Privacy Policy

What TendClear processes

TendClear processes account identity and authentication/session information; password-reset email addresses, expiring reset records and pseudonymous reset rate-limit information; business names, memberships and roles; trial and plan-access status and dates; submitted website names and URLs; business category, services, service area, preferred tone and CMS preference; customer-selected search topics and their source provenance; beta feedback and optional willingness-to-pay research responses; and support or deletion communications you send us. Production billing is disabled, and the current private beta does not collect payment-card details.

When you request a scan or website check, TendClear retrieves public website pages and records page addresses, response information, titles, search descriptions, bounded normalized public page-text excerpts, bounded headings, links, crawl coverage, findings, action plans, website-check history and recheck results. It does not retain page HTML for this review. Anonymous scans also use private access/claim tokens stored as hashes and pseudonymous rate-limit information.

During the private beta, TendClear records limited onboarding and product milestones, including whether an invited user opened an Action Plan or Action Detail. These records associate the milestone with the account, business, website, invitation campaign, timestamp and necessary website-check/action identifiers. Milestone records do not contain passwords, password-reset tokens, OAuth credentials, invitation bearer tokens or arbitrary website page contents.

If you request an AI-assisted draft, TendClear stores the relevant request context, generated output, your saved edits, provider/model identifiers and usage counts. If you request AI-assisted content review, TendClear stores the allowlisted issue type, short evidence excerpt, page identity, confidence/source metadata, provider/model identifiers and token counts. If you optionally connect Google Search Console, TendClear stores the selected property, finalized date/page/query performance measurements and encrypted Google access credentials. TendClear may analyze those measurements to identify and prioritize search opportunities, let you select an observed query as a search topic, retain a bounded evidence snapshot when you mark work complete, and compare later Search Console performance. These measurements do not prove that a particular website change caused a later search result.

Why it is used

We use this information to operate accounts and the private beta, perform requested scans, prioritize website improvements, understand onboarding completion, identify product problems, evaluate whether invited customers reach useful recommendations, prepare optional drafts, recheck measured conditions, display optional Search Console context, prevent abuse, secure and debug the service, and respond to support or deletion requests.

When a free website check is submitted from a link containing a valid utm_campaign label, TendClear stores only that bounded campaign label with the scan so the founder can review aggregate scan, invitation and onboarding progress. TendClear does not use that label to record page visits or button clicks, and does not store the referring page or other campaign parameters for this report.

Google Search Console

Search Console is optional. TendClear requests read-only access and retrieves properties plus finalized measurements such as dates, pages, queries, clicks, impressions, click-through rate and average position. Stored credentials are encrypted. Search Console activity can help prioritize an existing website action; it does not prove causation or guarantee an outcome.

Disconnecting causes TendClear to attempt Google credential revocation and delete its stored connection, credentials, synchronization jobs and Search Console measurements for that website. TendClear does not send Search Console credentials or Search Console performance rows to OpenAI for the current draft feature.

Planned Google Business Profile connection

Google Business Profile connection is not currently available in the production beta. When enabled after Google access and policy approval, Google will require the broad business.manage permission. This version of TendClear is designed to use that connection read-only: it will not change a profile, create posts, or post review replies.

The planned feature will temporarily process selected profile and location fields plus recent reviews, reply status, and limited reviewer information that Google supplies. Review data can contain personal information. Cached Google Business Profile content will expire no later than 30 days. Disconnecting will attempt credential revocation and remove the stored connection, credentials, cached profile/review content, and refresh jobs without deleting unrelated website checks or Search Console data.

AI-assisted features

When you request a draft, TendClear may send OpenAI your business name, category, service area, services, preferred tone, relevant page URL/path, current title and description, measured action details and action type/subject. When an authorized manager explicitly requests a content-quality review, TendClear may instead send OpenAI a bounded sample of public page URLs, titles, search descriptions, headings, deterministic signals and normalized visible-text excerpts. It does not send full HTML, passwords, cookies, database credentials, Google OAuth credentials or Search Console performance rows. These API requests are configured with storage disabled. AI output can be wrong and must be reviewed. Nothing is published automatically.

Service providers

Current providers are Render for application and PostgreSQL hosting, Resend for password-reset email and optional weekly product briefs when outbound delivery is configured, OpenAI for user-requested AI drafts, and Google for optional Search Console authorization and data. A Stripe-hosted billing integration has been prepared and tested separately, but it is disabled in production and no production payment processing is open. This draft must be reviewed and updated before billing is enabled.

Optional weekly brief

If you explicitly enable the weekly TendClear brief, TendClear may send concise summaries of current Action Plan items and links back to authorized website pages through Resend. The brief is off by default, can be disabled in Email Preferences or through its scoped unsubscribe link, and does not affect password-reset or security messages.

Retention and deletion

Anonymous rate-limit attempts are designed to expire after 24 hours, and unclaimed anonymous scan results after 72 hours. Claimed account, site, website-check and draft data is retained while the account is active or until deletion. Search Console data is removed on disconnect. Operational logs and backups can follow the hosting provider’s operational retention rather than disappearing immediately.

Signed-in users can request account and data deletion from Privacy settings. The controlled beta uses a reviewed process so organization ownership, shared access, active work and Google disconnection can be handled safely. Contact privacy@tendclear.com with privacy questions.

Security and changes

TendClear uses HTTPS, managed PostgreSQL, tenant-scoped authorization, separate runtime/migration database roles, hashed security tokens and encrypted Google credentials. No system can promise absolute security. Because this is a private beta, this draft may change as the product changes; material updates should be dated and communicated before broader use.