Privacy policy

Who operates Sutra

GrowthForgeAI LLC operates Sutra at joinsutra.com. This policy explains how this SEO, GEO and AEO application handles information when you visit, create an account or manage a website. For support and privacy requests, contact hello@joinsutra.com.

Information we handle

Your account includes your email address, profile details and workspace memberships. When you add a website, we handle its public pages, business details, research, findings, drafts, your conversations with Sutra and the permissions you choose. Connected services also require website-specific credentials and provider identifiers.

We record work history, usage, approval decisions and change receipts so you can understand what ran and recover supported changes. Our infrastructure also processes request information, such as IP addresses and operational errors, to deliver and protect the service. Billing integrations handle customer and subscription references; the payment flow is currently test-only.

Your Google connections

Google connections are optional and separate from your Sutra account. Search Console access is read-only: we verify the matching website property and read search performance, including dates, queries, pages, clicks and impressions. Analytics access is also read-only: we list accounts and properties for selection, verify the matching web stream, and read aggregate traffic, sources, landing pages, key events and revenue for your website. This integration does not request individual visitor names or email addresses.

We store reports in your workspace to show history and suggest work. Search-derived opportunities can inform AI suggestions, conversations and drafts as described below. Google refresh tokens are encrypted on the server. These permissions cannot change your Search Console or Analytics settings.

We use Google information for Sutra’s visible reporting and website improvement features. We do not sell it, use it for advertising or use it to train general-purpose AI models. Sutra’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How AI processing works

Sutra uses OpenCode and the selected model providers to prepare suggestions, answer questions, draft content and review claims. Relevant business details, website evidence, selected conversation history and opportunities may be sent for this processing. Opportunities may include information derived from Search Console. OAuth tokens, API keys and CMS passwords are not supplied as model context.

The current default models are DeepSeek for routine work and Anthropic for designated reviews. Provider retention can vary by model and service. OpenCode publishes its current model data-handling information. Do not include secrets or sensitive personal information in conversations, business descriptions or content you submit.

Why we use this information

We use information to authenticate your account, separate client workspaces, read and analyze your website, produce reports and content, execute work within your selected permissions, send account messages and permitted updates, manage usage, troubleshoot failures and prevent abuse. Connecting a report does not authorize publishing, outreach or changes to a client’s website. Those actions have separate permission controls.

Services that process information

We use Supabase for authentication and database storage, Hetzner for application hosting, Cloudflare for delivery and protection, Resend for authorized email, OpenCode and its model providers for AI processing, and Dodo Payments for the current test billing flow. A CMS or other service you choose receives the information needed for that connection or an authorized action.

Information is available to workspace members according to their access. Service providers process information needed for their functions. We may also disclose information where required by law or necessary to investigate security incidents. Infrastructure and providers may process information in countries other than your own. Each connected provider also has its own privacy terms.

Storage and retention

We protect service credentials with server-side encryption and restrict application records by workspace membership. This is not end-to-end encryption of all workspace content. No service can promise absolute security.

Saved reports, content, change receipts and primary activity records remain stored until removed; there is currently no single automatic deletion period for all workspace records. Temporary Google setup expires after ten minutes. Live job events older than thirty days are removed by housekeeping; that rule does not delete all reports or content.

Disconnecting Google stops future synchronization for the selected website and service, removes its saved grant and pending setup, and keeps existing reports. It does not erase imported data, drafts or past work. Deletion requests may need separate handling of operational records, legally required records, third-party copies and backups.

Your controls and requests

A workspace owner or administrator can manage Search Console and Analytics access from the corresponding website connection in Settings. Disconnecting inside Sutra removes that local connection. To remove the broader Google account permission, use Google Account connections; this may affect other websites or services using the same grant. You can also pause a website, change its automation permissions and manage optional email preferences in the workspace.

For access, correction, export or deletion requests, email hello@joinsutra.com from your account address and identify the workspace or website involved. We may need to verify your identity and your authority over shared client information. A full self-service account deletion tool is not currently available. Applicable privacy rights depend on your location; you may also contact your local privacy regulator.

Browser storage

We use cookies and browser storage for sign-in, secure connection setup, your theme, workspace preferences and guidance choices. Clearing that storage may sign you out or reset preferences. Hosting and connected providers may use their own necessary security storage. These controls are distinct from any analytics or cookies installed on a website you manage.

Children and policy updates

Sutra is intended for adults managing businesses and client websites, not for children. Contact hello@joinsutra.com about information submitted by a child. We identify policy revisions by the date above and will explain material changes through the service or account communications. New uses of connected Google information that require consent will require that consent before the new use.