Privacy Policy

1. Who we are

[Company legal name] operates GEO Audit and is the controller of the personal data described here. For customer content processed on your behalf (for example, articles about your business), we act as your processor. Contact: [contact email].

2. What we collect

Account data: your name, email address and a hashed password; the workspaces you belong to and your role.
Session data: when you sign in we store your IP address and browser user agent with the session, to keep you signed in and to detect misuse.
Workspace data: websites you add, brand descriptions, customer questions, competitors, keywords, content plans, articles, and the AI answers we collect for your questions.
Public website data: pages we crawl from websites you add, and pages we check for live backlink network links.
Publishing credentials: WordPress application passwords and webhook signing secrets, stored encrypted.
Billing data: Stripe processes your card. We store your Stripe customer and subscription IDs, plan and subscription status, not card numbers.
Free audit: the website address and optional brand details you enter, and the resulting report, which anyone with its link can view. Your IP address is used briefly in memory to limit the number of audits and is not stored. If you leave your email address on a report, we store it with that report.
Backlink network: if you join, the consent you gave (who, when and which version), review results, and the links placed to and from your websites.

3. Why we use it

To provide the Service you signed up for: tracking, writing, publishing and the network (contract).
To bill you and keep financial records (contract and legal obligation).
To send service emails such as email confirmation and visibility alerts (contract). We don't send marketing emails without your consent.
To keep the Service secure, prevent abuse and enforce our Terms (legitimate interests).
To improve the Service using aggregated, de-identified statistics (legitimate interests).

4. Who we share it with

We share data only with service providers that help us run the Service, under contracts that limit their use of it:

AI providers that answer tracked questions and write or analyze content: Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) and Perplexity. We send them your questions, brand and website descriptions and article content, not your account details.
DataForSEO, for keyword and search result data. We send keywords and your website's domain.
Stripe, for payments and invoices.
Resend, to deliver emails.
Our hosting and database providers, which store the data on our behalf.
Your own website platform (for example, WordPress) when we publish articles you approved.

If you join the backlink network, other members can see your website's domain and the URLs of your articles that link to them. We may also disclose data if the law requires it, or as part of a merger or acquisition, in which case this policy continues to apply.

5. Cookies

We use only cookies that the Service needs: a session cookie that keeps you signed in, and a cookie that remembers the language you chose. We don't use advertising or analytics cookies, so there is nothing to opt out of.

6. How long we keep it

Account and workspace data: for as long as your account exists.
Deleting a website deletes its tracking answers, content, keywords and network records.
Free audit reports: kept so their shareable links keep working. Email us to have a report deleted.
Billing records: as long as tax and accounting laws require.
After you ask us to delete your account, we delete or anonymize your data within 30 days, except records we must keep by law. Backups roll over within a further 30 days.

7. International transfers

Our providers may process data in the United States and other countries. Where data from the EEA, UK or Switzerland is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Security

Passwords are hashed, publishing credentials are encrypted at rest, and connections use HTTPS. Access to production data is limited to people who need it to run the Service. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent. Residents of California and other US states have similar rights; we don't sell personal data or share it for cross-context behavioral advertising.

To make a request, email [contact email] from the address on your account. We'll respond within 30 days. You can also complain to your local data protection authority.

10. Children

The Service is for businesses and isn't directed at children. We don't knowingly collect data from anyone under 16.

11. Changes

We'll post changes on this page and update the version date. For material changes we'll also notify you by email or in the app before they take effect.

If this policy is translated, the English version governs.