized AI or machine-learning models. Solvir SEO does not generate or edit images, video or audio.
- Storage: sign-in tokens are kept encrypted while you stay connected; Search Console results are cached for at most 6 hours.
- Deletion: revoke access at any time at myaccount.google.com/permissions, or email support@solvir.net to have your data deleted.
Solvir SEO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
1. Google user data we access
When you connect the Service and sign in with Google, you grant these permissions:
openid,email,profile: your Google account ID, email address and name, to identify your connection.https://www.googleapis.com/auth/webmasters.readonly: read-only access to the Search Console properties your Google account can see: the list of properties, Search Analytics data (queries, pages, clicks, impressions, click-through rate, position, countries, devices, dates) and URL Inspection results (index status, crawl details, canonical URLs).
The Service cannot change anything in Search Console or on your websites, and requests no other Google permissions.
2. How we use Google user data
- Search Console data is fetched only when your AI client calls one of the Service's tools on your behalf, and is returned to that client as the tool result.
- Your account ID and email identify your connection and keep different users' data separate.
- When you use
site_check, the Service fetches the public page you named (only within your own Search Console properties) and your site's robots.txt, and returns a technical summary.
Google user data is transferred to your AI client only at your direction, to provide the features you use in that client.
We do not use Google user data for advertising, do not sell it, do not use it to build user profiles or databases, do not use it to determine credit-worthiness or for lending, and do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models. No person reads your Search Console data except when you ask us to for support, when needed for security or abuse investigation, or when required by law.
3. How we share, transfer or disclose Google user data
- The AI client you connected (for example Anthropic's Claude, OpenAI's ChatGPT, Cursor). Tool results go to that client at your request, and its provider processes them under its own privacy policy. Disconnecting the connector stops this.
- Cloudflare, Inc., which hosts the Service and provides its storage, cache and logs.
- Law enforcement or regulators, only where legally required.
We do not share, transfer or disclose Google user data to anyone else, and never for advertising, data brokering, or training AI or machine-learning models.
4. How we store Google user data and how long we keep it
- Connection record, in Cloudflare Workers KV (which Cloudflare encrypts at rest): your Google account ID and email address, used to identify the connection; and, additionally encrypted with a key we cannot read without your client's token, your name and the Google access and refresh tokens. Your client renews the connection about once an hour while you use it. The record is deleted 90 days after the last renewal, the next time the connector tries to renew after you revoked access at Google, or on request.
- Short-lived tokens and sign-in state: the Service's own access tokens (about 1 hour) and the state of a sign-in in progress (10 minutes).
- Client registration: the name, callback addresses and any contact details that the AI client software declared when it registered. This describes the client, not you, and is kept 365 days after the client was last used.
- Usage counters: how many tool calls, URL inspections and page checks your account made in the current minute and day, keyed by your Google account ID, to enforce usage limits. Counts for past minutes are discarded, and all of an account's counts are deleted shortly after the UTC day ends.
- Usage statistics: anonymous daily totals (calls per tool, refused calls, and the number of active accounts, counted with a keyed hash that changes every day and is not linked to your account ID), kept 90 days.
- Cache: Search Analytics results for up to 6 hours and URL Inspection results for up to 10 minutes, so repeated questions do not use up your Google quota. Cache entries are keyed by your Google account ID and cannot be read by other users.
- Logs: our error messages, kept by Cloudflare for up to 7 days. We do not keep per-request logs, and never log Search Console data or tokens. Cloudflare processes IP addresses to deliver and protect the Service.
- Cookies: only strictly necessary ones during sign-in, for security checks (10 minutes) and to remember which AI clients you approved (30 days). No analytics or advertising cookies.
Pages fetched by site_check are not stored.
5. How we protect Google user data
- All traffic to and from the Service and Google uses TLS (HTTPS).
- Google access and refresh tokens and your name are stored encrypted, with a key derived from your client's own token; Cloudflare also encrypts all stored data at rest.
- Google tokens never leave the server: AI clients receive only the Service's own tokens.
- Cached results are keyed by your Google account ID, so one user's data can never be returned to another.
- The Service only requests read-only Google permissions, and access to the infrastructure is limited to the operator.
6. How to delete your data
- Revoke “Solvir SEO” at myaccount.google.com/permissions. The stored Google tokens stop working immediately; the connection record is then deleted as described above. Cached results expire within 6 hours.
- Disconnect the connector in your AI client to stop it calling the Service. This alone does not revoke Google's permission.
- Email support@solvir.net with the Google email address you connected, and we will delete its connection records within 30 days.
Depending on where you live (for example under the GDPR or CCPA) you may also have rights to access, correct, port or restrict processing of your data; contact us at the address above.
7. Google API Services User Data Policy and Limited Use
Solvir SEO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
8. International transfers
Cloudflare runs the Service on its global network, so data may be processed outside your country.
9. Children
The Service is not directed to children under 16, and we do not knowingly collect their data.
10. Changes
We will post changes here and update the date above. Material changes will be announced on this site before they take effect.
11. Contact
Questions and requests: support@solvir.net.