Privacy policy

Account and organization information

We process account details and the information organizations provide through the CMS, including contacts, intakes, case records, documents, and communications. We use this information to operate the requested features, administer access, and maintain security. Contact the organization that manages your account about its use of case, intake, or contact records.

Google sign-in

If you choose Google sign-in, Google provides identity information such as your account identifier, email address, name, and profile image, subject to the permissions granted. Supabase processes sign-in for the CMS. Access to a CMS workspace also requires an authorized CMS account.

Google Analytics and Search Console

When an account administrator connects Google reporting, we request read-only access for reports and page indexing checks. Administrators may separately authorize Search Console management so they can submit sitemaps from the CMS. We retrieve available Analytics accounts, properties and website streams, and Search Console sites so the administrator can select the website to report on.

For the selected connection, we retrieve reporting information such as visitors, visits, page views, events, traffic sources, landing pages, Google search queries, clicks, impressions, and search positions. We use that information to display reports to authorized users of the connected CMS account. We also retrieve sitemap status and URL inspection results, including indexing status, crawl dates, and canonical URLs. Checked page URLs and their inspection history are stored for that account and connection.

Storage, access, and service providers

We store the selected Google property, website stream and site, granted permissions, connection status, and encrypted OAuth credentials. Credentials remain on the server and are used to refresh reporting access. Reports may be cached to support dashboard updates. Connection and access activity is recorded in security audit logs.

The CMS uses hosting, database, authentication, and other infrastructure providers, including Vercel and Supabase, to operate these features. They process information as part of providing their services. Access by support personnel to Google data is limited to your specific permission, security investigations, legal requirements, or aggregated internal operations permitted by Google’s policy.

Our use and transfer of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements. Google reporting data is used for the connected reporting features, not sold or used for advertising.

Cookies and website activity

The CMS uses session cookies for sign-in and access controls. Website activity reporting may include page views, referrals, campaigns, device information, and interactions. Where Google Analytics is configured, it receives website usage events. Google reporting connections and Google sign-in are separate from this website activity collection.

Disconnecting and requesting deletion

Account administrators can disconnect Google reporting in Integrations. This removes that account’s stored OAuth credentials and pending connection attempts. Cached Google reports are no longer available through that connection. Existing CMS records, security audit records, and data held in Google Analytics or Search Console are not deleted by disconnecting.

You can also remove the CMS application’s access through your Google Account connections. Removing Google sign-in access may affect how you sign in to the CMS.

For help with access or a request to delete information held by the CMS, contact your organization’s account administrator or Indian Country Legal. We may need to verify your identity and authority over the account. Some records may need to be retained for security, legal, or organizational recordkeeping requirements.