Privacy Policy

Last updated: 1 November 2026

Brightstone Metrics shows publishers what their websites earn. To do that it reads figures from the advertising and analytics accounts you connect, stores them, and shows them back to you. This page says exactly what is read, why, where it goes, and how to get rid of it.

Who we are

The service is operated under the Brightstone Metrics name. The service runs at brightstone.app. For anything in this policy, including a request to delete your data, write to [email protected].

What we collect

Your account

Your name, email address, password (stored only as a bcrypt hash, never as text we can read), time zone, language and display currency. Billing is handled by Paddle, who act as the merchant of record — your card details go to them and never reach our servers.

Data from Google

When you connect a Google product, Brightstone asks only for the permission needed by that product. AdSense and Analytics permissions are read-only. Google Ad Manager currently provides its reporting API through the broader Ad Manager permission; Brightstone uses it only to read reporting data and does not change your Ad Manager configuration:

• https://www.googleapis.com/auth/adsense.readonly Your AdSense earnings, impressions, clicks and page views, by day and by site. This is the revenue the dashboard exists to show.
• https://www.googleapis.com/auth/analytics.readonly Google Analytics 4 traffic for the properties you choose: page views, sessions, active users now, and your top pages. This is what lets the dashboard show traffic alongside provider-reported earnings.
• https://www.googleapis.com/auth/admanager Google Ad Manager / AdX reporting data for the network and dimensions you connect. Brightstone requests this separately from AdSense and Analytics and uses it for reporting only.

We store the daily totals these return, plus the access and refresh tokens needed to keep fetching them. Tokens are encrypted at rest with your installation's application key. We never receive your Google password.

Data from other advertising networks

If you connect AdsKeeper, MGID, Adsterra, Ezoic, Taboola, Revcontent, Outbrain or another supported advertising network, Brightstone receives the reporting data that the provider makes available for the connection you configure. Depending on the provider this can include revenue, page views, impressions, visible impressions, ad requests, clicks, sessions and related performance metrics.

We store the credentials, API keys or tokens needed for the connection in encrypted form where applicable, together with the reporting figures used for your dashboard, history, reports, alerts and other features you request. Brightstone does not receive your password for these provider accounts. Availability and the exact data returned depend on the provider and the access enabled for your account.

Data from your own websites

The optional WordPress connector posts an audience count. The separate Brightstone Presence script uses a random browser identifier stored in local storage to avoid counting the same browser repeatedly. The server stores an HMAC-derived identifier with the site and last-seen time, counts activity over a 30-minute window, and removes inactive identifier records after a day. It does not send page content or advertising account credentials. Ordinary request-security logs may still contain IP and browser information.

Ordinary service and account-security records

Server logs with IP address and browser are kept for up to 30 days for security and debugging. Brightstone also keeps account-security events such as successful, failed, unusual or blocked sign-ins; sensitive-action verification; session and trusted-device changes; and access-role changes. These records can include the IP address, browser/device description, time, authentication method, risk signals and approximate country, region or city when that information is supplied by our network infrastructure. Where approximate coordinates are available to the server, they may be used to detect impossible travel. They are used only for account security, fraud prevention, investigation and user-visible security history.

Recognized devices use a random Brightstone-issued browser token whose hash is stored on the server. We do not use invasive browser fingerprinting for this feature. Authenticator-app secrets are encrypted at rest and recovery codes are stored as one-way hashes. A session cookie keeps you signed in. We do not use advertising cookies or build cross-site advertising profiles.

Brightstone landing-page analytics

Brightstone uses one company-owned Google Analytics 4 web stream to understand visits to the public landing page. It is not installed in the customer app or platform console. This can use analytics cookies or browser identifiers and measures general information such as the type of page, device and browser, referral source, and actions such as selecting a plan or opening the demo from the landing page. We use this to understand acquisition and improve the landing page.

Brightstone deliberately sends generic event labels rather than your business data. Provider credentials, access or refresh tokens, account identifiers, names, email addresses, site domains, publisher revenue, balances and targets are not sent to this Brightstone analytics stream. This measurement is separate from any customer-owned Google Analytics property you connect for dashboard reporting.

Landing-page analytics starts automatically when configured. Advertising storage, advertising personalization and Google signals remain disabled.

The public landing page also uses Microsoft Clarity for heatmaps and session recordings of landing-page interactions. Clarity is not installed on sign-in pages, the customer dashboard or the platform console. Advertising storage remains disabled.

Public product help and website support

The Brightstone character on the landing page and demo is a separate public product guide. It answers from Brightstone's published product knowledge and cannot access customer workspaces, analytics, provider credentials or private assistant conversations. Product-help questions are processed to return a reply; they are not saved as a customer conversation.

If you request a person, Brightstone stores the support messages and any name or email you choose to provide in a separate website support conversation, encrypted at rest. A random token in your host-only server session identifies that conversation; entering another conversation ID does not grant access. Authorized staff can reply in the website support inbox. Website chats are available for 24 hours, then expire and are removed by the next daily cleanup, normally within another 24 hours. Do not send passwords, access tokens or payment-card details. Our support email remains available afterward.

SocialChamp and Facebook Page metadata

Where direct Facebook Page connections are enabled, you choose Pages through Meta's consent flow and select which to include in Brightstone. We request Page-list and read/reporting permissions, encrypt the saved access token, and retain the connection identity, selected Page identifiers, names, follower counts and available reporting snapshots. Country reporting is requested only when enabled. Business names entered inside BSM are internal organizational labels; they do not create a Meta business. Disconnecting a business removes its saved connection token and cached Page directory from Brightstone. You can separately remove the app's authorization using Meta's integration controls; doing so may affect your other connections to the same app.

Each workspace can connect its own SocialChamp account through MCP OAuth. We encrypt access and refresh tokens and store connected-channel information and reliably discovered Facebook Page links or identifiers. Requested permissions can include profile reading and post management. When an authorized workspace owner or admin confirms a publishing action, its selected accounts, text, media URLs, network options and time are sent to SocialChamp for delivery. Prepared actions and provider results are encrypted at rest; a submission record prevents duplicate sends. Calendar, posts, drafts and available post metrics are cached privately for the connected workspace. Where supported Meta access is configured, follower counts may be cached with their last-updated time. The platform owner's internal Audience tab can also cache anonymous public Facebook Page Plugin readings, with rounded, unavailable and dated values identified separately. These public readings are not enabled for ordinary customer workspaces. A separate Facebook login is not silently created for your users.

Brightstone AI

Brightstone includes an optional analytics assistant. When you ask Brightstone AI a question or explicitly request an AI-generated report insight, Brightstone sends your question, up to eight recent conversation messages, and a limited, access-scoped analytics context to Brightstone's Cloudflare edge service for inference with Cloudflare Workers AI. That context can include the selected period, revenue and traffic metrics, provider and site breakdowns, active-user figures, targets, comparison values, metric freshness and other dashboard context needed to answer the request.

Brightstone AI is invoked only for the requested AI feature; it does not independently sign in to or query your advertising providers. Provider credentials, OAuth access tokens and refresh tokens are not included in the AI context. Brightstone configures these AI requests to skip shared caching and disables AI Gateway prompt logging. Brightstone does not use customer metrics or Google user data to train machine-learning or AI models.

AI Connections and external assistants

AI Connections lets you authorize ChatGPT or another compatible assistant to read Brightstone reports through our MCP server. This is optional and separate from Brightstone AI. Where connections are enabled, you sign in through Brightstone, choose one workspace and explicitly select the websites and data permissions to share. Your current workspace role and site restrictions still apply. New websites are not shared automatically.

Shared results can include your account name, authorized workspace and website names, revenue, provider breakdowns, traffic and audience figures, targets, forecasts and reporting availability. Optional permissions can include existing social reporting snapshots, your report-history metadata and safe integration-health information where your role allows it. Results may include figures obtained from Google or another reporting provider. Provider passwords, API keys and provider access or refresh tokens are not returned to the assistant. This release cannot change settings or publish posts.

Your chosen assistant provider receives and processes these results under its own terms, privacy policy and account settings. Review its retention, data-use and deletion controls before connecting. Brightstone does not promise that an external assistant retains nothing or deletes results immediately. Select Disconnect in Account → AI Connections to revoke future retrieval and refresh access. This does not remove results already received or stored by the assistant; use that provider's controls for its copy. It does not delete your Brightstone reporting history or disconnect your advertising or analytics providers.

Connection records contain the authorizing user, workspace, selected sites, client/application identifier, approved permissions, connection and last-use times, expiry and revocation state. Safe access records contain connection and workspace identifiers, tool names, timestamps, result status and processing duration. They do not contain bearer tokens, provider credentials, complete analytics responses or assistant conversations. MCP access-audit records are normally retained for 30 days; expired connection and authorization records are removed on the scheduled cleanup cycle.

Customer support and notifications

When a signed-in customer explicitly asks to talk to a person, a separate support thread contains their messages, workspace and contact identity. Authorized staff can reply, and closing that customer thread can email its public conversation to the customer. Staff-only notes are excluded. Private assistant history is scoped to the signed-in user and workspace. Optional browser push notifications store the subscription endpoint and delivery keys needed for that device; permission and notification settings remain under your control. Installing the PWA does not grant provider access.

Report delivery

If you configure scheduled report delivery, Brightstone sends the report and the information necessary to deliver it through the channel you choose. Email reports are processed by our email delivery provider. Telegram reports are sent through Telegram's bot service, and Viber reports are sent to the Viber Channel you connect. Those third-party services process the delivered content under their own terms and privacy policies. Delivery credentials and tokens are stored securely and are used only to provide the configured delivery feature.

How Google user data is used

Data obtained through Google APIs is used to provide the reporting features you choose: your dashboard, authorized team access, requested reports and optional AI Connections you explicitly approve. Specifically, Brightstone Metrics' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. That means we do not:

• sell it or transfer it for advertising, data brokerage or unrelated purposes;
• use it for advertising, profiling or credit assessment;
• allow humans to read it, except where you have explicitly asked us to help with a support problem, where the law requires it, or where it is aggregated and anonymised for internal operations;
• use it to train machine learning or AI models.

Transfers needed for a visible feature you request, including sharing authorized reporting results with your selected assistant, take place with your consent. Other permitted disclosures are limited to service delivery, security and legal requirements described in this policy and the Google API Services User Data Policy. An AI connection does not authorize unrestricted use of your Google account.

Who else sees it

Data is shared with the service providers and processors needed to provide features you use: our hosting and infrastructure providers; Cloudflare for edge services and optional Brightstone AI inference; Paddle for payments; our email provider for service messages and reports; Telegram or Viber when you configure those report-delivery channels; Google Analytics for Brightstone landing-page analytics; Microsoft Clarity for public landing-page analytics; and our own support system when you contact us. An external assistant you authorize also receives the results described in AI Connections, under its provider's own terms and privacy policy. Each service receives only the information needed for its role or for the feature you request. We have never sold customer data and the business does not depend on doing so.

We will disclose data if legally compelled to, and where we are allowed to tell you that has happened, we will.

How long it is kept

Data is held on servers in the United States. Daily revenue and traffic figures are kept for as long as your account exists, because a dashboard with no history is not worth much. Disconnect an integration and its tokens are deleted immediately; the figures already gathered stay until you delete the site or the account. Account-security events are normally retained for up to 180 days. Revoked recognized-device records are normally removed after 90 days.

Delete your account and everything belonging to it — sites, integrations, tokens, figures, targets — is removed within 30 days, apart from records we are legally required to keep, such as invoices.

Taking it back

You can revoke our access to your Google data at any time, either from the integrations page in Brightstone Metrics or directly at myaccount.google.com/permissions. Revoking there stops all future access immediately.

Under the GDPR you may also ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email [email protected] and we will answer within 30 days.

Third-party services

Brightstone is an independent service. Connecting to or displaying the name or logo of an advertising, analytics or messaging provider does not mean that provider sponsors, endorses or is affiliated with Brightstone unless we expressly say otherwise. Third-party services remain subject to their own privacy policies and terms.

Security

Everything travels over HTTPS. Provider credentials, provider OAuth tokens and authenticator secrets are encrypted at rest. Passwords are stored using Laravel's one-way password hashing and recovery codes are stored as one-way hashes. Brightstone supports authenticator-based two-factor authentication, adaptive sign-in checks, fresh verification for sensitive actions, trusted-device revocation and active-session controls. Access to production is limited to the people who operate the service. No system is perfect, and if a breach ever affects your data we will tell you and the relevant authority without undue delay.

Children

The service is for businesses and is not directed at anyone under 16. We do not knowingly collect their data.

Changes

If this policy changes in a way that affects what we do with your data, we will email you before it takes effect. The date at the top always reflects the current version.