Reporting app privacy

Effective 14 October 2026. This disclosure covers AFVA SEO Reporting. It is separate from the privacy arrangements for AFVA's public website contact form. AFVA's authorised read-only Google Search Console and Analytics connections are working through its local collector; reporting completeness depends on each source's available data. The proposed hosted mode would collect authorised data and generate weekly and monthly reports using reporting rules, without automatic AI analysis. It would be connected and activated only after the owner's approval.

Who operates the app

Access Food Verification & Auditing Limited operates AFVA SEO Reporting for its own business reporting. For questions, access requests or deletion requests, email AFVA at info@foodverification.co.nz.

Data accessed

Search Console: the authorised website property and its search clicks, impressions, click-through rate, average position, search queries, pages, countries, devices and reporting dates.
Google Analytics: the authorised property and reporting time zone, aggregate traffic, channels, landing pages, locations, devices, event counts and key-event metrics, together with data-quality information returned by Google.
Connection details: app client configuration and authorisation tokens needed to make the permitted API requests. This hosted mode would not use ChatGPT/Codex account authentication.
Optional business evidence: AFVA's own aggregate enquiry records and separately sourced official exports, when supplied for the reporting task.

The app does not request Gmail messages, contacts or individual contact-form message bodies. Personal form values are not needed for the intended analytics reports.

How data is used

Data is used to provide AFVA's dashboard, weekly and monthly reports, trend explanations and action register. Report limitations are retained so that missing, provisional or restricted data is not presented as a measured result.

The workflow does not sell Google API data, use it to target advertising, or publish the owner's private reports. AFVA will use relevant Google API data only for the reporting features described here and in accordance with the Google API Services User Data Policy and its Limited Use requirements

Storage and security

The current local collector stores its client configuration and Google authorisation tokens in a Windows vault encrypted for the current Windows user. These local connections remain in place during the transition. Credentials are kept outside the public website and reporting archive.

If the proposed hosted mode is approved and activated, the server reporting process would keep its Google credentials in encrypted private storage outside the public website document root. It would not store ChatGPT/Codex account credentials or an account authorisation cache on the hosting account. Hosting administrators with the relevant server access may be able to access the private Google credential store.

Report evidence and generated documents are separate files. They may be kept locally, in AFVA's private Dropbox folders and in a private SEO Reports area on AFVA's website hosting account. The website-admin archive contains the reporting snapshot, dashboard, written report and priorities for each saved weekly or monthly version. The report files are stored outside the public website document root and are accessible through an authenticated AFVA website-admin login. The local credential vault does not encrypt these report files. Access is controlled through the owner's computer, Dropbox permissions and website-admin authentication.

Authorisation tokens and app secrets are excluded from report bundles and the website-admin report archive. Opening a saved report does not trigger a Google request. Once approved and activated, hosted weekly and monthly generation could use the authorised read-only Google connections while the owner's computer is off and no website administrator is logged in. Reports and priorities would be generated from collected data using defined reporting rules. This mode would not send data to OpenAI automatically, use a ChatGPT/Codex account allowance or require a separate OpenAI API account. Viewing reports would still require an active AFVA website-admin login. Source availability, hosting limits or expired Google authorisation may prevent a scheduled delivery; missing data and delivery status would be reported. The archive excludes individual contact-form values, message bodies and personal enquiry records. The reporting bundle excludes Google Business Profile API content and derived metrics.

Credentials are retained while the connection is needed. Reporting records are retained for AFVA's ongoing business reporting until the owner removes records that are no longer needed. No fixed archive deletion period has been configured. Existing backup, version-history and provider retention settings may affect how deletion of a copy is completed.

Google provides the authorised source data. Dropbox may receive report files for AFVA's private archive. AFVA's website hosting provider stores and processes the private report archive so authenticated website administrators can view reports and their history. In the proposed hosted mode, the provider would also host the collection and report-generation process and the private Google credential store described above. At the owner's separate request, selected aggregate reporting data may be supplied in the owner's existing Codex/ChatGPT account, provided by OpenAI, for additional analysis and actions. This optional review is separate from automatic hosted generation and is subject to that account's terms and usage limits. These uses support the reporting feature authorised by AFVA.

The reporting data supplied to Codex excludes Google authorisation tokens, app secrets, individual contact-form values, message bodies and personal enquiry records. The hosted mode does not keep OpenAI account authorisation or send reporting data for unattended AI processing. Provider processing and retention follow the applicable service terms and the owner's account settings; this page does not claim a particular retention period or account setting has been verified.

The owner and specifically authorised reviewers can read the reports for AFVA's business purposes. The private website-admin archive is available to users with an active AFVA website-admin login. There is no public report-sharing feature. AFVA uses report data for its own reporting features, not to develop or train a general-purpose AI model.

Your choices and deletion

The account owner can stop collection by disabling scheduled collection or revoking the app's connection in Google Account third-party connections. If hosted mode is activated, its server schedule and account authorisations can also be disabled, and its private Google credential store removed. Logging out of the AFVA website admin alone would not stop server generation. Revocation does not itself delete copies already saved locally, in Dropbox, in AFVA's private website-admin archive or through Codex.

To remove saved copies, the owner can delete the relevant local reports, Dropbox records and chats, and ask AFVA to remove the relevant records from the private website-admin archive and, if activated, the hosted reporting process through the contact email above. Existing backup, version-history and provider retention settings may affect deletion of other copies. Disconnecting the app does not delete the original data held in Search Console or Analytics.

Future Business Profile access

Direct Google Business Profile access is not part of the currently connected reporting scope. A future integration would use a separate live view: API responses and derived metrics would not be stored in the permanent report archive. Official exports downloaded by the owner would be labelled separately. The disclosure and permission request will be updated before any additional Google data is accessed.