Last updated: 13 October 2026
This policy explains what personal information Verbolica collects, how we use it, and the choices you have. Verbolica is operated by Digileads Marketing LTD, a company registered in the United Kingdom (“Verbolica”, “we”, “us”), which is the controller of the personal information described here. We process personal information in line with the UK General Data Protection Regulation and the Data Protection Act 2018 (together, “UK data protection law”), and, for our users and their clients in South Africa, the Protection of Personal Information Act, 2013 (POPIA).
Questions or requests: help@verbolica.com.
1. Who this applies to
Verbolica is software that marketing agencies use to plan, write, publish and report on marketing for their clients (“brands”). This policy covers people who use the Verbolica app at app.verbolica.com, visitors to verbolica.com, and the people whose information an agency adds to Verbolica.
2. Information we collect
- Account information: your name, email address, password (stored as a hash), role and the workspace you belong to.
- Brand and content information: what you and your agency put into Verbolica: brand details, personas, briefs, drafts, comments, approvals and published content.
- Information from services you connect: see section 4 for Google. Other connections (WordPress, social accounts, Meta Ads) give us the data needed to publish and to report.
- Usage information: which features are used, errors, and technical details such as browser type, so we can run, secure and improve the service.
- Website visitors: when a brand installs our WordPress plugin, it records engagement on that brand’s own website (pages read, scroll depth, form submissions) for that brand’s reporting.
3. How we use information
We rely on these lawful bases: performing our contract with you or your agency; our legitimate interests in running, securing and improving the service; your consent where we ask for it (for example, when you connect a Google account); and complying with the law.
- To provide the service: generating, publishing and reporting on content, and running the features you choose.
- To produce reports and recommendations for the brand the data belongs to.
- To keep the service secure, prevent abuse and fix problems.
- To communicate with you about your account, including notifications you can switch off.
- To bill for the service.
We do not sell personal information.
4. Google user data
When you connect a Google account to Verbolica, you choose which access to grant. Verbolica asks for read-only access to everything except Google Ads, and uses each kind only for the feature named:
| Google access | What Verbolica reads | What it is used for |
|---|---|---|
| Google Search Console (read-only) | Search performance (queries, clicks, impressions, positions) and URL inspection results for the sites you choose | Search reporting, ranking tracking, finding content gaps, and recommendations for that brand |
| Google Analytics (read-only) | GA4 traffic and engagement figures for the properties you choose | Traffic and engagement reporting, and recommendations for that brand |
| Google Ads (read and manage) | Campaign, ad group, keyword and performance data for the Ads accounts you choose | Paid media reporting and recommendations for that brand, and making the changes you ask for: adjusting budgets, bids and keywords, pausing or enabling campaigns, and creating campaigns. Verbolica changes a Google Ads account only when a user in your workspace makes the change or approves and applies a recommendation; it never changes your account on its own, and every change is logged with who made it |
| Google Calendar (read-only) | Upcoming events whose attendees share the client’s email domain | Showing upcoming meetings with that client in the brand’s Client Room. Calendar data is read when the page loads and is not stored |
| Your Google email address | The address of the account you connected | Showing which Google account is connected |
How Google data is stored and protected. Access tokens are encrypted at rest (AES-256-GCM). Search Console, Analytics and Google Ads figures are stored with the brand they belong to, so reports can show history.
Who it is shared with. Google user data is shown only to the people in the workspace that connected it, and to that brand’s client users where the agency has shared a report. To write reports and recommendations, Verbolica sends the relevant figures to the AI model provider that powers those features (Anthropic, through its commercial API, which does not use API data to train its models). We use service providers to host and run Verbolica (for example, database hosting and error monitoring), bound by confidentiality. We do not sell Google user data or use it for advertising.
Limited Use. Verbolica’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the user-facing features described above; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you; we do not use it to serve advertisements; we do not use it to train generalised AI or machine-learning models; and no person at Verbolica reads it unless you ask us to (for example, for support), it is needed for security or to comply with law, or it has been aggregated and anonymised.
Disconnecting and deletion. You can disconnect Google at any time in Verbolica, which deletes the stored tokens, or remove Verbolica’s access from your Google Account at https://myaccount.google.com/permissions. Deleting a brand deletes the Google data stored for it. To have all your Google data deleted, email help@verbolica.com and we will do so within 30 days.
5. Where information is processed
Verbolica runs on cloud infrastructure that may store and process information outside the United Kingdom and South Africa, including in the United States. Where information leaves the UK, we rely on an adequacy decision or on the UK International Data Transfer Agreement or Addendum, and we require providers to protect it to a standard at least equivalent to UK data protection law and POPIA.
6. How long we keep information
We keep information for as long as your account or the brand is active, and as needed to meet legal, accounting and security obligations. When a brand or account is deleted, its data is deleted, apart from records we must keep by law.
7. Security
We protect information with encryption in transit and at rest for credentials, access controls that limit each user to their own workspace and brands, and monitoring. No system is perfectly secure; if a breach affects your personal information, we will notify you and the relevant regulator (the Information Commissioner’s Office in the UK, or the Information Regulator in South Africa) as the law requires.
8. Your rights
You may ask for a copy of the personal information we hold about you, and ask us to correct it, delete it, restrict or object to its processing, or give it to you in a portable format. Where we rely on your consent, you may withdraw it at any time. Contact help@verbolica.com; we reply within one month.
You may also complain to the Information Commissioner’s Office (https://ico.org.uk) in the UK or, in South Africa, the Information Regulator (https://inforegulator.org.za).
9. Children
Verbolica is a business tool and is not intended for anyone under 18.
10. Changes
We will post changes to this policy here and update the date above. If a change materially affects how we use Google user data, we will tell you before it takes effect.