Home

Legal

Privacy Policy

Effective date: 13 October 2026

This Privacy Policy explains how Umbrella Technologies PTY LTD (trading as Umbrella Technologies) collects, uses, stores, shares and protects personal information, including information we receive from your Google account when you connect it to one of our services. We have written it in plain English. If anything is unclear, contact us using the details in section 18.

1. Who we are

Umbrella Technologies (“Umbrella”, “we”, “us”) is a Perth, Western Australia business providing managed security, compliance, infrastructure and professional services. We operate under the legal entity Umbrella Technologies PTY LTD, ABN 15 701 061 243, of Perth, Western Australia.

Our privacy contact is privacy@umbrellatech.com.au.

2. What this policy covers

This policy applies to:

  • our website at https://umbrellatech.com.au (the “Website”);
  • the services we provide to our clients (the “Services”);
  • SiteBeacon, our search engine optimisation (SEO) keyword and content platform; and
  • any other Umbrella product or tool that connects to a client’s Google account, including our Google connection service, “Umbrella Connect”, which appears on Google’s consent screen as “Umbrella Technologies”.

3. Information we collect

Information you give us

This includes your name, business name, email address, phone number, role and the details you include when you contact us, request a quote, sign up for or use our Services, or correspond with us.

Information from your use of our Services

When you use SiteBeacon or another online Service we record account details, the websites, keywords and settings you configure, the reports and content you generate, and technical information such as IP address, browser type and activity logs needed to operate and secure the Services.

Information from your Google account

If you choose to connect your Google account, we receive the Google user data described in section 4. We only receive it after you approve Google’s consent screen, and only for the permissions you approve.

Information from our Website

See section 14 (Cookies and analytics).

4. Google user data we access, and why

When you connect a Google account through Umbrella Connect, Google asks you to approve specific permissions (called “scopes”). We request only the scopes below. For each one, this is exactly what we access and why.

Basic profile and email (openid, email, profile)

  • What we access: your Google account email address, name, profile picture and a unique Google account identifier.
  • Why: to identify which Google account has been connected, to link it to the correct client and user in our systems, and to show you which account is connected.

Google Search Console, read-only (https://www.googleapis.com/auth/webmasters.readonly)

  • What we access: the list of Search Console properties you can access and their search performance data (such as queries, pages, clicks, impressions, click-through rate and average position), and related site information such as sitemaps. We cannot change anything in your Search Console account with this permission.
  • Why: to show you how your website performs in Google Search and to power keyword and content recommendations and reports in SiteBeacon and our other Services.

Google Analytics 4, read-only (https://www.googleapis.com/auth/analytics.readonly)

  • What we access: the list of Google Analytics accounts and GA4 properties you can access, and the reporting data and configuration of those properties (such as traffic, engagement and conversion metrics). We cannot change anything in your Analytics account with this permission.
  • Why: to report on your website traffic and results and to show how SEO and advertising work is performing.

Google Ads (https://www.googleapis.com/auth/adwords)

  • What we access: the Google Ads accounts you can access and their campaign, ad group, keyword, budget and performance data. Google offers a single Google Ads permission, and it allows both reading and managing an account.
  • Why: to report on your advertising performance and, where you have engaged us to manage your advertising, to carry out changes you have asked for or approved. We do not make changes to your Google Ads account that you have not requested or authorised.

Google Business Profile (future)

  • What we access: we do not request Business Profile access today. We plan to request the Business Profile permission (https://www.googleapis.com/auth/business.manage) only after Google approves our access to the Business Profile API. At that point we will update this policy, and you will see the permission on Google’s consent screen before you approve it.
  • Why (planned): to view and, where you ask us to, manage your business listing information, such as business details, hours, posts and reviews.

We do not access your Gmail, Google Drive, Google Calendar, Contacts or any other Google data that is not listed above.

5. Google API Services User Data Policy and Limited Use

Umbrella Technologies’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means:

  • We use Google user data only to provide and improve the user-facing features you asked for, which are described in section 4.
  • We do not sell Google user data.
  • We do not use Google user data for advertising, including retargeting, personalised or interest-based advertising, and we do not transfer it to others for those purposes.
  • We do not use Google user data to build or train generalised AI or machine learning models.
  • We do not allow people to read your Google user data, except: (a) with your consent for specific data (for example, when you ask us for support and agree that we may look at it); (b) where necessary for security purposes, such as investigating abuse or a breach; (c) where necessary to comply with applicable law; or (d) where the data has been aggregated and anonymised and is used for internal operations in line with applicable law.
  • We transfer Google user data to others only where necessary to provide the features you asked for (see sections 6 and 8), to comply with law, for security purposes, or as part of a merger, acquisition or sale of assets where you are notified first and Google’s requirements are met.

6. AI processing

Some of our Services use artificial intelligence to generate summaries, keyword and content suggestions and reports. To do this, relevant data, which can include Google user data such as Search Console or Analytics reporting data, may be processed by third-party AI providers, currently OpenAI, accessed through Cloudflare AI Gateway.

  • We send data to AI providers solely to deliver the features you have requested.
  • We do not use Google user data to train generalised AI or machine learning models, and we do not permit our AI providers to do so with it.
  • We send only the data needed for the task, and we do not send your Google account credentials or access tokens to AI providers.

AI-generated output can be wrong. Please review it before relying on it.

7. How we use other personal information

We use the other personal information we collect to:

  • provide, operate, support and secure our Website and Services;
  • set up and manage client accounts, and communicate with you about our Services;
  • send you invoices and administrative notices, and, where permitted, information about our Services (you can opt out at any time);
  • meet our legal and regulatory obligations; and
  • protect our rights, systems and clients, including preventing fraud and misuse.

We do not sell personal information.

8. Who we share information with (sub-processors)

We use the following service providers to run our business and Services. They process information on our behalf and only for the purposes described in this policy:

  • Cloudflare — hosting, databases, storage, security and AI Gateway for our Services and Website.
  • DataForSEO — a search data provider used by SiteBeacon. It receives the keyword and website information needed to retrieve SEO data. It does not receive your Google account credentials.
  • OpenAI — AI processing, accessed via Cloudflare AI Gateway, as described in section 6.
  • Microsoft 365 — our email, file storage and business communications.

We may also disclose information where required or authorised by law, to our professional advisers, or to protect our rights or safety. If our business is sold or restructured, information may be transferred to the new owner, who must continue to protect it consistent with this policy; for Google user data we will notify you first.

We will update this list if we add or change a sub-processor that handles Google user data.

9. Overseas disclosure (Australian Privacy Principle 8)

Our service providers operate internationally. As a result, personal information, including Google user data, may be stored or processed in countries outside Australia, including the United States. Before we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles (APPs), for example by using reputable providers with contractual data protection terms. By using our Services you understand that we may disclose information to these overseas recipients.

10. Storage and security

  • Our Services run on Cloudflare’s infrastructure, and Google user data and other service data is stored there.
  • The OAuth refresh tokens that let us access your Google account are encrypted at rest using AES-GCM. The encryption key and other secrets are kept in Cloudflare’s secret store, separate from the data.
  • We restrict access to our systems and to personal information to people who need it for their role, and we use access controls and secure connections.
  • No system is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

11. Retention and deletion

  • We keep Google user data only for as long as your Google account remains connected and the data is needed to provide the Services.
  • When you revoke our access, disconnect your account, or end your use of the Services, we stop accessing your Google account and will delete your stored Google tokens and Google user data within 30 days, unless we are required by law to keep it.
  • You can ask us to delete your Google user data or other personal information at any time (see section 12). We will delete it within 30 days of verifying your request, unless the law requires us to retain it.
  • We keep other business records, such as invoices and correspondence, for as long as we need them for business and legal purposes (including tax and record-keeping obligations), and then delete or de-identify them.

12. Revoking access and requesting deletion

You are in control of the access you give us. You can:

  • Revoke our access to your Google account at any time at myaccount.google.com/permissions by selecting “Umbrella Technologies” and choosing to remove access. After you revoke access, our tokens stop working.
  • Remove Google Ads access by removing the link between your Google Ads account and our manager (MCC) account, in your Google Ads account settings.
  • Remove Google Business Profile access (once we use it) by removing us as a manager or user on your Business Profile.
  • Ask us to delete your data by emailing privacy@umbrellatech.com.au. We may need to verify your identity first.

Your Google Ads, Google Analytics, Search Console and Business Profile accounts belong to you and stay with you. Revoking our access does not delete them.

13. Access and correction

You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Email privacy@umbrellatech.com.au. We will respond within a reasonable period, and will tell you if we cannot give access or make a correction and why, as permitted by the APPs.

14. Cookies and analytics

Our Website is delivered through Cloudflare and only uses cookies and similar technologies that are needed for it to work and stay secure. We do not use advertising or tracking cookies. We measure Website traffic with cookie-free, server-side analytics.

You can control cookies through your browser settings. Blocking some cookies may affect how the Website works.

15. Children

Our Website and Services are intended for businesses and are not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

16. Complaints

If you have a concern about how we have handled your personal information, contact us at privacy@umbrellatech.com.au. We will acknowledge your complaint and respond within a reasonable time. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

17. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date. If we make a material change, particularly to the Google user data we access or how we use it, we will notify you (for example by email or in our Services) and, where required, ask for your consent again.

18. Contact us

Umbrella Technologies PTY LTD (ABN 15 701 061 243)

Perth, Western Australia

Email: privacy@umbrellatech.com.au