Privacy Policy

Last updated: 14 October 2026

Dhucha is a trading name of Aimpro Digital Ltd, registered in England and Wales, company number 13017278. We are the data controller for the personal information described here. Questions or requests: hello@dhucha.com.

What we collect

• Application and account details: your name, company name, email address, mobile number and website address, given when you apply or sign up.
• Your business information: what Dhucha learns from your publicly available website (services, locations, branding, contact details) plus any facts, photos or corrections you add inside the platform.
• Google data, only if you connect it: see the Google section below.
• Website connection details: if you connect your website (for example a WordPress application password), it is stored encrypted and used only to place work you have approved.
• Usage and security data: sign-in times, approximate location (city and country derived from your connection) and the device type, kept to protect accounts.
• Scan records: each time a website is scanned we record which account ran it, the website address entered, the time and the IP address it came from. Scans use paid search and AI services, so this record exists to protect the service from misuse and to keep your account to your own website. Attempts to scan a website that is not yours are recorded in the same way.
• Messages: feedback, questions you ask the assistant, and survey answers, so we can respond and improve the product.

How we use it

• To provide the service: analysing your website, building your plan, preparing work, and sending your weekly progress email.
• To send service emails about your account and, during the beta, occasional product updates. Every non-essential email can be stopped by replying or emailing us.
• To keep the platform secure and improve how it works.

We rely on: performing our contract with you, our legitimate interest in running and improving the service, and your consent where you grant a connection. We never sell your personal information.

The Google connection

If you choose to connect Google, Dhucha accesses your Search Console data (which searches show your website and where it ranks) and your Google Analytics data (read only). Dhucha uses this solely to report your performance back to you, to decide what marketing work will help you most, and to submit your sitemap to Google on your behalf. Dhucha's use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, or allow humans to read it except with your permission, for security, or where the law requires. You can disconnect at any time inside the platform, or from your Google account permissions, and the stored connection is deleted.

Google Ads (the free Google Ads audit)

If you choose "Connect Google Ads" on our free Google Ads audit, you sign in with Google and grant Dhucha access to your Google Ads data. Dhucha uses it read-only and solely to produce your audit: we read the last 90 days of search terms (with clicks, cost and conversions), your conversion actions, and your account names. We never create, change or delete anything in your Google Ads account. The access token is kept encrypted for at most one hour and no long-term connection is stored; the audit result is kept for 30 days so you can email it to yourself, then deleted. This use complies with the Google API Services User Data Policy, including its Limited Use requirements: we do not sell this data, use it for advertising, use it to train AI models, or allow humans to read it except with your permission, for security, or where the law requires. You can remove access at any time from your Google account permissions.

How we protect your data

We treat Google user data (your Google sign-in tokens and the Search Console, Analytics and Google Ads data we read with them) and any credentials you give us as sensitive data, and protect it like this:

• Encrypted in transit: every connection to Dhucha and to Google uses HTTPS (TLS). We never send this data over unencrypted connections.
• Encrypted at rest: Google tokens and website credentials are encrypted with AES-256-GCM before they are stored, so they are never held in plain text. Our database provider also encrypts all stored data at rest.
• Least access: only the minimum read-only permissions are requested. Encryption keys and service passwords are kept as secret environment settings, never in our code or database. Only the account owner and authorised Dhucha administrators can reach your data, through signed-in, owner-only screens.
• Minimum data, short retention: we read only what a feature needs. A Google Ads access token is deleted after at most one hour and a free tool result after 30 days. Search Console and Analytics connections are removed when you disconnect.
• No human reading, no AI training: people do not read your Google data except with your permission, for security, or where the law requires, and it is never used to train AI models or for advertising.
• Monitoring and incidents: our systems log errors and unusual activity. If a breach affecting your data ever happened, we would tell you and the Information Commissioner’s Office (ICO) as UK law requires.

Who helps us process it

Trusted service providers process data on our instructions: cloud hosting and database providers, an email delivery provider, a payment provider (when paid plans start, card details go directly to them and never touch our servers), and AI processing providers used to prepare your analysis and drafts. Each is bound by contract to protect your data. A current list is available on request.

How long we keep it

Account and business data is kept while your account is active. Sign-in records, assistant questions and error logs are deleted automatically after 180 days. If you ask us to delete your account, we remove your personal information within 30 days except where the law requires us to keep it.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict our use of it, and take your data elsewhere. Email hello@dhucha.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Cookies

Dhucha uses one essential cookie to keep you signed in, and your browser's local storage to remember preferences like light or dark mode. No advertising or cross-site tracking cookies.

Changes

If this policy changes in a way that matters, we will tell account holders by email before the change takes effect.