Beacon

Privacy policy

Last updated 15 November 2026. Draft pending legal review before launch.

This policy explains what information Beacon (“we”, “us”) collects when you use our marketing intelligence service, how we use it, and the choices you have. Beacon is operated from Australia by [legal entity name, ABN] and is designed for trade and home-service businesses. We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles, and we apply the same standards to customers elsewhere.

Information we collect

  • Account information: your name, email address and password hash when you create an account, and the business details you enter for your organisation (name, trade, timezone, currency, country).
  • Google user data (only if you connect Google Ads): the email address and identifier of the Google account you authorise, and read-only Google Ads reporting data for the advertising accounts you choose to track: account names, currency and timezone; campaign names, status, type and budgets; and daily performance metrics such as impressions, clicks, cost and conversions, including conversion action names and categories.
  • Lead information you provide (future feature): enquiries you record or import, such as a customer's name, contact details and the status of the enquiry.
  • Usage and technical data: sign-in events, actions taken in the product (kept in an audit log for your organisation), and standard web server logs including IP address and browser type, used for security and reliability.

How we use Google user data

We use Google user data solely to provide the features you see in Beacon for your own business: displaying your campaign performance, computing derived metrics (for example cost per conversion), attributing your enquiries to campaigns, and generating written analysis of your own data. Specifically:

  • We request the Google Ads read-only scope (https://www.googleapis.com/auth/adwords) and basic identity (email). We never request permission to edit campaigns, budgets, bids, keywords or any other Google Ads setting, and the software contains no code that can do so.
  • We do not sell Google user data, use it to serve advertisements, or use it to build profiles of individuals.
  • We do not share Google user data with third parties except service providers who host and operate Beacon on our behalf under confidentiality obligations (listed below), or where the law requires.
  • Humans at Beacon do not read your Google user data except with your explicit permission to resolve a support request, for security investigations, or to comply with the law.
  • Where we use artificial-intelligence models to generate written insights, the model receives only aggregated metrics from your own organisation, the output is checked against those metrics before it is shown, and the data is not used to train the models.

Beacon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we store and protect data

  • Data is stored in a managed PostgreSQL database hosted in Sydney, Australia, with encryption at rest and in transit.
  • Each customer organisation's data is isolated with database-level access controls (row-level security) that are tested on every release.
  • Google OAuth refresh tokens are encrypted with AES-256-GCM before storage; the decryption key is held only by our application servers, and tokens are never shown to users or staff.
  • Access within your organisation is controlled by roles (owner, admin, member, viewer) that you manage.

Retention and deletion

  • You can disconnect Google Ads at any time in Settings → Connections. We then revoke our access with Google and permanently delete the stored token. Previously synced reporting data remains available to your organisation until an owner removes the advertising account, which deletes that data.
  • You can also remove Beacon's access from your Google Account's third-party connections page.
  • Deleting your organisation deletes its data within 30 days of the request, except where we must keep records to meet legal obligations. Backups are rotated within a further 30 days.
  • Audit and security logs are kept for 12 months.

Service providers

We use the following providers to operate Beacon; each processes data only on our instructions:

  • Supabase (database, authentication; Sydney region)
  • Vercel (application hosting and delivery)
  • Anthropic (AI analysis of aggregated metrics, when enabled)
  • An email delivery provider for account and alert emails
  • An error-monitoring provider that receives technical diagnostics without your Google data

Your rights and choices

You can access and correct your account information in the product, export your reporting data, disconnect advertising accounts, and delete your organisation. You may also ask us to access, correct or delete your personal information, or complain about how we have handled it, by contacting us below. If you are in the European Economic Area or the United Kingdom you have additional rights under the GDPR, including data portability and the right to lodge a complaint with a supervisory authority.

Children

Beacon is a business tool and is not directed at children under 16. We do not knowingly collect their information.

Changes

We will post changes to this policy here and, for material changes, notify organisation owners by email before they take effect.

Contact

Privacy enquiries: [privacy contact email] · [postal address]. See also our terms of service.