Privacy Policy
Last updated 27 August 2026
Two roles, and the difference matters. For the agencies who buy AgencyDash, we are the controller of their account data. For the information an agency stores about its own clients, the agency is the controller and we are a processor acting on its instructions. If you are an agency’s client and want your data corrected or removed, ask that agency first — they hold it, and they decide.
What we collect
Account information
Names, email addresses, hashed passwords, two-step verification settings, and the role a person holds. Every account on this platform requires a second factor, so we also record when a verification code was sent and whether it was accepted.
What agencies put in
Client records, contacts, tickets, projects and tasks, content drafts and approvals, contracts and signatures, invoices, time entries, uploaded files, and notes. We do not decide what goes in here; the agency does.
Operational records
An audit log of who did what and when, error reports, and records of what each piece of work cost us in third-party API calls. We keep these to run the service, investigate incidents, and bill accurately.
The marketing site
This site sets no advertising or analytics cookies. It stores one item in your browser — your light or dark theme preference — which never leaves your device.
Google account data
An agency may connect a Google account so that AgencyDash can show search and website performance alongside the rest of that client’s work. This section describes exactly what that connection does, because it is the part people most reasonably want to be sure about.
What we ask for
| Permission | What it lets us do | Why |
|---|---|---|
webmasters.readonly |
Read Search Console data. Read only — it cannot change anything. | To show which searches a site appears for, how often it is clicked, and where it ranks, next to the work being done about it. |
analytics.readonly |
Read Google Analytics reports. Read only. | To show visits and conversions, so search work can be connected to what it actually produced. |
What we do with it
- We read it, store the figures needed to draw a history, and show them to the agency and to the client that data belongs to. Nobody else.
- We do not sell it, and we never will. We do not use it for advertising, we do not use it to build profiles, and we do not use it to train machine-learning models.
- We do not share it with any other customer of AgencyDash. Every agency’s data is separated, and a connection made by one agency is readable only within that agency.
- Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How it is stored
The credential Google issues is encrypted with AES-256-GCM before it is written down, using a key held separately from the database. It is never written to logs, never shown in the interface, and never sent anywhere except to Google.
How to disconnect
Disconnect at any time from the agency’s settings, which deletes the stored credential. You can also revoke access directly from your own Google account permissions page, which takes effect immediately and without our involvement. Figures already stored are deleted along with the client record they belong to.
The WordPress plugin
An agency can install the AgencyDash plugin on a WordPress site it looks after, so that the site’s condition is visible without anybody logging in to it. This section is what that plugin sends, in full, because it runs on somebody else’s website and that is the part people most reasonably want to be sure about.
Nothing until it is connected
An installed plugin that has never been paired makes no request to us at all. It schedules nothing, records nothing, and sends nothing. Connecting it is a deliberate act by a site administrator, who is shown this same list on the plugin’s own settings screen before pasting a pairing code. Disconnecting stops it immediately and deletes the credential; deleting the plugin removes everything it stored.
What it sends
- Versions. WordPress, PHP, the database and the web server.
- What is installed. Plugins and themes, their version, whether each is active, whether an update is waiting, and whether auto-updates are on.
- Security settings. Whether the site address is HTTPS, whether debug mode is on, whether XML-RPC is enabled, whether file editing is allowed, and whether the uploads directory has an index file.
- Two counts. How many administrator accounts exist, and how many logins have failed in the last 24 hours.
- Events, with a timestamp and the IP address the site saw. Failed logins, including the username that was tried; administrators created or promoted; role changes; users deleted; plugins installed, activated, deactivated, updated or deleted; theme switches; core updates; and changes to the site or home address.
A failed login carries the username that was attempted because “somebody tried to sign
in as admin four hundred times” is the whole of the finding. No password
is sent, ever, and no successful login is reported.
What it never sends
No page, post or page-builder content. No customer, order, form or comment data. No email addresses. No passwords or password hashes, and no WordPress credentials of any kind. No file contents, no uploaded media and no database dumps. The plugin does not scan, alter, block or clean anything on the site — it reads a fixed list of values and reports them, and every judgement about what they mean is made here rather than there.
Who it goes to, and for how long
Only to the agency that manages the site, inside their own workspace, and to that agency’s client where the client has a portal login. It is not shared with any other AgencyDash customer, is not sold, and is not used to train machine-learning models. Reports and events are deleted along with the website record they belong to, and on the same schedule as everything else under How long we keep it.
The plugin’s full source is public in the WordPress Plugin Directory, which is the strongest form this promise can take: anybody can read exactly what it collects rather than taking our word for it.
Who else touches it
We use these providers to run the service. We do not sell data to anyone.
| Provider | What for |
|---|---|
| Amazon Web Services | Hosting, database and file storage (United States) |
| Stripe | Subscription billing. Card details go to Stripe, never to us. |
| Resend | Sending email — invitations, verification codes, contracts |
| Page speed measurement, and Search Console and Analytics where connected | |
| DataForSEO | Search ranking, site audits and backlink data |
| OpenAI | Drafting SEO recommendations and reading uploaded contracts |
| Sentry | Error reporting, so faults are found before they are reported |
How it is protected
- Encrypted in transit with TLS, and at rest using managed keys.
- Two-step verification is mandatory for every account. There is no way to sign in with a password alone.
- Permissions are checked on the server for every action, not merely hidden in the interface.
- An audit log records who did what. Where a member of our staff needs to view an agency’s workspace to resolve a problem, that access is read-only, time-limited and recorded.
How long we keep it
Account and client data is kept while the account is active. When an agency deletes a client, the record is scheduled for permanent deletion after a short grace period and then destroyed, including uploaded files. Audit and billing records are kept longer where we are required to. Deleting your account removes your personal details from active systems; backups age out on their own schedule.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to some processing. Write to us and we will act on it. If you are an agency’s client, ask that agency first — they control the record and can usually act immediately.
Children
AgencyDash is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16.
Changes
We will update the date at the top when this changes. If a change materially affects how we handle personal information, we will tell account holders directly rather than relying on you to re-read this page.
Contact
Questions about this policy, or a request about your data: privacy@agencydash.cloud.