Privacy Policy

• Account data: your email and authentication identity, handled by Supabase Auth on our behalf.
• Audit data: the URL(s) you submit, the pages our crawler visits on that site, and the report we generate. We do not need or ask for your website's login credentials.
• Billing & Payment data: we never see, process, or store your payment card numbers, expiry dates, or CVV codes. Subscription and one-off payment processing is managed by our payment processor and Merchant of Record, Paddle, which receives your billing details directly and complies with PCI-DSS Level 1 standards. We store only the subscription ID, status, and plan details reported back to us.
• Usage data: logs of audit runs, credits spent, and (for AI Task Completion runs) the step-by-step actions an AI browser agent took, which we keep so you can review what the agent actually did.

To run the audit you asked for, show you its report and history, meter credits against your plan, bill your subscription, send the account and product emails you've opted into (scheduled report emails, alert notifications), and improve the accuracy of the audit engines themselves.

We share data with the processors we use to run the Service, each acting under its own privacy terms:

• Supabase: authentication and our database.
• Paddle: subscription and payment processing.
• OpenAI: the AI models behind AI Task Completion, AI Visibility's prompt probes, and the AI Usability agent flows. The content sent is what's necessary to run the check you requested (page content, the task you described), not your account credentials.
• Google (Gemini): an alternative AI model you can choose for some checks. It receives the same kind of content as OpenAI above, and only when you pick it.
• Browser Use: hosted browsers that some audits run in. They load the site you asked us to check; your account details are not sent.
• Google Analytics: only if you accept analytics cookies; see section 4 for exactly what it receives.
• Our email provider: delivers sign-in, alert and scheduled-report emails to the address you gave us.
• Google's favicon service : when the app shows a site icon (next to a run, for a workspace, or for the site you enter when setting one up), your browser requests it directly from Google, which sees that domain and your IP address. This trades a small disclosure for reliably showing an icon for almost any site; it does not go through our servers.

We do not sell your data, and we do not share the content of your audits with anyone other than these processors and you.

Some storage is needed for the Service to work, and one kind is optional. You choose the optional one when you first visit, and can change your mind at any time from "Cookie settings" in the footer.

• Sign-in session (necessary): when you sign in, your browser's local storage keeps your session so you stay signed in. Signing out removes it.
• Your cookie choice (necessary): we remember whether you accepted or declined analytics, so we don't ask on every visit.
• Checkout (necessary): when you open the payment window, Paddle may set its own cookies to process the payment and prevent fraud, under its privacy policy.
• Google Analytics (optional, only if you accept): cookies named _ga that let us count visits and see which pages people use. We send page paths and product events (for example "an audit was started" and its type), never your email, your name or the address of a site you audit. Advertising features and Google signals are switched off. If you decline, Google Analytics is not loaded at all; if you later withdraw consent, we stop collection and delete these cookies.

We don't use advertising or cross-site tracking cookies, and our fonts are served from our own domain.

Audit history is kept for as long as your account exists, so you can track trends over time. You can delete a workspace, which removes its schedules, alerts, and run history; ledger rows for credit accounting are retained even after a workspace is deleted, since they're the record of what was already paid for and consumed.

You can delete your account yourself at any time from the Danger zone at the bottom of Settings. This cancels any active subscription and permanently removes your profile, workspaces, reports, schedules and alerts; anonymised usage records needed for credit and billing accounting are kept without your identity attached. You can also request a copy of your data, or ask us to delete your account, by contacting us below.