What we do with your data, and what we never do.
Every item on this page matches a rule running in the product today. No statements of intent.
What we do
- We only scan public pages. We never ask for your site admin login.
- We don't store full AI answers. We keep only the short excerpt where the brand appears (up to 500 characters).
- Page content and AI answers are always passed to models as data; instructions inside them are never executed.
- Your data is stored in the European Union: both the database and scanning servers are in Frankfurt. For measurement we send prompts to AI providers in the US; measurement queries carry only the prompt text. For report summaries, brand names and scores go to Claude in the EU (AWS); if Claude is unreachable they may go to OpenAI (US) as a fallback.
- Each customer's data is separated at the database level. One agency's data never shows up for another.
- We offer two-factor authentication, and it's required for the owner on the Agency plan.
- Actions like deletion or removing a team member ask for your password or verification code again.
- We record important account actions in an activity log you can see in the app.
- When you delete your account we wait 30 days (you can change your mind), then delete permanently. Old data is removed when your plan's retention period ends.
What we never do
- We don't sell your data or use it for advertising.
- We don't send your account or identity details to AI providers; a prompt may contain only a brand name and domain.
- We never ask for passwords to other sites.
- A revoked or nonexistent share link shows the same "not found" message, so nobody outside can tell whether a link exists.
Subprocessors
Scroll sideways to see the whole table.
| Service | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication and file storage | Frankfurt, Germany (EU) |
| Amazon Web Services | Hosting for the website, dashboard and portals (Amazon EC2; content delivered through the Amazon CloudFront edge network), crawl and job servers, backups, report archive, Claude analysis in EU regions, transactional and notification emails (Amazon SES) | Frankfurt, Germany, eu-central-1 (EU); CloudFront edge locations in Europe and North America |
| Hetzner Online | Support mailbox (incoming and outgoing correspondence via the destek@ and security@ addresses) | Germany (EU) |
| OpenAI | Visibility measurement (ChatGPT answers); fallback for analysis (if Claude is unreachable) | USA |
| Anthropic | Visibility measurement (Claude answers, optional, Agency and Enterprise plans only) | USA |
| Visibility measurement (Gemini answers) and page speed data | USA | |
| Perplexity AI | Visibility measurement (Perplexity answers) | USA |
| Serper | Google search result data | USA |
| iyzico | Payment collection and card storage | Türkiye |
| Upstash | Rate limit counters and short-lived cache | Frankfurt, Germany (EU) |
| Cloudflare | Bot protection (Turnstile) | Global network |
| Sentry | Error tracking | EU |
| PostHog | Product analytics, only if you allow cookies | EU |
Certifications
We don't have an independent security certification yet. When we do, it'll be listed here.
Vulnerability disclosure
Found a vulnerability? Write to us through the contact form. We'll get back to you within 3 business days.