LucidGEO

Privacy policy

Last updated: 16 August 2026

Access to Google account data

LucidGEO allows the User to voluntarily connect their Google Search Console and Google Analytics 4 accounts, in order to import performance data relating to web properties the User owns or is authorised to access.

Requested authorisation scopes

The connection uses the Google OAuth 2.0 protocol and requests only the following scopes, both read-only:

  • https://www.googleapis.com/auth/webmasters.readonly — reading search performance data (queries, clicks, impressions, average position, indexing status) from the Search Console properties selected by the User.
  • https://www.googleapis.com/auth/analytics.readonly — reading traffic and behaviour metrics (sessions, sources, landing pages, events) from the Google Analytics 4 properties selected by the User.

LucidGEO does not request write, modify or delete scopes, and does not access Gmail, Google Drive, Google Contacts, Google Calendar or any Google service other than those listed above.

Purpose of processing

Data obtained through Google APIs is used exclusively to:

  • generate reports and analyses of visibility in organic search and generative answer systems;
  • compute aggregate metrics and performance indicators within the LucidGEO interface;
  • compare the performance of the User's connected properties over time.

Limited Use

LucidGEO's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained through Google APIs is:

  • not used for any advertising purpose, nor for marketing profiling;
  • not sold, transferred or licensed to third parties;
  • not used to train, fine-tune or improve generalised artificial intelligence models, whether our own or those of third parties;
  • not made accessible to human operators, except where strictly necessary to resolve a technical issue reported by the User with their consent, to comply with a legal obligation, or to protect the security of the service against confirmed abuse.

Retention, revocation and deletion

Access credentials (OAuth tokens) are stored encrypted at rest using AES-256-GCM. Imported performance data is retained for the duration of the contractual relationship and for a maximum of 12 months thereafter, after which it is deleted.

The User may at any time:

  • revoke authorisation from their Google account permissions page, taking immediate effect on data import;
  • disconnect the integration from within LucidGEO, in the settings section of their workspace;
  • request deletion of already imported data by writing to info@lucidgeo.eu. Requests are fulfilled within 30 days.

On revocation of authorisation or disconnection of the integration, stored credentials are deleted immediately and permanently. Performance data already imported is deleted within 30 days, or sooner at the User's request.

Security measures

Each customer's data is isolated at the database level through Row Level Security policies, not at the application code level. Third-party credentials are encrypted at rest. Infrastructure is hosted in data centres located in the European Union.

General privacy information

Data controller

The data controller is LucidGEO by Tripnepeople Di Marco Nardino, Italy company street G. Puccini 3 Roseto Degli Abruzzi, P. IVA 01904240676. Contatto per ogni questione relativa alla protezione dei dati: . Contact point for any data protection matter: info@lucidgeo.eu.

Categories of data processed

  • Registration and account data — first name, last name, e-mail address, organisation name, role, access credentials in encrypted form.
  • Billing data — company name, address, VAT or tax number, electronic invoicing code, and the data required to issue accounting documents.
  • Data imported from connected platforms — performance data for web properties, as described in the section above.
  • Technical usage data — IP address, request date and time, browser type, pages visited, recorded in system logs for security and diagnostic purposes.

Legal bases

  • Performance of a contract (Art. 6(1)(b) GDPR) — to provide the service, manage the account and deliver support.
  • Legal obligation (Art. 6(1)(c) GDPR) — for tax, accounting and record-keeping obligations.
  • Legitimate interest (Art. 6(1)(f) GDPR) — for infrastructure security, abuse prevention and technical improvement of the service, subject to a balancing test against the data subject's rights.
  • Consent (Art. 6(1)(a) GDPR) — for promotional communications and for any processing by providers located outside the European Union, where applicable. Consent may be withdrawn at any time without affecting the lawfulness of processing already carried out.

Recipients and processors

Data may be disclosed to parties acting as processors under Art. 28 GDPR, appointed by written agreement. As at the date of this policy, the categories of recipients are:

  • infrastructure and hosting provider, with data centres located in the European Union;
  • transactional e-mail service provider;
  • invoicing and accounting service providers;
  • consultants and professionals bound by confidentiality obligations;
  • public authorities, where disclosure is required by law.

Data is not disseminated publicly, nor transferred to third parties for their own commercial purposes.

Transfers outside the EU

Infrastructure and data storage are located in the European Union. Where any processing involves a transfer to a third country, it takes place solely on the basis of a European Commission adequacy decision or standard contractual clauses under Art. 46 GDPR and — for optional features that require it — subject to the User's explicit prior consent.

Retention periods

  • Account data — for the duration of the relationship and 12 months thereafter.
  • Billing data — 10 years, in compliance with civil and tax obligations.
  • Data imported from connected platforms — as set out in the dedicated section above.
  • Technical logs — 12 months.

Data subject rights

Data subjects may at any time exercise the rights set out in Articles 15 to 22 GDPR: access to their data, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent where processing relies on it.

Requests should be sent to info@lucidgeo.eu and receive a response within 30 days. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority or with the supervisory authority of their place of residence.

Nature of provision

Providing account and billing data is necessary to enter into and perform the contract: refusal prevents the service from being supplied. Connecting Google accounts is optional, and declining only limits those features that depend on such data.

Automated decision-making

The service does not carry out automated decision-making producing legal effects concerning the data subject, or similarly significantly affecting them, within the meaning of Art. 22 GDPR.

Changes to this policy

This policy may be updated to reflect legal or functional changes to the service. The date at the top of the document indicates the most recent revision. Material changes are notified to registered Users by e-mail with reasonable notice.