Privacy notice

Who operates Maple Orbit

Maple Orbit is operated by Vamoson Inc..

This notice covers the public website, Google-sign-in browser app, and the connector service that connects Google Search Console with your chosen AI assistant, including ChatGPT or Claude. Google, Auth0, OpenAI and Anthropic also have their own policies for the services you use directly.

Information we handle

• Sign-in information. Auth0 handles your Maple Orbit login and may process profile details such as your email address. Our service uses the verified account identifier to keep customer connections separate.
• Google authorisation. After your consent, we store Google access and refresh credentials so we can request reports without asking you to authorise every request. We do not receive your Google password.
• Property and report data. We can list Search Console properties accessible to your connected Google account. You choose a property for reports. Report requests can include clicks, impressions, click-through rate, average position, queries, pages, countries, devices and dates.
• Account and setup records. We keep your selected property, trial start and end times, and short-lived records needed to complete sign-in securely.
• Support and operational information. If you contact us, we receive what you include in your message. Our hosting and authentication providers may process connection details, IP addresses and security logs as part of operating their services.

Early-access requests

If you submit the early-access form, we collect your email address and any name, public website URL or note you choose to include, along with the request time and your permission to receive emails about that request. We use these details to review pilot requests and respond about access. This does not subscribe you to marketing, authorise Google access, create an account or start a trial.

Requests are stored encrypted on our Render service in the United States, separately from Google connection records. Authorised operators review them; submissions do not currently trigger an automatic email. Requests older than 90 days are deleted during subsequent request submissions or operator review. You can request earlier deletion using the privacy contact below. Short-lived hashed submission identifiers and timestamps help limit repeated requests; we do not store your IP address in this request database.

Browser app and Google sign-in

The browser app requests Google OpenID and email permissions to verify your Google account identifier and verified email, together with read-only Search Console permission. We store the verified Google identifier and email with encrypted browser-session records. Essential Secure, HttpOnly cookies protect sign-in and your session. Sessions expire after 12 hours; sign out to end a session sooner. Temporary encrypted sign-in records expire after ten minutes.

Browser and connector identities are separate in this release. We do not merge accounts by email. Browser credentials and records are stored encrypted in a separate database on the same Render persistent disk in the United States. Disconnecting or revoking the Google grant may affect other Maple Orbit connections using the same Google account.

Report results may be cached, encrypted and bound to your account, for five minutes to reduce repeated requests. Expired cache records are removed during subsequent cache activity. If you choose Save report, we retain a bounded report snapshot. Journal entries retain the title, date, note, URL and property you enter. You can keep up to 50 records of each type and delete them individually. These records remain until you delete them, remove browser app data, or request account deletion. Do not enter passwords or confidential information in notes or questions.

Settings → Delete browser app data removes browser Google credentials, browser sessions, cached reports, saved reports and journal entries. A minimal hashed account key and trial timing remain to prevent trial resets; these and operational usage counters currently require administrative cleanup. Contact us to request full deletion or discuss retention. This action does not remove connector records or conversations in your AI assistant.

Ask Orbit and OpenAI

Ask Orbit is optional and unavailable until configured by the operator. Before each question, you must confirm that your question, recent conversation context and a bounded subset of the selected property’s report data may be sent to OpenAI through its API. This may include your property URL, query text, landing-page URLs, dates, filters and metrics. Google credentials, session tokens and your profile email are not included in these prompts. Ask Orbit cannot fetch website content, competitor research or sales data.

The API request uses store: false to disable Responses application-state storage. This is not a guarantee of zero provider retention: OpenAI may retain data for abuse monitoring or other purposes under its API policies. We do not persist Ask Orbit conversations in our database; they remain in the open page’s memory. You can decline to use Ask Orbit and continue using reports. AI answers may be incorrect or incomplete.

How information is used

We use the connection to provide the Search Console reports you request, maintain your selected property, enforce the pilot trial and protect access to the service. We do not use Google user data for advertising, sell it, or use it to train our own AI models.

Reports are returned to the AI assistant you choose. When you request a report through the connector in ChatGPT, results are sent to ChatGPT and handled under your OpenAI account settings and OpenAI’s policies. When you request a report through the connector in Claude, results are sent to Claude and handled under your Anthropic account settings and Anthropic’s policies. Google report data is transferred to your chosen AI assistant only to provide the user-requested feature. Google credentials are not included in tool results. Avoid sharing sensitive reports in conversations accessible to other people.

Our Google data handling is subject to the Google API Services User Data Policy, including applicable Limited Use requirements. Any new use of your Google data would need an updated disclosure and any consent required before that use begins.

Service providers and location

The pilot uses Google for Search Console data, Auth0 for sign-in, Render for hosting, and OpenAI/ChatGPT or Anthropic/Claude to receive requested connector reports and provide the conversational interface you choose. The separate optional browser Ask Orbit feature uses OpenAI as described above. See OpenAI’s privacy policy and Anthropic’s privacy policy.

The current Render pilot is hosted in the United States. Our providers may process or retain information outside Canada, where it may be subject to local laws and lawful access by authorities. This is not a Canada-only data-residency service.

These public pages do not include advertising or analytics scripts. Connection flows use essential browser cookies and temporary state to protect sign-in; authentication providers may set their own cookies.

Storage, security and retention

Saved Google credentials are encrypted at rest in the application's database. Credential encryption keys are kept separately from that database. HTTPS protects data in transit. No security measure eliminates every risk.

The connector does not maintain a historical report database. Browser reports have the cache and user-saved snapshot retention described above. Connector results may remain in your chosen AI assistant’s conversations. Google keeps the underlying Search Console data according to its own practices.

Disconnecting Google removes our saved Google connection and pending setup links. Trial records remain so disconnecting and reconnecting does not restart the trial. Account and trial records currently remain until account deletion or administrative cleanup; an automatic retention timetable is not yet in place for this pilot. Service providers may separately retain backup or security records under their policies.

Your choices and requests

• Disconnect Google: ask Maple Orbit in your AI assistant to disconnect your Google account. It removes the local connection and attempts to revoke the Google grant. If revocation is not confirmed, remove the app's access directly in your Google Account connections.
• Manage conversations: deleting a connection does not delete previous ChatGPT or Claude conversations. Use your AI assistant’s conversation controls to manage them.
• Ask for account deletion, access or correction: use the privacy contact below. Deletion of your Maple Orbit account is a separate request from disconnecting Google. We may need to verify your identity and explain any information that must be retained.

Privacy contact

If the way we handle data changes, we will update this notice and explain material changes before relying on a new use of your information.

Account preferences and local help

Your display name, date and CSV formats, chart direction and default report filters are stored encrypted with your browser account. They are removed when you delete browser app data. Your Google sign-in email remains managed through Google; display names do not change verified identity.

The support assistant matches questions against fixed help topics locally. It does not send its conversation to our server or an AI provider, store it across page loads, access Google credentials or inspect reports. Do not enter sensitive data. Its email link opens your mail app; no support message is sent automatically. Only essential sign-in cookies are used; no optional analytics or advertising cookies are currently installed.