Privacy Policy
Last updated:
This policy explains what personal data SEO·AEO·GEO collects when you use SEO·AEO·GEO, why, how long we keep it, who handles it for us, and the rights you have. We wrote it from how the product actually works, and we will update it when that changes.
The short version
- No advertising, no analytics or tracking scripts, and we do not sell or rent your data.
- Audit reports are deleted automatically after 24 hours.
- We ask for your email only when a feature needs it: downloads, alerts, the newsletter, or an account.
- We set one cookie, and only when you sign in.
- Card, UPI and bank details go to Razorpay. We never see or store them.
1. Who is responsible
SEO·AEO·GEO decides how and why this data is used, which makes us the “data fiduciary” under India's Digital Personal Data Protection Act, 2023 and the “controller” under the EU and UK GDPR.
2. What we collect, and why
Audits you run
- What: the URL you submit and the report we produce. To build it we fetch that public page, its robots.txt and sitemap (and, for a sitewide audit, other pages on the site), and we look the domain up on Wikidata. A report contains what was publicly visible on that page, which can include names or contact details the site itself publishes.
- Why: to show you the report you asked for.
- How long: 24 hours, then it is deleted automatically. The same applies to comparisons, sitewide reports and live citation-check results. Anyone with a report's link can open it until then, so share links with care.
- You do not need to give us your name or email to run an audit.
Emailing you a report
- What: your email address and a six-digit code. We email you the code, and once you enter it, links to your report and its downloads.
- Why: to deliver the report to an address you have shown you control.
- How long: the code and the address stored with it expire after 10 minutes, or as soon as the code is used. We do not keep your address after that. Resend, which sends the email, keeps its own delivery records.
Accounts
- What: your email address; a sign-in code (valid for 10 minutes); and an account record with your plan, subscription status, billing interval and currency, Razorpay subscription reference, the date your paid period ends, whether you have cancelled, and when the account was created and updated. We also count how many of your monthly allowances you have used. On the Agency plan we store the branding you add (agency name, website, logo link and colour) and the key for your embeddable widget.
- Why: to sign you in, give you the plan you paid for, apply its limits, and show your branding.
- How long: while your account exists. Usage counters expire after about 40 days.
Payments
- Payments are handled by Razorpay. Whatever you enter at checkout (card, UPI or bank details, phone number and email) goes to Razorpay and is used under Razorpay's privacy policy. We never see or store card numbers, UPI IDs or bank credentials.
- We pass Razorpay your account email and the plan you chose, so the payment is matched to your account. Razorpay tells us the subscription reference and whether payments succeeded, and may email or text you about your subscription.
Weekly alerts
- What: your email address, the page you want watched, and that page's last result (its score and the status of the checks we watch).
- Why: to re-audit the page each week and email you only if something that controls AI access gets worse. Nothing is watched until you click the confirmation link we email you, so nobody can sign up someone else.
- How long: an unconfirmed sign-up is deleted after 24 hours. A confirmed one is kept until you unsubscribe, which takes one click on the link in every alert email.
Newsletter
- What and why: your email address, to send you our research updates.
- How long: until you ask us to remove it. Any newsletter we send will include a way to unsubscribe, and you can always write to our support email on the contact page.
Live citation checks
- When you run one, we send the prompts you write (one to three questions, which normally name the brand or domain you audited) to the AI providers we use — Anthropic, OpenAI and Perplexity — and record whether their answers cite the site. The results are kept for 24 hours.
- Please do not put personal information in prompts.
Agency widgets and lead capture
- Agencies on our Agency plan can put our audit widget on their own websites, under their brand. If you use an agency's widget and choose to enter your email address, we send that address and the domain you audited to that agency. From then on the agency is responsible for it under its own privacy policy; ask the agency if you want it to stop contacting you or delete it.
- Reports opened from an agency's widget show the agency's logo, which your browser loads from the address the agency gave us.
Security and abuse prevention
- We use your IP address to apply rate limits (how many audits, codes or sign-ups can be requested in a period). If we cannot determine an IP address for a newsletter sign-up, we use your browser's user-agent string instead. These entries are deleted automatically, after between one minute and about two days depending on the limit.
- Vercel, our host, processes your IP address, browser type and the pages you request in order to deliver the site and protect it, and keeps short-lived request logs.
When you write to us
We keep your message and our reply for as long as we need to help you and keep a record of what was agreed.
3. What we do not do
- We do not run analytics, advertising or tracking scripts on the site.
- We do not sell, rent or trade personal data, or share it for advertising.
- We do not use your data to train AI models.
- We do not make decisions about you that have legal or similarly significant effects by automated means.
4. Cookies
We set one cookie, and only when you sign in: ga_session. It keeps you signed in for up to 30 days. It holds your email address and an expiry time, signed so it cannot be altered, and it is marked HttpOnly (page scripts cannot read it), Secure and SameSite=Lax. Signing out deletes it. It is strictly necessary for signing in, so we do not ask for consent to it.
We set no analytics, advertising or tracking cookies, and our fonts are served from our own domain. When you choose to pay, Razorpay's checkout opens, and Razorpay may use its own cookies or similar technologies there for security and fraud prevention, under its own policy.
5. Who processes data for us
We share personal data only with the service providers below, only for what they do for us, or when the law requires it (for example, a valid order from a court or regulator).
| Provider | What it does | Data it handles |
|---|---|---|
| Vercel | Hosts the website and runs its servers. | Every request: IP address, browser type, the page requested. Short-lived request logs. |
| Upstash | Our database (Redis). | Reports, one-time codes, accounts, alert subscriptions, newsletter addresses, rate-limit counters. |
| Resend | Sends our emails. | Your email address and the email we send you (codes, report links, alerts). |
| Razorpay | Takes payments and runs subscriptions. | Everything you enter at checkout, plus the account email and plan we pass to it. |
| Anthropic, OpenAI and Perplexity | Answer live citation checks (only when you run one). | The prompts you write, which mention the brand or domain you audited. |
Privacy policies of the AI providers: Anthropic, OpenAI, Perplexity. We use their business APIs, not their consumer apps. Audits also query Wikidata (run by the Wikimedia Foundation); we send it only the domain being audited, from our servers, never your details.
6. International transfers
Our providers run servers in several countries, including the United States, so your data may be processed outside the country you live in, including outside India and the EU. We only use providers whose terms commit them to protect it, and these providers offer data-processing terms that cover such transfers, including standard contractual clauses for data from the EU and UK.
7. How long we keep data
| Data | Kept for |
|---|---|
| Audit reports, comparisons, sitewide reports, citation-check results | 24 hours, then deleted automatically |
| Email one-time codes (downloads and sign-in) | 10 minutes, or until used |
| Unconfirmed alert sign-ups | 24 hours |
| Confirmed alert subscriptions (email, page URL, last result) | Until you unsubscribe |
| Newsletter address | Until you ask us to remove it |
| Account record and agency branding | While your account exists; deleted on request |
| Monthly usage counters | About 40 days |
| Rate-limit entries keyed by IP address | From one minute to about two days, then deleted automatically |
| Payment records | Kept by Razorpay under its policy and the law |
Where tax or accounting law requires us to keep a record of a payment or subscription, we keep that record for as long as the law requires, even after you delete your account.
8. Security
The site is served only over HTTPS. One-time codes expire after 10 minutes and lock after repeated wrong guesses; download, unsubscribe and session tokens are cryptographically signed; and requests are rate-limited. No system is perfectly secure, but if a breach affects your data we will tell you, and the authorities where the law requires it, without undue delay.
9. Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and how we use it, and give you a copy;
- correct or update it if it is wrong or incomplete;
- delete it, including closing your account, removing alert subscriptions and taking you off the newsletter;
- withdraw your consent to anything we do on the basis of consent, such as alerts and the newsletter, as easily as you gave it;
- object to or ask us to restrict a use of your data, or give you your data in a format you can take to another service.
Under India's Digital Personal Data Protection Act, 2023, you can also nominate someone to exercise these rights if you die or become unable to, and you can complain to the Data Protection Board of India if you are not satisfied with our response. Under the GDPR, you can complain to the data protection authority where you live or work. We would appreciate the chance to sort it out with you first.
To use any of these rights, email our support email on the contact page from the address the request is about (or tell us which address it is about, and we will confirm by sending a code to it). We reply within 30 days, and usually much sooner. Deletion removes the data from our systems; Razorpay keeps its own payment records as the law requires it to.
Our legal grounds (GDPR)
- Contract — running your audits, delivering reports you ask for, your account and subscription.
- Consent — weekly alerts, the newsletter, and lead capture on an agency's widget.
- Legitimate interests — rate limiting, security and preventing abuse of the service.
- Legal obligation — tax, accounting and lawful requests from authorities.
10. Children
SEO·AEO·GEO is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us their details, write to our support email on the contact page and we will delete them.
11. Changes to this policy
When we change how we handle data, we update this page and the date at the top. If a change materially affects account holders, we will email them before it takes effect.
12. Contact and grievances
For questions, requests or complaints about your personal data, write to our support email on the contact page. We acknowledge complaints within 48 hours. Our full details are on the contact page.