This page explains how we handle data on behalf of business customers. We wrote it plainly so you can actually read it. Need a signed DPA on paper for your procurement team? Email us and we will send one.
Roles
For the data you put into the product (the domains, brands, and prompts you track), you are the data controller and we are the data processor. We process that data only to run the service, and only on your instructions.
What we process
- The domains and brand names you track, plus the prompts we run to measure them.
- Account data: your email and login, handled through Supabase auth.
- Measurement output: the answers and citations the AI engines return, stored as your results.
We do not need or want special-category personal data. Please do not put it into prompts.
Sub-processors
We use a short, vetted list of providers to run the service. Each one processes data only as far as it needs to:
- Supabase: Database and authentication, hosted in the EU.
- Cloudflare R2: Storage for raw measurement results.
- Resend: Transactional email, like sign-in links and alerts.
- Creem: Payments and billing, as the merchant of record.
- AI engines and data sources: Perplexity, OpenAI, and Google (Gemini and AI Overviews via DataForSEO). They receive the prompt and the domain we measure, not your account details.
Where data lives and how long
Our database and servers are in the EU. We keep your data while your account is active. We delete it on request, or after you close your account. Raw measurement results stick around so your history and trends keep working, and we remove them once they are no longer needed.
Security
Data is encrypted in transit. Tenant data is isolated with row-level security, so one customer can never read another customer's results. Access to production is limited and logged. Payment card details are handled entirely by Creem, so we never see your full card number.
International transfers
Some sub-processors sit outside the EU or UK. Where that happens, transfers rely on proper safeguards such as Standard Contractual Clauses.
Your rights and breach notice
We help you meet data-subject requests, which means access, correction, and deletion. If a personal-data breach affects your data, we will tell you without undue delay and share what we know.
Requesting a signed DPA
Email [email protected] and we will send a signable DPA for your records.