Last updated: 2026-10-20
Who we are
Woodander (woodander.com) is a growth platform for projects. This policy explains how personal data is handled when you visit the site or use an account. The operator of Woodander is the controller of your data.
Contact for all data protection matters: contact@woodander.com
What we collect
- Account data: your name, email address, password (stored only as a hash), language and notification settings.
- Social sign-in: if you sign in with Google, GitHub, LinkedIn or Microsoft, we receive the profile data described below. We never receive your password for those services.
- Content you add: projects, articles, channels, offers, businesses, outreach records, comments and anything else you submit.
- Purchases and subscriptions: which plan or placement you bought and its status. Card details are never seen or stored by us (see payments below).
- Our own analytics: we count page views and clicks without cookies. A visitor is recognised by an identifier made from a one-way hash that changes every day, so it cannot be used to follow you across days or sites. We do not count our own visits or known bots.
- Cookies: signed-in users receive a session cookie (and a security token) that keeps you signed in. A small preview cookie may remember a setting while a feature is being previewed. These are strictly necessary. Google Analytics may set its own cookies (see “Analytics through Google” below); we use no advertising cookies.
- Technical logs: IP address, browser and error information kept briefly for security and debugging.
Why we use it
- To provide the service: accounts, publishing, the catalog, TOP, Market, Outreach, SEO tools and the Workspace.
- To process payments and manage subscriptions.
- To keep the platform safe: preventing abuse, spam and fraud, and moderating content.
- To understand, in aggregate, how the site is used and to count honest views and clicks.
- To send service messages you have not turned off, such as receipts, security notices and the notifications you chose.
Who processes data for us
- Contabo, our hosting provider in Germany (EU), which stores and serves the site and its database.
- Cloudflare, for CDN, security and DNS. It processes visitors’ IP addresses and may set strictly necessary security cookies such as __cf_bm.
- AgentaOS, acting as Merchant of Record for payments. It collects and handles your card or payment details, calculates and collects taxes, and issues invoices and receipts. Woodander does not receive your full card data.
- Anthropic, whose AI models power AI-assisted features. Text you submit to those features (for example a page to analyse or a draft to improve) is sent to Anthropic to produce the result, and only when you use them.
- Google, for sign-in, and, only if you choose to connect them, Search Console, Analytics and Tag Manager, plus public PageSpeed Insights and Chrome UX Report data. See “Google user data” below.
- GitHub, LinkedIn and Microsoft, for sign-in only, and only if you choose them.
- An email delivery provider, to send messages to you.
We do not sell your personal data. We share it only with these providers as needed to run the service, or when the law requires it.
Google user data
Woodander’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google API Services User Data Policy · Limited Use requirements
Signing in with Google asks only for your identity (openid, email, profile). Connecting Search Console, Analytics or Tag Manager is optional, a separate step in SEO → Integrations with its own consent screen, and never part of signing in.
Which Google APIs and scopes we use
- Sign in with Google: openid, email and profile. We receive your name, email address, profile picture and a Google account identifier. No Google tokens are kept after sign-in.
- Google Search Console, read-only (webmasters.readonly), only if you connect it: the list of your verified sites and their search performance (clicks, impressions, click-through rate, position, queries and pages).
- Google Analytics, read-only (analytics.readonly), only if you connect it: your Analytics accounts and properties, and reports such as sessions, users, engagement, conversions, top pages, sources, countries and devices.
- PageSpeed Insights and Chrome UX Report: public performance data about web addresses, requested with our own API key. No Google user data is involved.
- Google Tag Manager, only if you connect it, in steps you choose: read-only first (tagmanager.readonly): your accounts, containers, workspaces, tags, triggers, variables and versions. Only if you allow changes (tagmanager.edit.containers and tagmanager.edit.containerversions): Woodander creates or edits tags, triggers and variables in a separate workspace named “Woodander” and turns it into versions; your live Default Workspace is never edited. Only if you allow publishing (tagmanager.publish): a version is made live.
- What Woodander may change in Tag Manager follows the mode you set for each site: Manual (Woodander and your agents only propose; you apply each change), Hybrid (changes in the Woodander workspace, publishing and deleting only after your confirmation in Woodander) or Autonomous (also publishing, only if you turn it on for that site and give an API token the publish permission, with a daily limit, a saved previous version for rollback and an email to you). Nothing is ever published without your confirmation unless you turn on Autonomous. Every change is logged in the Workspace.
What we do with it and why
We use Google data only to show you your own reports in the Workspace and, through your own API and MCP tokens, to you; and, for Tag Manager, to make the changes you or your agents asked for within the mode you chose. We do not use it to build profiles of you or for any other purpose.
We do not use Google user data for advertising, including retargeting, personalised or interest-based advertising, and we do not sell it.
Google user data is returned through your personal API and MCP tokens only to you, for use in the tools you choose. Anything you pass to an AI tool you choose is covered by that tool’s own terms.
Storage and retention
We store the daily aggregates we sync from Search Console and Analytics, a short-lived cached copy of your Tag Manager container, the Tag Manager changes and their log, and the connection tokens (encrypted) needed to keep working. When you disconnect, or delete your account, this data is deleted within 30 days. Backups roll off within 60 days.
Sharing
We never sell Google user data. We do not share it with anyone except the service providers needed to run Woodander (see above), or when the law requires it. Google user data is not sent to AI model providers and is never used to train AI models, ours or anyone else’s. No person at Woodander reads your Google data except to support you at your request, to investigate abuse, or as the law requires.
We do not transfer Google user data to others except as needed to provide or improve the features you asked for, to comply with applicable law, or as part of a merger or sale with notice to you.
How to revoke access
Disconnect Google in Settings → Connected Accounts, which deletes the synced data. When you disconnect your last Google product, or delete your account, we delete the stored tokens and ask Google to revoke them. You can also remove Woodander’s access yourself at any time on your Google Account permissions page. myaccount.google.com/permissions
GitHub, LinkedIn and Microsoft sign-in
If you choose to sign in with one of these services, we receive only basic profile data: your name, your verified email address where the service provides one, your profile picture, and the service’s identifier for your account. We use it to create or recognise your Woodander account and never post on your behalf or read anything else. You can disconnect them in Settings → Security.
API and MCP
API and MCP tokens are personal. Data is returned only to the owner of the token, and tokens are deleted when you revoke them.
Legal bases
- Contract: providing your account and the services you use.
- Legitimate interests: security, abuse prevention, and aggregate cookieless analytics.
- Consent: optional connections such as Google data, and marketing emails. You can withdraw consent at any time.
- Legal obligation: keeping invoices and payment records.
International transfers
Our hosting is in the EU. Some providers process data outside the EU/EEA, for example in the United States, protected by Standard Contractual Clauses or equivalent safeguards.
What is public
Anything you publish on Discover, Media, Market, Outreach or a public profile is visible to everyone and may be indexed by search engines. Your email address is never shown publicly.
How long we keep it
- Account data is kept while your account is open.
- When you delete your account, it is scheduled for deletion and kept for a grace period during which you can change your mind. After that your personal data is removed or anonymised.
- Invoices and payment records are kept as long as tax and accounting law requires, even after deletion.
- Technical logs are kept for a short period, normally weeks rather than months.
- Backups roll off within 60 days after deletion.
- API and MCP tokens are deleted when you revoke them.
Your rights
Depending on where you live, you can ask to access, correct, export or delete your data, to restrict or object to some processing, and to complain to your data protection authority.
- Export: download a copy of your data from Settings → Privacy & Data.
- Deletion: delete your account from the same place. There is a grace period before it becomes final.
- Settings: change your profile, language, sign-in methods and notifications at any time in your account settings.
Children
Woodander is not intended for children under 16, and we do not knowingly collect their data.
Changes to this policy
We may update this policy. When the changes are significant we will tell signed-in users before they take effect.
Contact
For privacy questions or to use your rights, contact the operator of Woodander using the contact details published on this page.
Email: contact@woodander.com
