Privacy Policy

1. Who we are

[Company legal name] operates Hammer GEO and is the controller of the personal data described here. For customer content processed on your behalf (for example, articles about your business), we act as your processor. Contact: [contact email].

2. What we collect

Account data: your name, email address and a hashed password; the workspaces you belong to and your role. If you turn on two-step verification, we also store your authenticator key and backup codes, both encrypted.
Session data: when you sign in we store your IP address and browser user agent with the session, to keep you signed in, to show you your signed-in devices, and to detect misuse.
Workspace data: websites you add, brand descriptions, customer questions, competitors, keywords, content plans, articles, and the AI answers we collect for your questions.
Public website data: pages we crawl from websites you add, and pages we check for live backlink network links.
Publishing credentials: WordPress application passwords and webhook signing secrets, stored encrypted.
Billing data: we store which plan your workspace is on, when it was activated and by whom. Plans are paid outside the app (in USDT unless agreed otherwise), so we hold no card numbers or wallet keys. We keep a record of each payment, such as the amount, date and transaction reference, as accounting law requires.
Free check: it needs an account, and we store the website address and optional brand details you enter, the resulting report and which account ran it, to limit free checks to one per account and to follow up with you. Anyone with the report's link can view the free-check version of it. Your IP address is used briefly in memory to limit the number of checks and is not stored. If you leave your email address on a shared report, we store it with that report.
Backlink network: if you join, the consent you gave (who, when and which version), review results, and the links placed to and from your websites.

3. Why we use it

To provide the Service you signed up for: tracking, writing, publishing and the network (contract).
To bill you and keep financial records (contract and legal obligation).
To send service emails such as email confirmation and visibility alerts (contract). We don't send marketing emails without your consent.
To keep the Service secure, prevent abuse and enforce our Terms (legitimate interests).
To improve the Service using aggregated, de-identified statistics (legitimate interests).

4. Who we share it with

We share data only with service providers that help us run the Service, under contracts that limit their use of it:

AI providers that answer tracked questions and write or analyze content: Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) and Perplexity. We send them your questions, brand and website descriptions and article content, not your account details.
DataForSEO, for keyword and search result data, and to collect AI answers to the questions we ask for you. We send it keywords, those questions and your website's domain.
Resend, to deliver emails.
Our hosting and database providers, which store the data on our behalf.
Your own website platform (for example, WordPress) when we publish articles you approved.

If you join the backlink network, other members can see your website's domain and the URLs of your articles that link to them. We may also disclose data if the law requires it, or as part of a merger or acquisition, in which case this policy continues to apply.

5. Cookies

We use only cookies that the Service needs: session cookies that keep you signed in (one for each account signed in on the browser), a cookie that remembers a device you chose to trust for two-step verification, and a cookie that remembers the language you chose. We don't use advertising or analytics cookies, so there is nothing to opt out of.

6. How long we keep it

Account and workspace data: for as long as your account exists.
Deleting a website deletes its tracking answers, content, keywords and network records.
Free audit reports: kept so their shareable links keep working. Email us to have a report deleted.
Billing records: as long as tax and accounting laws require.
After you ask us to delete your account, we delete or anonymize your data within 30 days, except records we must keep by law. Backups roll over within a further 30 days.

7. International transfers

Our providers may process data in the United States and other countries. Where data from the EEA, UK or Switzerland is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Security

Passwords are hashed, publishing credentials are encrypted at rest, and connections use HTTPS. Access to production data is limited to people who need it to run the Service. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent. Residents of California and other US states have similar rights; we don't sell personal data or share it for cross-context behavioral advertising.

To make a request, email [contact email] from the address on your account. We'll respond within 30 days. You can also complain to your local data protection authority.

10. Children

The Service is for businesses and isn't directed at children. We don't knowingly collect data from anyone under 16.

11. Changes

We'll post changes on this page and update the version date. For material changes we'll also notify you by email or in the app before they take effect.

If this policy is translated, the English version governs.