Private Beta Privacy Notice

1. Information we collect

• Account and application data: names, business contact details, organization, role, submitted domain, goals, plan interest, WorkOS identity, membership, and acceptance records.
• Website evidence: authorized public URLs, page content, response headers, robots and sitemap data, structured data, screenshots when separately authorized, hashes, and normalized findings.
• Connected Google data: read-only Search Console properties and Web performance, plus selected GA4 properties and landed-session data. Google credentials and tokens are encrypted and are not returned to the browser.
• AI-search measurements: approved prompts, provider responses, citations, mentions, models, dates, locales, run conditions, errors, and costs.
• Billing and communications: subscription and payment-status references from Stripe, delivery-status references from Resend, support messages, preferences, and refund/cancellation requests.
• Security and operations: IP-derived request information, user agent, session and audit events, error and performance data, access attempts, and fraud/abuse signals.

2. How we use information

We use information to qualify applicants; authenticate and authorize users; create tenant-isolated workspaces; perform requested scans and measurements; generate, review, and deliver reports; connect read-only data sources; manage subscriptions and support; secure and troubleshoot the service; enforce terms; comply with law; and maintain evidence, audit, cost, and release lineage.

3. AI providers and measurement boundaries

When an authorized AI-search measurement runs, the applicable provider may receive the approved prompt and public brand/domain context required for that run. Depending on enabled and accepted features, providers may include OpenAI, Anthropic, xAI, Perplexity, Google Gemini with Search grounding, Google Search Console for first-party AI Mode or AI Overviews evidence, and a licensed Microsoft Copilot preview surface. Meta AI is not represented as measured until a supported, verified integration is available. Reports identify the actual provider, API or first-party surface, model when returned, date, locale, citations, and measurement limitation.

4. Optional product learning

Product learning is a separate yes/no choice and is not required to receive the service. If Customer opts in, de-identified criterion labels, error categories, aggregate performance, and observation hashes may be considered for a separately governed evaluation dataset. Opt-in does not automatically make data eligible.

Direct identifiers, domain and brand names, full raw pages, customer-only artifacts, row-level Google data, and released report prose are excluded from cross-customer training datasets by default. Reidentification is prohibited. A customer may withdraw future use by emailing privacy@thisisgeo.ai.

5. How information is disclosed

We do not sell Customer personal information or expose one customer’s raw data in another customer’s report. We disclose information only as needed to operate the service, follow Customer instructions, protect rights and security, complete a business transaction with appropriate safeguards, or comply with law.

Service providers may include Cloudflare/OpenAI Sites for hosting and storage, WorkOS for authentication, Stripe for billing, Resend for transactional email, Google for connected analytics/search data, supported AI-search providers for authorized measurements, and HostGator for business email. Each receives only the information reasonably required for its role.

6. Google API data

Google connections are optional, read-only, and limited to properties the signed-in user selects. Search Console data represents overall Google Web search performance; we do not claim that Google exposes a documented isolated generative-AI filter. GA4 measures landed sessions only. Use and transfer of Google API data adheres to the Google API Services User Data Policy, including Limited Use requirements.

Customers may disconnect Google access and request deletion of retained connection data. Revocation stops future reads but does not automatically erase reports or audit records already lawfully retained.

7. Retention, deletion, and exports

Current private-beta policy generally retains raw scan and provider evidence for up to 365 days, normalized findings for up to 730 days, and released report/audit lineage for up to seven years unless a shorter contract, deletion request, legal hold, security need, or law requires otherwise. Approved deletion requests use a 72-hour safety window and tenant-scoped verification before execution.

Backup copies may persist until their scheduled rotation. We may retain minimized records required for contracts, billing, fraud prevention, legal compliance, security, and proof of deletion. Contact privacy@thisisgeo.ai to request access, correction, export, disconnection, or deletion.

8. Security and tenant isolation

We use server-side authorization, tenant-scoped storage, encrypted secrets and OAuth tokens, signed provider callbacks, bounded scanning, audit logs, and approval gates designed to prevent unauthorized access and actions. No security program can guarantee absolute protection. Report suspected issues to support@thisisgeo.ai.

9. Cookies, sessions, and site analytics

The application uses necessary authentication, session, security, and load-balancing cookies. Public pages use Google Analytics to measure visitors, sessions, acquisition sources, and page use. Analytics storage starts automatically; URL query strings are excluded, and Google Signals, advertising storage, advertising user data, and ad personalization remain disabled. Connected providers may set their own cookies when a user follows an authorization or checkout link.

10. Business users, location, and changes

The beta is intended for authorized business users, not children. Information may be processed in the United States and other locations where service providers operate, subject to applicable safeguards. We will post material changes with a new effective date and request renewed acceptance when the change materially affects the agreed service or data use.