Privacy Policy

Introduction

On Belay ("we", "us", or "our") operates the On Belay platform at onbelay.ai (the "Service"). This Privacy Policy describes how we collect, use, store, and disclose information when you use the Service.

On Belay is a B2B SaaS platform. By using the Service, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Account and identity information

When you sign in with Google, we collect your name, email address, and profile photo via Google OAuth (the openid, userinfo.email, and userinfo.profile scopes). This sign-in information is used only to create and identify your individual account within On Belay. It is separate from the Google business data described below, which your organization connects deliberately.

Google business data your organization connects

Separately from sign-in, an administrator of your organization may connect On Belay to your company's Google business properties so that On Belay can read data on your organization's behalf. These connections are optional, are initiated by an administrator, and require explicit consent on Google's own consent screen. Every one of these scopes is read-only. The full list of scopes, the data each one reads, and what On Belay does with that data is set out in the "Google API Data We Access" section below.

Organization and group configuration

We store the organizational structure you configure in On Belay: organization name, functional group names and descriptions, Claude role definitions (system prompts), people guidelines, and group membership assignments. This configuration data is the core of what On Belay delivers to Claude via MCP.

OAuth tokens and API credentials

When you connect third-party integrations (e.g., HubSpot, Shopify, Google Analytics, Slack), we store the OAuth tokens or API keys required to authenticate against those services on your behalf. All credentials are encrypted at rest using libsodium secretbox symmetric encryption before being written to our database. Credential decryption only occurs at the moment a permitted user requests the credential via the MCP API.

MCP access tokens

On Belay issues OAuth 2.0 Bearer tokens to Claude Desktop, claude.ai, and Claude Code when users complete the OAuth PKCE flow. These tokens are stored as SHA-256 hashes in our database — we never store the plaintext token. Tokens are used to authenticate MCP API requests.

Usage and log data

We may collect standard server log data including IP addresses, browser user agents, request timestamps, and error information. This data is used for security monitoring, debugging, and service reliability. It is not used for behavioral advertising.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Authenticate you and your team members to the platform
• Deliver organizational context to Claude via MCP when requested
• Read data from the third-party services your organization has connected — including Google Analytics, Google Ads, Search Console, and YouTube — and turn it into analysis, reports, and recommendations for that organization
• Send transactional emails (e.g., team invitations) using Resend
• Monitor and maintain the security and reliability of the Service
• Comply with legal obligations

We do not sell your data to third parties. We do not use your data or your organization's configuration to train AI models.

Google API Data We Access

On Belay requests two distinct categories of Google access. We describe both here so that it is clear exactly what data we receive, why we receive it, and what we do with it.

1. Sign-in scopes (about you as an individual user)

• openid, userinfo.email, userinfo.profile — your Google account identifier, email address, name, and profile photo. Used only to create your On Belay account, sign you in, identify you to your teammates within your organization, and send transactional email you have requested.

2. Business data scopes (about your organization's Google properties)

An administrator of your organization connects these. On Belay uses them to read business data and turn it into analysis, reports, and recommendations for that same organization. All of the following scopes are read-only. On Belay does not create, write, modify, publish, or delete anything in your Google properties through any of them.

• Google Analytics — analytics.readonly — reads Google Analytics 4 property data (sessions, traffic channels, funnels, and e-commerce events) via the Analytics Data API. Used to power the Website Optimization Agent, the Marketing Agent's weekly brief, Customer Analytics, and the AI Visibility Engine.
• Google Ads — adwords — reads campaign performance (cost, impressions, clicks, conversions, conversion value, cost-per-click, and impression share) via the Google Ads API. Used to power the Marketing Agent's advertising views and the BI Dashboard. Google Ads does not publish a separate read-only scope variant; On Belay uses this scope on a read-only basis and does not create, edit, pause, or spend against any campaign.
• Google Search Console — webmasters.readonly — reads organic search performance (clicks, impressions, click-through rate, average position, and top queries and pages). Used for the Website Optimization Agent's SEO analysis. On Belay does not submit sitemaps or modify property settings.
• YouTube — youtube.readonly — reads channel and video metadata for your organization's channel, on demand, when a user of your organization asks their AI agent for it. On Belay does not upload, edit, or delete videos or channel settings.
• YouTube Analytics — yt-analytics.readonly — reads YouTube Analytics metrics (views, watch time, traffic sources, and engagement), on demand, for the same purpose.

Data returned by these APIs is used only to deliver the Service to the organization that authorized the connection. It is scoped to that organization, is never pooled or combined across customers, and is never made available to another customer.

You can disconnect a Google integration at any time from Dashboard → Integrations, or revoke On Belay's access directly from your Google Account permissions page. Disconnecting stops all further data collection immediately and deletes the stored credential.

Prohibited Uses of Google User Data

On Belay's use of information received from Google APIs — both sign-in data and business data read under the scopes listed above — is limited to the practices disclosed in this Privacy Policy. We do not use Google user data for any prohibited purpose, including but not limited to: building surveillance systems, making creditworthiness determinations, selling or renting data to third parties, transferring it to data brokers or information resellers, or serving advertising.

We do not use Google user data to train, fine-tune, retrain, or otherwise develop or improve any artificial intelligence or machine learning model — including our own, and including any third-party or generalized AI model. On Belay is an AI platform: it sends the relevant Google data to Anthropic's Claude API at the moment of a request so that a report or recommendation can be generated for the organization that owns that data, and the output is returned only to that organization. That is inference on the customer's behalf, not model training. On Belay does not retain Google user data for model development, does not use it to build datasets, and does not permit its use for training by any sub-processor.

On Belay's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

OAuth Token and Credential Storage

All third-party OAuth tokens and API keys stored by On Belay are encrypted at rest using libsodium secretbox (XSalsa20-Poly1305) before being written to our primary PostgreSQL database, which is hosted on Supabase. The master encryption key is a 32-byte secret held as an environment variable on our application hosting provider, Railway — deliberately separate from the database itself, so that database access alone does not yield readable credentials. A distinct per-organization key is derived from that master key, so credentials belonging to one organization cannot be decrypted with another organization's key material.

Integration credentials are never logged, never transmitted in plaintext beyond the TLS-secured API response, and are only decrypted when a user with valid group-level permission calls the get_integration_credential MCP tool with a valid Bearer token.

Shopify Merchant Data

On Belay integrates with Shopify as a public app. When a Shopify merchant connects their store to On Belay, we store the shop domain and OAuth access token required to make API calls on their behalf. This data is subject to the same encryption and retention standards described in this policy.

On Belay caches Shopify end-customer records. Once a store is connected, On Belay reads order and customer data from the Shopify Admin API on a recurring schedule and stores it in that organization's per-organization cache database (Neon, described under Third-Party Services below), so that analytics, reporting, and the AI features the merchant has enabled can run without re-querying Shopify on every request.

• Cached customer records include the customer's first and last name, email address, number of orders, lifetime amount spent, account state and tags, and first-order and acquisition attribution (source, medium, campaign, and landing page), together with the customer object as Shopify returned it.
• Cached order records include the order's line items, totals, discounts, refunds, and timestamps, the purchaser's email address, and the customer record linked to the order.

This data is read from Shopify only — On Belay does not write customer records back to a merchant's store. It is scoped to the single organization that connected the store, is never pooled or combined across customers, and is never made available to another customer. Retention is described in the Data Retention section below.

In compliance with Shopify's platform requirements, On Belay responds to the mandatory compliance webhooks:

• customers/data_request — we acknowledge receipt. To obtain the Shopify customer data On Belay holds, a merchant contacts privacy@onbelay.ai with the shop domain and the customer concerned; we respond within 30 days.
• customers/redact — we acknowledge receipt. Redaction is performed on request: a merchant contacts privacy@onbelay.ai with the shop domain and the customer concerned, and we delete that customer's cached records and confirm within 30 days.
• shop/redact — on receipt we immediately delete the stored access token and configuration for that shop, which stops all further data collection. Cached data already held is deleted with the organization's cache database when the account is deleted, or sooner on request to privacy@onbelay.ai.

Merchants may request deletion of their cached Shopify data, or confirmation that deletion has occurred, at any time by contacting privacy@onbelay.ai.

Data Retention

We retain data for as long as your account is active or as needed to provide the Service:

• Integration credentials — deleted immediately when you remove an integration from your organization.
• MCP Bearer tokens — remain valid until you explicitly revoke them; they do not currently expire on their own. You may revoke any token at any time from Dashboard → Settings, and revocation takes effect immediately. Tokens are stored only as SHA-256 hashes, so the plaintext token is never recoverable from our database.
• Organization and group data — retained for the lifetime of the organization account. Deleted within 30 days of account deletion upon request.
• User account data (including Google sign-in data) — deleted within 30 days of an account deletion request. To request deletion, contact privacy@onbelay.ai.
• Google API data (Analytics, Ads, Search Console, YouTube, YouTube Analytics) — cached API responses and the reports derived from them are retained for the lifetime of the organization account so that period-over-period analysis remains possible. Disconnecting the Google integration stops all further collection and deletes the stored credential immediately. All retained Google API data for an organization is deleted within 30 days of an account deletion or data deletion request to privacy@onbelay.ai.
• Cached integration data (including Shopify orders and customers) — the working copy On Belay keeps of the business data your organization's connected integrations return. Retained for the lifetime of the organization account so that period-over-period analysis remains possible. Disconnecting an integration stops all further collection immediately and deletes the stored credential; data already cached is deleted together with the organization's per-organization cache database when the organization is deleted, or sooner on request to privacy@onbelay.ai.
• Integration call logs — a metadata record of each API call On Belay makes to your connected integrations: integration name, operation, request path, HTTP method, response status, error message if the call failed, retry count, and duration. Request and response bodies are not stored. These records are retained for the lifetime of the organization account and are deleted with the organization.

Third-Party Services

On Belay uses the following sub-processors and infrastructure providers. Each processes data subject to their own privacy policies:

• Supabase — PostgreSQL database hosting. supabase.com/privacy
• Railway — Cloud application hosting. railway.app/legal/privacy
• Anthropic (Claude API) — AI model API. Data reaches Anthropic by two paths. First, when Claude makes an MCP tool call at a user's request, Anthropic receives what Claude sends as part of that operation. Second, On Belay's own scheduled agent and fieldset runs send data to the Claude API on a recurring server-side schedule, with no user present, in order to generate the analyses, reports, and recommendations your organization has enabled — this includes data read from the third-party services you have connected, such as your Google properties. In both cases the output is returned only to the organization that owns the underlying data, and Anthropic does not use it to train its models. anthropic.com/privacy
• Google — Identity provider for sign-in, and the source of the read-only business data your organization connects. From sign-in we receive your name, email address, and profile picture, used to create and maintain your On Belay account. Where your organization has connected them, we additionally read Google Analytics, Google Ads, Search Console, YouTube, and YouTube Analytics data on your organization's behalf, as detailed in "Google API Data We Access" above. We do not sell Google user data and do not share it with any third party except the sub-processors named in this section as required to operate the Service — specifically Supabase and Neon for encrypted storage and the per-organization cache, Railway for hosting, Inngest for the durable state of the scheduled job producing your report, Resend for transactional email you have requested, Anthropic's Claude API, which receives only the data needed to generate a requested report or recommendation and does not use it for model training, LangSmith for the trace of that AI run, Sentry if that run errors, and Slack where you have connected it and asked for reports to be delivered there. Retention and deletion are described in the Data Retention section above. policies.google.com/privacy
• Resend — Transactional email delivery (team invitations). resend.com/legal/privacy-policy
• Shopify (Shopify Managed Pricing) — Subscription billing & payment processing. Shopify handles plan selection and all payment data; On Belay never stores card numbers. shopify.com/legal/privacy
• Neon (a Databricks company) — Per-organization PostgreSQL cache branches. Neon was acquired by Databricks, and the linked privacy notice is published by Databricks. On Belay keeps a working copy of the business data your organization connects — orders, customers, products, and search and analytics metrics — so reports render without re-querying your source systems on every page load. Each organization's cache is a separate database branch, and it is deleted when the organization is deleted. neon.tech/privacy-policy
• Inngest — Background job orchestration. On Belay's scheduled runs execute as durable, resumable jobs; the intermediate state Inngest persists in order to make a job resumable can include the data being analyzed. inngest.com/privacy
• LangSmith (LangChain) — AI run tracing and cost observability. LangSmith receives the full conversation of a traced AI run, not only the model's answer. That includes the results of any data the agent looked up while producing it — records read from your organization's cache, such as orders, products, marketing metrics, and search-performance data. For a traced run, LangSmith sees substantially what the model sees. It is used to debug runs and to account for their cost. langchain.com/privacy-policy
• DataForSEO — AI answer-engine and search-results data. On Belay sends your probe questions and your brand and competitor names, and receives back what the AI answer engines and search results say. This is how the AI Visibility Engine measures your visibility without holding an account on each engine. dataforseo.com/privacy-policy
• Upstash — Redis hosting for short-lived AI agent conversation context and rate-limit counters. upstash.com/trust/privacy
• Sentry — Application error monitoring. Receives error reports and the diagnostic context attached to them. sentry.io/privacy
• Slack — Where your organization connects it, On Belay delivers reports, alerts, and analyses into your own Slack workspace. slack.com/trust/privacy
• Intercom — Support-conversation data source. Where your organization connects its own Intercom workspace, On Belay reads your Intercom contacts and conversations into your per-organization cache to power Customer Analytics. intercom.com/legal/privacy
• Microsoft Clarity — Website session and interaction analytics. Where your organization connects its own Clarity project, On Belay reads daily friction metrics for your site — rage clicks, dead clicks, quick-backs, script errors, and scroll depth — and stores them in your per-organization cache to power the BI Dashboard and the Website Optimization Agent. privacy.microsoft.com/privacystatement
• Ahrefs — SEO and competitive search data. On Belay sends your domain and target keywords and receives organic keyword rankings, backlink profiles, top pages, and competitor ranking data, used by the Website Optimization Agent and the AI Visibility Engine. Ahrefs is provisioned by On Belay at the platform level and enabled per organization. ahrefs.com/legal/privacy-policy

Security

We implement industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, encrypted credentials at rest, hashed authentication tokens, and role-based access controls within the platform.

Google user data is covered by these same measures. Google OAuth tokens are encrypted at rest with libsodium secretbox as described above and are decrypted only at the moment an authorized request is made. Data read from Google APIs is transmitted over TLS, stored in per-organization scope, and is accessible only to members of that organization who hold the relevant group-level permission.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@onbelay.ai.

Your Rights

Regardless of where you are located, you have the right to access, correct, or delete your personal data at any time. You may also request restriction of processing or a portable copy of your data. To exercise any of these rights, contact us at privacy@onbelay.ai. We will respond within 30 days.

For organizations, admins may disconnect integrations and remove members directly from the dashboard; disconnecting an integration erases its stored credentials immediately. Deletion of an entire organization is not self-serve — it is performed by On Belay on request, and removes the organization's records together with its per-organization cache database. Organization and account deletion requests will be processed within 30 days.

Users in the European Economic Area (EEA) and United Kingdom additionally have rights under GDPR/UK GDPR including the right to object to processing and the right to lodge a complaint with a supervisory authority.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with a revised effective date. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact

For privacy-related inquiries, data deletion requests, or security concerns, contact us at:

On Belay Privacy Team
privacy@onbelay.ai