Privacy Policy

The short version

We store what an audit needs and little else: the business you asked about, what the engines said, your email, and — if you buy a report — a payment reference. We do not sell data, and we do not build advertising profiles.

What we collect

Business information. Public details from your Google Business Profile — name, address, website, rating, review count, coordinates — plus what we read from your public website: structured data, robots.txt, sitemap, llms.txt.

Engine answers. The text each AI engine returned for a buyer question, and the sources it cited. These answers are about a market, not about you, so one answer is shared across every business audited in the same city and trade. It is what makes the service affordable, and it means two businesses in one city are compared against an identical set of answers.

Account details. Email address and authentication, held by Clerk. We never see or store your password.

Payment details. Handled entirely by Dodo Payments. We receive a payment reference, an amount and an email address. We never see your card number.

A hashed IP address. To stop one visitor running up unlimited audits, we count requests per address per day. The address is stored only as a salted SHA-256 hash — the salt matters, because an unsalted hash of an IPv4 address can be reversed by brute force in seconds, and storing one would be pseudonymisation in name only. We keep the count for the day and no longer.

What we do not collect

No advertising trackers, no third-party analytics pixels, no cross-site profiling, no fingerprinting for marketing. Bot protection on the audit endpoint uses Vercel BotID, which inspects the request to tell a browser from a script.

Why we are allowed to hold it

To provide the service you asked for, to take payment for it, and to protect the service from abuse. Where we email you about the product, it is because you gave us your address to receive a report.

Who we share it with

Only the vendors that make the product run: Neon (database), Clerk (accounts), Vercel (hosting and bot protection), Dodo Payments (payment), Google Places (business identity), and the AI providers whose engines we probe — OpenAI, Anthropic, Google and Perplexity, reached through OpenRouter. The questions we send them are about a market, not about you personally.

How long we keep it

Audits and reports stay until you delete them or close your account. Engine answers are kept as a historical record so week-over-week comparison is possible. Rate-limit counts are kept for a day. Payment records are kept as long as tax law requires.

Your rights

Ask us for a copy of your data, a correction, or deletion, and we will act on it. Deleting your account removes your profiles, audits and reports. Shared engine answers are not personal data about you and remain as market history.

Contact

Privacy questions or a deletion request: get in touch.