Security and data
Last updated: 5 November 2026
This page is for the person who has to approve Goppa at an agency or a company: where the service runs, where your data lives, who processes it, how long we keep it and how to remove it. It says only what is true today, and it says what we do not have. The legal terms are in the Privacy Policy.
1. Where it runs and where the data lives
- The application runs as a serverless function on Vercel, in the São Paulo region (gru1).
- The database and the sign-in run on Supabase, in São Paulo, Brazil (AWS region sa-east-1). That is outside the European Economic Area.
- Traffic between your browser, the plugin and Goppa goes over HTTPS.
2. What we keep, and for how long
The full list is in section 3 of the Privacy Policy. The main items:
| Data | Kept |
|---|---|
| Email address and account identifier | Until you delete the account |
| Sites you add, their reports and AI visibility measurements | Until you delete them or the account; free-plan reports may expire earlier |
| Agent activity reported by the WordPress plugin | Until you delete the site or the account |
| Free check on the website: the site, your email address and the result | 12 months, or until you ask us to delete it. An account we created for you that you never sign in to and never pay for is deleted after 30 days |
| Leads from an agency's audit widget | Until the agency deletes the lead or its account. The agency is the controller of this data; we process it on the agency's behalf |
| Requests to book a call, to get a city report, or to be introduced to an agency | 12 months |
| Calls made by your AI assistant to your account (account, assistant, tool, time taken and result; never your conversation, the arguments or your tokens) | 180 days |
| Billing details | With Paddle, as it and tax law require. We never see or store card numbers |
3. Who processes the data
These are the services our servers call. We send each one only what the task needs, and we do not sell data.
| Service | What it does for Goppa |
|---|---|
| Vercel | Runs the application, and counts page views in aggregate, with no cookie and without identifying anyone |
| Supabase | The database and the sign-in |
| Paddle | Subscription payments and tax compliance. Paddle is the merchant of record and the seller on your invoice |
| Resend | Sends our emails: check results, sign-in links and reports. It receives the recipient's email address and the content of the email |
| OpenAI | Answers the buying questions we ask ChatGPT for the visibility measurement, and writes text for you (SEO fixes, category guides, replies to your messages). It receives the question, your domain and the public page fields the text is about, never customer data |
| DataForSEO | Collects the answers of ChatGPT, Google AI Overview, Google AI Mode, Gemini and Perplexity for the measurement and, on plans with SEO, your Google positions, keyword research, competitors and links. It receives your domain, your country and the questions or keywords, never customer data |
| Meta (WhatsApp Business Platform) | Carries the WhatsApp messages between a person and us, only when that person replies to us there |
| Microsoft Clarity | Records clicks and scrolling on our website, with what you type masked. Only if you accept it in our notice |
Three more services start only when you connect them yourself: Google Search Console (read-only), Bing Webmaster Tools and Cloudflare. An AI assistant you connect (for example ChatGPT or Claude) is not our processor: it handles what you ask it under your own agreement with its provider.
4. How secrets are stored
- Credentials you give us: the Google Search Console access, the Bing key and the Cloudflare API token are stored encrypted. The key that opens them is kept in the server's environment, not in the database. If that key is missing, we do not save the credential at all rather than save it in clear text.
- Tokens we issue: the access tokens of your AI assistants, the reporting keys and the install keys of an agency are random and stored only as a hash, so we cannot read them back. A key is shown once, when you create it.
- The connection of a WordPress site uses a one-time code that lasts 10 minutes. The site's token never travels in a web address.
- Sign-in is handled by Supabase Auth.
- This page describes how secrets are stored and never contains one.
5. How to delete a site or your account
- A site: in Goppa, go to Settings and use Remove site, then type the site's domain to confirm. It removes the site with its scans, SEO data, plugin data and stored credentials, and it disconnects Search Console at Google when no other site of yours uses it. The AI measurements of that site stay in your account, where they count toward your plan's measurements, and their public report links stop working.
- Your account: in Settings, use Delete account and type your email address. It removes your sites, reports, measurements, agent activity, Google SEO data, connected AI apps and your sign-in. Your billing history stays with Paddle, as tax law requires. If you have a paid plan, cancel it first; if other people share the account, write to privacy@trygoppa.com and we will close it.
- For anything else, such as data from the free check, write to privacy@trygoppa.com. We answer within 30 days.
6. What your AI assistants can reach
You can connect your Goppa account to an AI assistant that supports MCP. It is optional, and it starts only when you sign in to Goppa from the assistant and approve access. How it works.
- The access is named
goppa.readand covers your own organization's Goppa data only. It cannot reach any other account. - The assistant can read your plan, sites, AI visibility measurements, site checks, Google SEO data and next steps.
- Four actions save something to your Goppa account: running a site check, adding a site within your plan, starting an AI measurement after you agree to its questions, and recording which approved SEO fixes were applied. The connection never changes your website.
- It cannot change your settings, approve fixes, remove anything or reach any other part of Goppa.
- Access lasts one hour and renews for up to 60 days while in use. You can disconnect at any time in Settings, under Connected AI apps, and the tokens stop working at once.
7. What we do not have
We do not have a SOC 2 report or an ISO 27001 certificate, and we do not offer single sign-on (SSO).
To report a security problem, write to contact@trygoppa.com with the address and the steps to reproduce it. Our security.txt has the same contact. We do not run a paid bug bounty program. For questions about your data, write to privacy@trygoppa.com.