TurnStoneX

Privacy policy

Last updated: October 18, 2026

This policy explains what data the TurnStoneX marketing platform ("TurnStoneX", "we") collects, how we use it, where it is stored and how to have it deleted. It applies to the TurnStoneX web application and its background services.

1. Who uses TurnStoneX

TurnStoneX is operated by the TurnStoneX team for its clients (small businesses and nonprofits). People who sign in are TurnStoneX staff and the client's own users. A user can see a client's data only when they have been given access to that client.

2. Account data

  • Your email address, your name if you give it, and your password (stored only as a salted hash by our authentication provider, Supabase Auth).
  • Your organisation and client memberships and your role.
  • A record of the actions you take in the platform (for example approvals, changes to settings and connections), kept as an audit trail for security and accountability.
  • A session cookie that keeps you signed in. We do not use advertising cookies or third-party analytics on the application.

3. Google user data

When a client's authorised user connects a Google account, TurnStoneX requests only these permissions (OAuth scopes), and only for the products the user chooses to connect:

  • Google Analytics (analytics.readonly, read-only): the list of Analytics properties and web data streams, the property's key events, and daily reports of sessions, users, new users, engaged sessions and key events by date, channel, source/medium, landing page, country and device, plus daily event counts by event name. We use it to measure the client's website traffic, check that conversion tracking works and report progress.
  • Google Search Console (webmasters): the list of verified sites; search performance (clicks, impressions, click-through rate and position by date, query, page, country and device); URL inspection results; and, only when a person approves the action in TurnStoneX, submitting the site's sitemap. We use it to find search opportunities, track rankings and measure the effect of changes. We request the read-and-write scope only so that approved sitemap submissions can run; we do not change any other Search Console setting.
  • Google Merchant Center (content), only when a user chooses "Connect Merchant Center" for a client: the list of Merchant Center accounts the Google account can open, and each product's status (approved or disapproved, and the issues Google reports for it). We use it to report product data problems that stop free shopping listings. We only read; we do not change products, feeds or account settings.
  • Your Google account email (openid, email): to show which Google account a connection uses.
  • YouTube (youtube.readonly, yt-analytics.readonly, youtube), only when a client connects its YouTube channel: the channel's and its videos' statistics (views, likes, comments, subscribers and daily analytics), and, once a person approves a post in TurnStoneX, publishing or updating the client's own videos on the client's behalf (title, description and the release of an existing upload). It is used only for that client's own channel. The connection can be revoked at any time in the portal or at myaccount.google.com/permissions.

Google user data is used only to provide and improve the features the client uses in TurnStoneX. We do not:

  • sell it, rent it or share it with advertisers, data brokers or information resellers;
  • use it for advertising, including personalised or retargeted ads;
  • use it to train or improve general-purpose artificial-intelligence or machine-learning models;
  • use it to determine credit-worthiness or for lending purposes.

People at TurnStoneX read Google user data only to deliver the service the client asked for (for example reviewing a client's report with them), with the client's permission, for security or abuse investigations, to comply with the law, or in aggregated, anonymised form for internal operations.

TurnStoneX's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Website and public data

TurnStoneX crawls the client's public website (and the public websites of competitors the client names) the way a search engine does, checks public search results for the client's keywords, and sends public page addresses to Google PageSpeed Insights and, when the client sets it up, to IndexNow.

5. AI processing

Some features use an AI model from Anthropic (the Claude API) to draft recommendations, page titles and descriptions and to run the marketing assistant. For these, TurnStoneX sends the minimum client data the task needs, which can include figures and search queries derived from the client's Google Analytics and Search Console data and text from the client's public website. Data sent to the Anthropic API is not used to train Anthropic's models under Anthropic's commercial terms. AI output is a draft: changes to a client's website or accounts follow the client's approval rules.

6. Where data is stored and how it is protected

  • The database (Supabase, PostgreSQL) is hosted in the United States (AWS us-east-2). The web application is hosted by Vercel.
  • Google OAuth tokens and other connection credentials are encrypted at rest with AES-256-GCM and are never shown in the browser or sent to the AI model.
  • Data is transferred over HTTPS. Database access is limited by row-level security, so each user can only read clients they belong to.

7. Subprocessors

  • Supabase: database and user authentication.
  • Vercel: hosting of the web application.
  • Anthropic: AI model (Claude API), as described in section 5.
  • Brevo: sending account and notification emails (your email address and the message).
  • DataForSEO: checking public search results for tracked keywords (the keyword text and location only).
  • Google: the Google APIs above, and PageSpeed Insights for public page addresses.

We do not sell or share personal data with anyone else, except where the law requires it.

8. Retention and deletion

  • We keep account and client data while the client uses TurnStoneX.
  • Disconnecting a Google connection in TurnStoneX deletes its stored tokens and revokes the grant with Google. You can also remove access at any time at myaccount.google.com/permissions.
  • To delete your account, or a client's data including data imported from Google, email sales@turnstonex.com. We delete it within 30 days, except records we must keep by law. Database backups roll over and are not restored to recover deleted data.

9. Children

TurnStoneX is a business service and is not directed to children under 13.

10. Changes and contact

We will post changes on this page and update the date above. Questions or requests: sales@turnstonex.com.