Privacy Policy

Who we are

Profit Labs Inc. (operating as Profit Labs™, "we", "us") runs a self-serve SEO publishing platform: you keep a dollar balance, and the platform writes and publishes guest posts, press releases, syndicated articles, citations and supporting links, then tracks them until they're indexed. The marketing site is profitlabs.net and the application is at cms.profitlabs.net/app. You can reach us at office@profitlabs.net.

What we collect

• Company brief demo — if you run the free brief on our homepage, we collect the website address you enter and your email address, so we can email you the full brief and an invitation to create an account. We also record the time, the page that referred you, your IP address and your browser's user-agent string, which is how we stop one person from running the demo hundreds of times. We do not add you to a recurring email sequence from the demo alone.
• Account data — if you create an account: your name, email address, a one-way hash of your password (never the password itself), your company or agency details, and the websites and keywords you ask us to work on.
• Payment data — handled by Stripe. Card numbers never touch our servers; we store only Stripe's customer and payment identifiers, plus the amount, currency and date of each charge.
• Site analytics — our own first-party measurement, described in the cookies section below. It records which pages you viewed, which buttons you clicked, where you arrived from, your campaign parameters if any, your device type, and a country and region derived from your IP. Your IP address itself is stored only as a one-way hash on the visitor record, never in readable form.
• Support correspondence — anything you email us, kept so we can answer you and refer back to it.

Alongside our own measurement we run two third-party tags, both described in the cookies section below: Google Analytics, to see how visitors use the site, and the Meta Pixel, to measure and improve our ads on Facebook and Instagram. When you create an account we also tell Meta that a signup happened, with your email address and name sent only as one-way hashes, so an ad can be credited with it. If your browser sends a Global Privacy Control signal, the Meta Pixel does not run and Google Analytics runs with its advertising features switched off.

Google user data (connected Google accounts)

Profit Labs™ lets you connect your own Google accounts to power your SEO dashboard. Connecting is always optional, is initiated by you through Google's own OAuth consent screen, and can be revoked at any time. This section explains exactly what Google user data we access, how we use it, and how we protect it.

What Google user data we access

• Google Analytics (GA4) — if you connect Google Analytics, we access your Analytics data in read-only mode (the analytics.readonly scope): your list of GA4 properties and their reporting metrics such as sessions, users, pageviews, traffic sources, and conversions. We cannot modify your Analytics configuration.
• Google Search Console — if you connect Search Console, we access your data in read-only mode (the webmasters.readonly scope): your list of verified sites and their Search performance data (clicks, impressions, average position, and search queries).
• Basic account identifier — your Google account email address (the userinfo.email scope), used only to label the connection so you can see which Google account is linked.
• Optional feature integrations — if you separately choose to connect Google Calendar, Google Drive, or Gmail, we access only the data required for the specific feature you enable, under the same terms described here.

How we use it. We use Google user data solely to provide the user-facing features you requested — displaying your rankings, traffic, and search-performance reports inside your Profit Labs™ dashboard and in the SEO reports we deliver to you. We do not use it for advertising and we do not sell it.

How we store and protect it. OAuth access and refresh tokens, and any cached Google reporting data, are stored on our own hardened infrastructure (Hostinger VPS), encrypted at rest and transmitted over TLS. Access is restricted to the systems and personnel that operate your account.

Sharing. We do not transfer, sell, or disclose your Google user data to third parties, except as strictly necessary to provide the service to you or as required by law. We never share it with data brokers or advertisers, and we never use it to train AI or machine-learning models.

Retention and deletion. We keep Google user data only while your integration remains connected. You can disconnect any Google account at any time from the Integrations page in your dashboard, or revoke our access directly at myaccount.google.com/permissions. When you disconnect (or email us at office@profitlabs.net), we delete the stored tokens and associated cached Google data within 7 days.

Limited Use. Profit Labs™' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace APIs to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.

What we don't do

• We do not sell your data. Ever.
• We do not share your email with any partner, affiliate, or data broker.
• We do not share anything with an advertising platform beyond what the cookies section below describes, and nothing at all when your browser sends Global Privacy Control.
• We do not use dark patterns (pre-checked subscribe boxes, hidden unsubscribe links, "are you sure?" 3-click escape funnels).

Cookies and site measurement

Our own cookies are first-party: set by us, on our own domain, and readable only by us. Two third-party tags also set cookies, listed last.

• pl_vid — a random identifier with no name, email or address in it, used to recognise a returning browser so we can tell whether a change to the site actually helped. Set on .profitlabs.net, SameSite=Lax, and it expires after 395 days (about 13 months).
• pl_sid — groups the pages of a single visit together. Expires after 30 minutes of inactivity.
• Application cookies — if you log in, the application sets session and security cookies. Those are required for the app to work at all and cannot be turned off while you are signed in.
• _ga, _ga_* — Google Analytics. Page views, traffic sources and device type, reported to us in aggregate by Google.
• _fbp, _fbc — Meta Pixel. Lets Meta tell us whether someone who saw or clicked one of our Facebook or Instagram ads went on to visit, request a brief or sign up, and lets us show ads to people who have visited. The pixel runs on the marketing site and the sign-in and sign-up pages of the app — not inside your dashboard. You can also control this in your Facebook ad preferences.

Alongside those cookies we record page views and button clicks against that random identifier, plus the referring site, any campaign parameters in the link you followed, your device type, and a country and region derived from your IP address. We use it for one thing: working out which parts of the site and product are worth keeping. We keep this measurement data for about 13 months and then drop it.

Global Privacy Control. If your browser sends a GPC signal, we record it against your visitor record and treat it as a standing objection to your data being shared with any advertising platform: the Meta Pixel does not load, a signup from that browser is not reported to Meta, and Google Analytics runs with its advertising features switched off.

Who else sees your data

We use a small number of providers to run the service. Each gets only what it needs to do its job, and none of them are permitted to use your data for their own purposes:

• Stripe — payment processing. Receives your name, email and card details directly.
• SMTP2GO — email delivery. Receives your email address and the contents of the emails we send you.
• Cloudflare — sits in front of our sites for TLS, caching and abuse protection, so it processes request metadata including your IP address.
• Publishing and SEO data vendors — when you order work, the parts needed to fulfil it (typically the target website address, the keywords and the article) go to the relevant publisher, wire-distribution service or ranking-data provider. Your email address and payment details do not.
• Google — Google Analytics on the marketing site, as described above.
• Meta Platforms — the Meta Pixel, and a signup notice with your email address and name as one-way hashes, used to measure our Facebook and Instagram ads. Meta acts under its Business Tools Terms.
• Cloudflare R2 — if you use the "upload image" option on a logo or cover image, the image file is stored there and served from images.profitlabs.net.

Everything else lives on our own hardened infrastructure (a Hostinger VPS), encrypted at rest and transmitted over TLS.

Your choices

• Unsubscribe from emails: every marketing email has a one-click unsubscribe link. We honour it within 1 hour. Transactional email about work you have ordered is not covered by that, since it is how we tell you what shipped.
• Delete your data: email office@profitlabs.net with the subject "Delete my data" and we will purge your account, lead record and measurement data within 7 days. We keep the minimum billing records that tax law requires us to keep.
• Export your data: same address, subject "Export my data", and we will send a JSON export of everything we hold on you.
• Opt out of measurement: block cookies for this site in your browser, or send a GPC signal. Neither affects your ability to use the product.

Changes to this policy

If we materially change this policy we will email every account holder at least 14 days before the change takes effect. You can always reach out with questions at office@profitlabs.net.