Privacy Policy
Last updated: 14 October 2026
OWNLYTIX ("we", "us") is operated by Zulqarnain Jabbar, a sole proprietor based in Multan, Pakistan. This policy explains what data we collect when you use ownlytix.com, app.ownlytix.com and our mobile apps, why, and the choices you have. Contact: privacy@ownlytix.com.
1. Who this applies to
- Users: freelancers and agencies who create an OWNLYTIX account.
- Report viewers: people who open a report link a user shares with them.
- Visitors: people browsing ownlytix.com.
For data about their own clients' websites, our users decide what to connect and share; we process that data on their behalf to provide the service. In privacy-law terms, we are the controller of account, billing, security and anti-abuse data, and a processor for the client website data our users put into their reports.
2. Data we collect
| Data | Where it comes from | Why we use it |
|---|---|---|
| Name, email, profile photo | Google sign-in | Create and secure your account |
| Google Search Console data (clicks, impressions, positions, pages, queries, countries, devices, index and sitemap status) | Google, with your permission, read-only | Build your reports, insights, health checks and alerts |
| WhatsApp number | You | Verify your account once and prevent abuse |
| Agency details, logos, colors, client names and emails, notes, captions | You | Brand and send your reports |
| Voice recordings | You, only when you record | Play your explanation to your client |
| Numbers, screenshots and CSV files you upload (e.g. Ahrefs, Semrush, Screaming Frog) | You | Show them in your reports and health checks |
| Payment details | Paddle or Lemon Squeezy, Apple or Google, or for JazzCash/Easypaisa: your screenshot, transaction ID and the sending number we see in our wallet app | Process purchases and refunds (wallet refunds go back to the sending number). We never see or store full card numbers. |
| Referral code use, Facebook post links | You | Give referral and post rewards |
| Report link opens (time and count of page loads; we don't use cookies or identify viewers) | Report viewers' browsers | Tell you when your report link was opened |
| Protected anti-repeat codes (a keyed fingerprint of your phone number, Google account ID and Gmail address) | Created by us from your phone and Google sign-in | Stop the same person collecting welcome credits, a free first report or a referral reward twice. This is still personal data, not anonymous |
| Support access permissions you give | You | Let support look at a specific report or site to help you, for 7 days |
| Email delivery status (sent, delivered, bounced) | Our email provider | Make sure report emails reach your clients and tell you if they bounce |
| A protected code of your internet (IP) address at sign-up and verification | Your browser's connection | Spot many accounts created from one place, so free credits can be checked before they're given. Never stored as the real address; deleted after 90 days |
| Usage and device data (pages used, errors, browser, approximate country) | Your browser or app | Keep the service working, fix bugs, improve features |
| Feedback and support messages | You | Answer you and improve OWNLYTIX |
| Answers to optional questions (where your clients are, how many sites you report on, how long reports took by hand, check-in ratings) | You | Improve OWNLYTIX and show you the time you save |
We do not use your data or your clients' data for advertising, and we do not sell it.
Purposes and legal bases
| Purpose | Data | Proposed basis |
|---|---|---|
| Providing the service you sign up for | Account, Search Console, report, upload, voice data | Contract |
| Payments, tax and accounting records | Purchase and refund records | Legal obligation / contract |
| Preventing abuse of free credits | Anti-repeat codes, phone verification | Legitimate interests |
| Security, error tracking, audit logs | Usage and device data, logs | Legitimate interests |
| Product statistics (cookieless, no identifiers) | Funnel events | Legitimate interests, subject to the storage/access assessment in the Cookie Notice |
| Optional emails (digest, reminders) | Email address, preferences | Legitimate interests with easy opt-out / consent where required |
3. Google user data and Limited Use
OWNLYTIX asks only for read-only access to Google Search Console. We use this data only to provide and improve the features you see in OWNLYTIX: your reports, insights, health checks and alerts. OWNLYTIX's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to others except as needed to provide the service, for security, to comply with law, or as part of a merger or sale with your prior consent. We never use it for advertising or sell it to data brokers. People at OWNLYTIX look at it only with your permission (you switch on support access for a specific report or site, for 7 days), for security or abuse investigations, or to comply with law; each look, and the reason for it, is logged. We don't send Google user data to our analytics or error-tracking tools. You can disconnect Google at any time in Settings or at your Google Account's permissions page.
4. Report links
Reports you share are reachable by anyone with the link, which is long and hard to guess, hidden from search engines, and expires after 30 days unless you extend it. You can turn off a link at any time; it stops working at once, but copies a viewer already downloaded (such as a PDF) can't be recalled. Edits you make after sending appear on the link only when you publish them. Viewers don't need an account; we record only when a link is opened.
5. Who we share data with
We use these service providers to run OWNLYTIX, each only for the purpose listed:
| Provider | Purpose |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Hosting |
| Sign-in and Search Console, PageSpeed and Chrome UX Report data | |
| Ahrefs | Domain Rating of connected websites (we send the domain name only) |
| Domain registries (RDAP) | Website registration date (we send the domain name only) |
| Twilio | WhatsApp verification codes |
| Paddle or Lemon Squeezy; Apple and Google; RevenueCat | Payments and in-app purchases |
| Resend | Emails |
| Sentry | Error tracking |
| PostHog | Cookieless website and app usage statistics |
These providers may store data outside Pakistan, including in Singapore, the European Union and the United States (database, sign-in and files: Singapore; error tracking and usage statistics: European Union; other providers: in the regions named in each provider's data processing terms). We use each provider under its standard data processing agreement, including the standard contractual clauses or similar transfer safeguards each provider offers for international transfers. We may also disclose data if required by law.
6. How long we keep data
- Account data, reports and history: while your account is open.
- Report links: 30 days by default, or as long as you extend or keep them live.
- Raw CSV uploads: deleted after 30 days; the extracted numbers stay with your reports.
- After you delete your account: data and files are deleted within 24 hours, except purchase and refund records we keep for 6 years for tax and accounting, admin audit logs we keep for 2 years for security, and backups that roll off within 7 days.
- Anti-repeat codes: we keep a keyed pseudonymous identifier made from your phone number, Google account ID and Gmail address to prevent repeated promotional rewards (welcome credits, the free first report and referral rewards). It is still personal data and is not anonymous. It is protected by a secret key kept only on our servers and used only for anti-abuse checks, and deleted 2 years after it was created.
- Waitlist emails: until you join, ask us to remove you, or 12 months after the beta ends, whichever comes first.
- Provider logs (email delivery, error reports): kept by those providers for up to 90 days.
- Payment webhook details: 90 days (the purchase record itself follows the 6-year rule).
- Protected internet-address codes: 90 days.
7. Your rights
Wherever you live, you can ask us to access, export, correct or delete your data, to stop a particular use of it, or to complain about how we handle it. Most of this is available directly in Settings: "Disconnect" (stops updates and deletes stored Search Console data for a site; reports you already sent keep working), "Delete site" (removes the site, its reports and links) and "Delete my account and data". For anything else, email privacy@ownlytix.com and we will reply within 30 days. We may ask you to confirm your identity first. OWNLYTIX is run from Pakistan for freelancers and agencies and does not specifically target people in the EU or UK; if that changes, we will update this policy, including appointing a representative where the law requires it. If you are in the UK or EU, you can also complain to your local data protection authority.
8. Security
Data is encrypted in transit; Google access tokens are encrypted at rest; each user's data is separated at the database level; staff access is limited and logged. No system is perfectly secure, and if a breach is likely to affect your data, we will tell affected users without undue delay (and within 72 hours of confirming it where we can), explain what happened and what we are doing, and notify any authority where the law requires it.
9. Children
OWNLYTIX is for businesses and is not meant for anyone under 18.
10. Changes
If we change how we use data, we will update this page, change the date above, and notify users by email or in the app before the change takes effect; new uses of Google data require your consent first.