Macaroni client dashboard privacy policy

Macaroni client dashboard privacy policy

Effective date: 28/09/26
Last updated: 28/09/26

Overview

Macaroni is the tool Blink SEO ("we", "our", "us") uses to share work with the businesses we work for. Each client has a private dashboard at docs.macaroni.works, where the people they choose can review our proposed changes, approve them and read their reports.

This policy covers the personal information we collect when somebody signs in to one of those dashboards. It does not cover the data about a client's store or website that the dashboard shows. That is covered by our agreement with the client.

1. Information we collect

When you sign in with Google

  • Your email address, and whether Google has verified it.

We ask Google for your email address only. We do not receive your name, photo, contacts, files or any other Google data, and we do not keep any Google access token after you have signed in.

Each time somebody tries to open a dashboard

  • The date and time.
  • The IP address the request came from.
  • The browser and device, as the browser reports them.
  • How they signed in (Google or password), and the email address for a Google sign-in.
  • Whether they got in.

The list of people who can sign in

  • Each person's email address, which member of our team added it and when.

We add people to a dashboard at the client's request. If you are on a list and did not expect to be, contact us.

2. How we use it

  • To check that the person signing in is on that client's list, and to let them in.
  • To keep a record of who opened each dashboard and when, so that we and the client can see if access was misused.
  • To lock a dashboard for 15 minutes after five wrong passwords, so that it cannot be opened by guessing.

We do not use this information for marketing or advertising, and we do not sell it or share it with anyone for those purposes.

Under UK data protection law, our lawful basis is legitimate interests: keeping the documents we share with a client available only to the people they choose.

3. Cookies

The dashboard uses three cookies. All three are needed for signing in, so we do not ask for consent to them. None is used for tracking or advertising.

  • macaroni_dashboard keeps you signed in for 12 hours.
  • macaroni_oauth_nonce protects a Google sign-in while it is in progress. It lasts 10 minutes.
  • macaroni_signin carries the message shown if a Google sign-in did not get in. It lasts one minute.

4. How long we keep it

  • Sign-in records are kept for [12 months], then deleted.
  • An email address stays on a dashboard's list until the client asks us to remove it, or until we stop working with the client.

5. Who we share it with

We share it only with the service providers who run Macaroni for us, and only so they can do so:

  • Vercel, which hosts the dashboards.
  • Neon, which stores the records.
  • Google, which handles Google sign-in.

We will also share it with legal authorities if the law requires us to.

Where one of these providers stores or processes data outside the UK, we rely on the safeguards UK law requires for international transfers.

6. Use of Google user data

Macaroni's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Security

Every connection to a dashboard uses HTTPS. Sessions are signed so they cannot be forged, and the sign-in cookie cannot be read by scripts on the page. Only members of our team who work on your account, and the people who maintain Macaroni, can see the records.

No system is completely secure. If a breach affects your information, we will tell you and the authorities as the law requires.

8. Your rights

You can ask us for a copy of the information we hold about you, or ask us to correct it, delete it, or stop or limit how we use it. Contact us at the address below. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

9. Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change affects what we collect, we will tell the clients whose dashboards it applies to.

10. Contact us

 Gladstone Street Limited, trading as Blink SEO.
Email: info@blinkseo.co.uk

Address: Suite 6.16 Fuel Studios, Kiln House, Pottergate, Norwich, England, NR2 1DX