This page explains how we handle data on behalf of business customers. We wrote it plainly so you can actually read it. Need a signed DPA on paper for your procurement team? Email us and we will send one.
Roles
For the data you put into the product (the domains, brands, and prompts you track), you are the data controller and we are the data processor. We process that data only to run the service, and only on your instructions.
What we process
- The domains and brand names you track, plus the prompts we run to measure them.
- Account data: your email and login, handled through Supabase auth.
- Measurement output: the answers and citations the AI engines return, stored as your results.
We do not need or want special-category personal data. Please do not put it into prompts.
Sub-processors
We use a short, vetted list of providers to run the service. Each one processes data only as far as it needs to:
- Supabase: Database and authentication, hosted in the EU.
- Cloudflare R2: Storage for raw measurement results.
- Resend: Transactional email, like sign-in links and alerts.
- Stripe: Payments and billing. Stripe acts as merchant of record under Managed Payments, which makes them responsible for collecting and remitting sales tax and VAT.
- AI engines and data sources: Perplexity, OpenAI, and Google (Gemini and AI Overviews via DataForSEO). They receive the prompt and the domain we measure, not your account details.
Where data lives and how long
Our database and servers are in the EU. We keep your data while your account is active. We delete it on request, or after you close your account. Raw measurement results stick around so your history and trends keep working, and we remove them once they are no longer needed.
Security
Data is encrypted in transit. Tenant data is isolated with row-level security, so one customer can never read another customer's results. Access to production is limited and logged. Payment card details are handled entirely by Stripe, so we never see your full card number.
International transfers
Some sub-processors sit outside the EU or UK. Where that happens, transfers rely on proper safeguards such as Standard Contractual Clauses.
Your rights and breach notice
We help you meet data-subject requests, which means access, correction, and deletion. If a personal-data breach affects your data, we will tell you without undue delay and share what we know.
What we will never do with your data
We do not sell it, rent it, or hand it to advertising networks. We do not use one customer's measurement data to train a model, our own or anyone else's. We do not use your results as an example in marketing without asking you first in writing.
The one thing worth naming explicitly, because it is what a careful buyer actually wants to know: the questions you choose to track are commercially sensitive, since they reveal what you think your market is. Those prompts are yours. They are not pooled, not benchmarked publicly against other customers, and not visible to anyone outside your workspace.
Sub-processor changes
The list above is current rather than aspirational. If we add or replace a sub-processor that touches customer personal data, we update this page and notify workspace owners by email before the change takes effect, so there is a genuine window to object rather than a notice published after the fact.
If you object to a new sub-processor and we cannot offer a workable alternative, you can cancel and receive a pro-rated refund of the unused term. That is the only fair outcome when the terms change underneath an agreement you already paid for.
What happens if something goes wrong
If we become aware of a breach affecting your personal data, we notify affected workspace owners without undue delay and in any case within 72 hours of becoming aware, with what we know, what we do not yet know, and what we are doing about it. An early notice with incomplete detail is more useful to you than a polished one that arrives a week late.
We would rather tell you about something that turns out to be minor than sit on something while we decide how it looks. If you need a named contact for your own compliance records, email us and we will provide one in writing.
Requesting a signed DPA
Email [email protected] and we will send a signable DPA for your records.