Privacy Policy

Effective 20 October 2026 · Sage (SEOMatic) · Contact: sageatseomatic@gmail.com

Sage is an SEO automation service for Shopify brands, operated as a small productized service. This policy describes exactly what data Sage accesses, what it does with it, where it is stored, and who it is shared with. It is written to match what the software actually does, not what a template says.

1. Who we are

Sage is operated by Khushi Dassani ("we", "the operator"). The service runs on a single application server hosted on Fly.io and serves this website and a client approval portal. Questions and requests about your data go to sageatseomatic@gmail.com.

2. Google user data

Sage connects to two Google services, both read-only. Each connection is separate, uses the minimum scope needed, and is described here individually.

2a. Outreach emails

Sage drafts backlink-outreach and sales emails as plain text and shows them to you in your portal with a one-click link that opens your own email program (Gmail or your default mail app) with the message pre-filled. You review it and send it yourself. Sage has no access to your Gmail account at all — no connection, no permission, no OAuth, no password — and cannot read, send, receive, or store anything from your mailbox.

2b. Google Search Console (read-only)

To measure a client's search performance, the client adds Sage's Google service account as a user on their own Search Console property. We ask for the Full user role, because Google only returns index-status data (is this page indexed, which canonical Google chose, when it was last crawled) to Full users and above. The role you grant is not what limits Sage: Sage's connection itself uses the read-only scope (webmasters.readonly) to read query, page, impression, click, and position data and index status. Sage never authenticates as the client and cannot modify anything in Search Console.

2c. Google Analytics 4 (read-only)

Similarly, a client may grant the same service account Viewer access on their GA4 property and tell us the property's numeric ID. Sage uses the read-only scope (analytics.readonly) to read aggregate traffic metrics (sessions, users, conversions by channel and landing page). Sage reads aggregate reporting data only; it does not access individual visitor identities, and it cannot change anything in the client's Analytics account.

3. Shopify store data

Clients provide a Shopify Admin API access token for their own store. Sage uses it to read products, collections, pages, and blog posts, and to write only changes the client has approved in the portal: SEO titles, meta descriptions, on-page copy edits, redirects, and blog posts (drafts by default). Sage does not access customer records, orders, or payment data.

4. What we store, and where

• API credentials (Google service-account key, Shopify token) are stored as files on the application server's private volume on Fly.io. They are excluded from source control, are not shared with anyone, and are used only to make the API calls described above.
• Working data per client — search-performance snapshots, drafted content, outreach logs (contact name, publicly listed email address, site, and draft status) — is stored as files on the same server, and is visible to the client in their password-protected portal.
• What we do not store: anything from your Gmail account (Sage never connects to it), Shopify customer or order data, or any Google account password (Sage never sees passwords — access is via service-account credentials only).
• Free audit requests — when you ask for a free audit at /free-audit, we save a record of the request on the application server's private volume on Fly.io and copy it to a Google Sheet that only the operator can open. For a Connected audit the record holds your name, email address, store address and brand name, the GA4 property ID if you give one, and the result of each connection check: whether Google showed our service account your Search Console property with the Full role, which property that was, whether GA4 Viewer access was confirmed, and when. For a Quick look it holds your store address and email address. Every record also holds the time, whether our server could open your store's home page, your place in the queue if that week is full, the private audit link once it is sent and when it expires, the choice you make at the end of your audit (I'll DIY or Let Sage do it), and whether each email to you and to the operator was sent. The connection check itself only asks Google which Search Console properties our service account can see (and, for GA4, runs a one-day session count to confirm access); the figures in a Connected audit come from the read-only access you granted, read by the operator when running your audit. We email you to confirm the request, when access is confirmed and when your audit is ready, and we email the operator for every request. We use all of this to run your audit, to follow up about it and to compare your later audits against it, and for nothing else; we do not add you to any other list. If you later become a client, the confirmed connection carries over to your client workspace so you do not have to connect again. Your browser keeps a reference to your request (local storage) so you can come back to it, and your audit page keeps the fixes you tick off in your browser only. Audit records, including the numbers and fixes in your audit and the evidence behind them (the Search Console, GA4, crawl and PageSpeed output used to produce them), are kept so we can follow up on your audit and compare your later audits against it. They are used only for that, are not shared, are not sold and are not used to train AI models. An audit link that expires stops showing the page but does not delete the record. We delete everything we hold about your request within 7 days of you asking (section 7).
• Website analytics — the home page uses PostHog to count visits and see how the page is used. It records which view of the page you open, clicks, how long you stay, rough location derived from your IP address, and your browser and device type. It also records short replays of how the page was used. Anything you type into a form field, including your email address and store URL, is masked and not recorded. We also record that the waitlist form was submitted or that the free-audit page was opened (that event only), never what you entered. The free-audit pages themselves are not tracked. PostHog sets a cookie or local-storage entry in your browser to recognise a return visit. If your browser sends a Do Not Track signal, nothing is recorded. Only the home page is tracked: this policy, the terms, the client portals and the admin pages are not. Analytics data is not combined with the Google or Shopify data described above.
• Your audit page — your audit is delivered on a private link made only for you, with an unguessable address. It is not listed anywhere, is marked so search engines do not index it, and stops working 14 days after it is sent; you can ask for a fresh link, which is sent to the email address the audit went to. To make it recognisably yours it shows your brand's name, logo, colours and heading font, which we read from your public website when the audit is published. It states clearly that it was prepared by Sage and is not an official page of your brand. A Connected audit contains figures from the read-only access you granted; a Quick look contains only figures measured on your public website (a live crawl and Google's PageSpeed test). Every figure is stamped with when it was measured and where it came from, and nothing on the page is a projection or an estimate. The numbers and fixes on your page, and the evidence behind them, stay in your audit record for the same purpose and under the same limits as described under Free audit requests above, including deletion within 7 days of your request.
• Payment and billing records: when you pay at /checkout, we keep your name, email address, store, brand, the subscription and payment IDs, the amounts and the state of each payment. We keep these while we are in contact and delete them on request, except where we must keep payment records as the law requires. Card, UPI and bank details go to Razorpay only. Sage never sees or stores them.
• Sign-in: one-time sign-in links are sent by email and last 24 hours. Only a hash of each link is stored. Client passwords are stored hashed.
• At onboarding, Sage reads your store's existing articles and pages from Shopify.
• Carrying over a free audit: a verified Search Console connection from a free audit is carried into your client account only when the email that pays matches the email on the audit. Sage re-checks about every 12 hours that the connection still works.
• Terms acceptance: when you accept the terms, we record that with the date.

5. Sharing and subprocessors

We do not sell or rent any data. Data is shared only with the infrastructure needed to run the service:

• Fly.io — hosts the application and its storage.
• Anthropic (Claude API) — generates draft text (blog posts, page rewrites, outreach emails). The material sent to it is the client's own brand/site content and Sage's own previously drafted emails.
• PostHog — provides the home-page analytics and replays described in section 4. Sage's PostHog project is hosted in the United States.
• Razorpay: payment processing, India.
• Google Sheets and Apps Script — hold the free-audit request list described in section 4.
• Google and Shopify APIs — as described above, at the direction of the account owner who granted access.

6. Security

All traffic to this site and the portal is forced over HTTPS. The portal is authentication-protected. Credentials live outside source control on a private server volume, and the operator is the only person with server access. No system is perfectly secure, but the attack surface here is deliberately small: one server, no database of end-user accounts, no stored passwords.

7. Retention and deletion

Credentials and client working data are kept while the engagement is active. When a client leaves — or on request at any time — we delete their tokens and workspace from the server. You can also cut off Sage's access yourself, instantly and unilaterally:

• Google: revoke access at myaccount.google.com/permissions, or remove the service account from your Search Console / GA4 property.
• Shopify: uninstall the private app / revoke the token in your Shopify admin.

To request deletion of stored data, email sageatseomatic@gmail.com; we will delete it and confirm within 7 days.

8. Changes to this policy

If how Sage handles data changes, this page changes with it, and the effective date above is updated. Material changes affecting an active client are communicated directly.

9. Contact

For anything about this policy or your data: sageatseomatic@gmail.com.