Go Digital Mate · SEO Portal

Privacy policy

Last updated 9 September 2026. Applies to the Go Digital Mate SEO Portal at seo.godigitalmate.com.au and the WordPress connector plugin that accompanies it.

This policy explains what the portal collects, why, where it is kept and how to get rid of it. It is written for the person whose website we are working on, not for lawyers.

1. Who we are

Go Digital Mate (ABN 92 650 986 735) operates the SEO Portal. Our registered address is Suite 248, Unit 4/16–18 Beenleigh Redland Bay Road, Loganholme QLD 4129, Australia. For anything in this policy — including a request for a copy of your data or to have it deleted — contact wecare@godigitalmate.com.au.

2. What we collect

Your account

The name, email address and password you use to sign in. Passwords are stored only as a salted hash — we cannot read your password, and neither can anyone who obtains the database.

Your website

With the connector plugin installed and its token entered by you, we read the published content, page titles and descriptions, SEO plugin settings, image filenames and alt text, internal links, and the site's own record of broken URLs. We also write changes you approve back to the site. We never read your customers' personal data, order records, form submissions or user accounts, and the plugin does not send them.

Google account data, if you connect one

Connecting Google is optional. If you do, you are asked to grant exactly three read-only permissions:

Permission	What we read	Why
`webmasters.readonly`	Search Console performance data for the property you choose: search queries, pages, clicks, impressions, click-through rate and average position, by day	To show you which searches bring people to the site, and to spot pages losing ground before the traffic goes
`analytics.readonly`	Aggregate Analytics figures for the property you choose: sessions, engagement and conversion counts by day, channel and landing page	To connect search visibility to what visitors actually did, and to estimate the value of the work
`userinfo.email`	The email address of the Google account you connected	So the portal can show you which account is connected, and so you can tell if it is the wrong one

These permissions are read-only. We cannot publish, alter or delete anything in your Google account, and they give no access to Gmail, Drive, Contacts, Photos or any other Google service.

3. How Google data is used — and the limits we accept

Google user data obtained through these permissions is used only to provide and improve the SEO features you can see in your own portal. Specifically, we commit that:

we do not sell it, rent it, or transfer it to anyone for advertising, marketing, credit assessment or any similar purpose;
we do not use it to train generalised artificial-intelligence or machine-learning models;
we do not use it to build a profile of you, or combine it with another customer's data;
no human reads it except where you have asked us to look at something, where it is necessary for security or to fix a fault, or where the law compels us;
we keep our use of it consistent with Google's API Services User Data Policy, including the Limited Use requirements.

Your data is never shown to another customer. Each account's data is separated by an account identifier on every record, and the portal refuses any request for a record belonging to a different account.

4. Where it is kept, and how it is protected

The portal runs on Cloudflare's network, and data is stored in a Cloudflare D1 database. Traffic is encrypted in transit with TLS.
The Google refresh token — the credential that lets the portal fetch your figures without asking you to sign in again — is encrypted before it is stored, using AES-GCM with a key held as a server-side secret and never written to the database. A copy of the database on its own does not yield a usable Google credential.
Sign-in sessions expire, and repeated failed sign-in attempts are rate-limited.
Access to the production system is limited to Go Digital Mate staff who need it to run the service.

5. Who else is involved

We use a small number of service providers to run the portal, and they only ever see what they need to do their job:

Hosting and database — Cloudflare, Inc.
Search data and language-model providers — for keyword volumes, competitor positions and drafting assistance. These providers receive keywords, page addresses and page text; they are not sent your Google account data, your sign-in details or any personal information about your customers.
Google — only when you have connected an account, and only to read the data described above.

6. How long we keep it

Search Console and Analytics figures are kept for as long as your account is active, so year-on-year comparisons still work. Disconnecting Google deletes the stored credential immediately and stops all further collection.
Website content snapshots are kept so a change can be rolled back, and you can delete any snapshot from the portal yourself.
When an account is closed, its data is deleted within 30 days, other than records we must keep for tax or legal reasons.

7. Your choices

Disconnect Google — Client Setup, then Google data, then Disconnect. The stored credential is deleted.
Revoke from Google's side — myaccount.google.com/permissions, which works whether or not you can reach the portal.
Get a copy, or have it deleted — email wecare@godigitalmate.com.au and we will respond within 30 days.
Remove our access to your website — deactivate the connector plugin in WordPress.

8. Cookies

The portal sets one cookie, to keep you signed in. There is no advertising or tracking cookie, and no third-party analytics on the portal itself.

9. Children

The portal is a business tool and is not intended for anyone under 16.

10. Changes

If this policy changes in a way that affects how your data is used, we will email account holders before it takes effect. The date at the top always reflects the current version.

11. Complaints

If you are not satisfied with how we have handled your data, contact us first at wecare@godigitalmate.com.au and we will work through it with you. If we cannot resolve it, you may complain to the Office of the Australian Information Commissioner, the federal regulator for private-sector privacy, at oaic.gov.au.