Who we are
Umbrella Technologies Pty Ltd (ABN 15 701 061 243), Osborne Park, Perth WA 6017, runs Umbrella Connect. In this notice "Umbrella Tech", "we" and "us" mean that company. The Google consent screen shows our app name as "Umbrella Technologies". For privacy questions or requests, email privacy@umbrellatech.com.au. For support, email support@umbrellatech.com.au. You can also call 1800 262 262.
What Google user data we access
We only access Google user data after you approve it on Google's consent screen. We request these scopes and no others.
| Scope | What we can access | Why we need it |
|---|---|---|
| openid and email | The ID and email address of the Google account that connects | To identify which Google account made the connection and to show it to you and our staff |
| webmasters.readonly | Read-only access to Google Search Console: the sites you share, search performance (queries, pages, clicks, impressions, click-through rate and position) and sitemap status | To report how your website performs in Google Search and to find ways to improve it |
| analytics.readonly | Read-only access to Google Analytics: the properties you share and reports such as sessions, users and key events by landing page and channel | To show which pages bring visitors who take action, beside the Search Console figures |
| adwords | Google Ads: we only read and report on campaign details and performance. We do not change anything in your Google Ads account | To include your Google Ads results in reporting. This feature starts only after Google approves our access to the Google Ads API |
| tagmanager.edit.containers | Google Tag Manager: read your container, and create and edit tags, triggers and variables in it. We never publish a container and never create container versions. You publish | To set up the tags and tracking that you ask us to add to your website |
How we get access
1. A member of our staff creates an invitation for you in the Umbrella Connect staff console. 2. You open the link we email you. The link works once and expires after 7 days. 3. Google shows its consent screen. It lists each scope above. 4. You choose which of your own sites, analytics properties, Tag Manager containers and Ads accounts to share. We can only reach the ones you choose. 5. Our staff check that what you chose matches your business, and approve it. 6. Only then does the product, such as SiteBeacon, show you data from those resources.
We use Google's OAuth process. We never see your Google password. We receive a refresh token, which lets us keep reading the resources you chose until you revoke access. Products such as SiteBeacon never receive that token. They ask Umbrella Connect to make each request for them.
How we store it
- Refresh tokens are encrypted before we store them in a database on Cloudflare in our own account. Short-lived access tokens are kept briefly in memory and are not stored.
- Connection records hold the connected Google account's ID and email, which resources you chose, the scopes granted and when. They are kept until the connection ends.
- Google data such as Search Console figures passes through Umbrella Connect to the product. Umbrella Connect does not keep it. The product that uses it, such as SiteBeacon, stores the figures it needs to serve you in Cloudflare services in our account. See the SiteBeacon privacy notice.
- Activity records (who did what, and when, without tokens or Google data) are kept for 24 months.
- Who can access it: a small number of authorised Umbrella staff. Staff sign in to the staff console through Cloudflare Access with Microsoft Entra single sign-on and multi-factor authentication. Approving a connection also needs a passkey.
How we use it
We use Google user data only to provide and improve the features you can see in the product you connected, such as reporting, analysis, recommendations and the setup of tags you asked for. We do not use it for any other purpose.
AI features and keyword data
SiteBeacon has AI features. When one is used, the request can include figures from your connected Search Console data, such as top search queries and pages with their clicks, impressions and positions. SiteBeacon can also send keyword phrases, which may come from your Search Console queries, and a location to DataForSEO to get search volume and difficulty figures. We send this data only to produce the result the user asked for.
Requests to AI models go through Cloudflare AI Gateway to the models we use, currently Anthropic's Claude models, with a Cloudflare Workers AI model as a fallback. These providers are listed on our sub-processors page. The SiteBeacon privacy notice explains exactly what is sent.
What we do not do
- We do not sell Google user data.
- We do not use Google user data for advertising, including retargeting or personalised or interest-based ads.
- We do not transfer Google user data to advertising platforms, data brokers or information resellers.
- We do not use Google user data to develop, improve or train generalised AI or machine learning models.
- Our staff do not read Google user data except to provide the service you asked for, with your consent, to investigate security or abuse, or where the law requires.
- In Google Ads we do not change anything. In Google Tag Manager we never publish and never create versions.
How long we keep it and how we delete it
We delete your refresh token and connection record, and the Google data held for that connection, within 30 days of any of these:
- you ask us to delete it
- you disconnect, or we disconnect you at your request
- you revoke our access in your Google account, or Google tells us the access has ended
- your service with us ends
If you stop sharing one site, property, container or account, we delete the data for that one resource in the same way. Backups held by our hosting provider can keep a deleted record for a short time before they expire. Activity records are kept for 24 months. To ask for deletion, email privacy@umbrellatech.com.au.
How to revoke access
You can stop us at any time. Go to myaccount.google.com/permissions, choose Umbrella Technologies and remove access. You can also email privacy@umbrellatech.com.au and we will disconnect you. If you remove access in your Google account, we stop reading your data and start the deletion described above.
Security
We take reasonable steps to protect Google user data from misuse, interference, loss and unauthorised access. Refresh tokens are encrypted. Staff access to the console needs single sign-on, multi-factor authentication and, for approvals, a passkey. Each product can reach only the resources you chose for it, and requests to Google use a fixed list of permitted operations. We act on Google's cross-account protection alerts: if Google tells us your account's access has been revoked or the account has been disabled, we end the connection.
Data breaches
If we become aware of a data breach that is likely to result in serious harm, we will contain it, assess it and notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. If you are in the UK or EU, we will also notify the relevant authority where the GDPR requires it. We will tell Google where its policies require it.
Overseas processing
Our providers process information outside Australia. Cloudflare operates a global network, and Google, Anthropic and DataForSEO process data on their own infrastructure outside Australia. We take reasonable steps to make sure they handle personal information in a way that is consistent with the Australian Privacy Principles. The sub-processors page lists each provider and what it receives.
Your rights and how to complain
You can ask for access to the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing privacy@umbrellatech.com.au. There is no charge. We may need to confirm that you control the Google account. We will respond within 30 days.
If the UK or EU GDPR applies, you also have the right to restrict or object to our handling of your information, to receive it in a portable format and to withdraw consent. For data from your Google properties, we act as your processor under our Data Processing Addendum. For the account details we use to link your connection, our lawful bases are performing our contract with you or your organisation, and our legitimate interest in keeping the service secure.
If you have a complaint, contact us first. If you are not satisfied, you can contact the OAIC at oaic.gov.au or on 1300 363 992. In the UK you can contact the Information Commissioner's Office (ico.org.uk), and in the EU the authority in your country.
Limited Use statement
Umbrella Technologies' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Read the Google API Services User Data Policy.
What changed
- Version 1.0, 31 October 2026: first published.
Contact us
- Business: Umbrella Technologies Pty Ltd (ABN 15 701 061 243)
- Location: Osborne Park, Perth WA 6017 (by appointment)
- Privacy email: privacy@umbrellatech.com.au
- Support email: support@umbrellatech.com.au
- Phone: 1800 262 262