Word of Agent

Privacy policyLast updated 26 October 2026

Privacy policy

Word of Agent measures whether search engines and AI assistants can find, read and recommend a website. This page says what we collect to do that, why, who else handles it, and how to have it deleted.

What we collect

  • Your account. Your email address, and your name if you sign in with Google. The accounts you belong to, the people you add, and your role in each.
  • Sign-in records. Sessions, one-time sign-in links and API tokens, all stored only as a one-way hash, with the browser that created each session.
  • Sites and results. The sites you add or audit, the public pages we fetched from them, the findings, and the history of each audit.
  • What you or your assistant send us. Site profiles (brand names, competitors, customer questions), answers you paste or your assistant sends from ChatGPT, Claude, Gemini or another assistant, readings of those answers, outreach drafts and the work log.
  • Your plans and answers about how you work. Your answers about your business (its type, the hours you can spend, countries, budget), the channel plans you approve and their reviews.
  • Facts your assistant records. Public prices, ratings and review counts of your business and its rivals, what your own listings show, claims assistants made about your business, and how many customers you asked for reviews, each with the pages they came from.
  • Listening. Public posts that mention your business, your rivals or your customers' questions, found on Hacker News, YouTube and the feeds you add: their title, a short excerpt, author name as published and link.
  • Prospects, if you sell to businesses. Names, roles, employers, countries and published work email addresses of people you or your assistant chose to contact, with the public pages that show why, and whether they replied or opted out. You decide who is recorded and are responsible for your lawful basis to contact them; we keep an opt-out permanently and delete a prospect on request.
  • Share links. When you share a report: a hash of the link's token, when it was made and last opened. Anyone with the link can see that report page (no answer texts, drafts or account details) until you revoke it.
  • Search Console, if you connect it. See "Google user data" below.
  • Connected assistants. When you connect an assistant to your account, its name and the grant you approved, stored as hashes.

Google user data

If you connect Google Search Console, we ask Google for read-only access to your Search Console data (webmasters.readonly). If you also allow sitemap submission, we ask for access to view and manage it (webmasters), which we use only to submit the sitemaps you or your agent ask us to submit. We read, for the sites in your Word of Agent account: which properties you can access, search traffic (queries, pages, clicks, impressions, positions), sitemaps and the indexing status of key pages.

We use this data only to show you, and the assistants you connect to your account, how your sites appear in Google search, and to submit sitemaps when asked. We store the refresh token Google gives us encrypted, and the Search Console data that appears in your audit results. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except your account's members, or us when you ask for support or the law requires it.

Word of Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Search Console at any time in Settings, Search Console. We then delete the stored token and ask Google to revoke it. You can also remove access at myaccount.google.com/permissions.

What we do not do

  • We do not call AI models with your data. Answers come from your own assistant, which you control.
  • We do not sell personal data or use it for advertising.
  • We do not send anything in your business's name. Outreach is drafted by your assistant, approved by you, and sent by you or your assistant.
  • We do not read Reddit or X, and we do not scrape personal data or buy lists.

Who else handles it

  • Resend sends our emails: sign-in links, invitations, monitoring alerts and reminders.
  • Cloudflare checks the email sign-in form for bots (Turnstile) and carries our web traffic.
  • Google, when you sign in with Google or connect Search Console, and YouTube's search, when our server is set up for it, which receives your business's and rivals' names as search terms.
  • Hacker News search (run by Algolia), which receives your business's and rivals' names and the key words of your customers' questions as search terms.
  • Our servers, which we rent from a hosting provider, store everything else.

How long we keep it

We keep your account, sites and results while your account exists, so you can see your history. Sign-in links expire within minutes and sessions after 30 days of not being used. When you delete your account or ask us to, we delete its data, apart from what the law requires us to keep.

Cookies

The app uses one cookie to keep you signed in, and a short-lived one while you sign in with Google. The dashboard and this site remember your colour theme in your browser. We use no advertising or tracking cookies.

Your choices

You can see your data in the dashboard, export it through the API, correct it, and ask us to delete it. Write to [email protected] and we will answer within 30 days.

Changes

When this policy changes, we update the date above, and email account owners about changes that matter.