Privacy Policy

• Account registration: your name, email address, and password (or magic-link credential). We use a secure authentication system and never store plaintext passwords.
• Organisation profile: your company name, website URL, industry, and any business information you enter when setting up your AIO account.
• Platform content: prompts, competitor names, keywords, and other business data you input into the Platform to generate AI visibility reports and recommendations.
• Communications: emails, support tickets, or messages you send to us, including their content and metadata.
• Free report requests: your name, email address, and website URL submitted through our free AI visibility report tool.
• Team member invitations: email addresses of colleagues you invite to join your Organisation on the Platform.

• Device and browser data: IP address, browser type and version, operating system, device type, screen resolution, and time zone.
• Usage data (website): pages visited, time spent on each page, referring URLs, links clicked, scroll depth, and navigation paths across our marketing website.
• Usage data (dashboard): features accessed, prompts run, reports generated, reports downloaded, team actions, billing actions, and session duration within the authenticated Platform.
• Authentication tokens: session tokens stored in your browser's localStorage to keep you logged in. These are cryptographically signed and expire automatically.
• Log data: server-side logs recording API requests, timestamps, response codes, and error events for security monitoring and debugging purposes.

All payment processing is handled by Stripe, Inc., a PCI DSS-compliant payment processor. We do not store, transmit, or have access to your full card number, CVV, or bank account details. When you subscribe to a plan:

• Stripe collects and processes your card or payment method details directly.
• We receive a tokenised payment method reference, the last 4 digits of your card, card brand, and expiry date.
• We store your Stripe customer ID, subscription ID, plan details, billing history, and invoice records.
• We receive webhook events from Stripe (e.g. payment succeeded, subscription cancelled) to update your account status.

Stripe's privacy policy is available at stripe.com/privacy.

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: session tokens and authentication state stored in localStorage. These are required for the Platform to function and cannot be disabled. They do not track you across other websites.
• Preference cookies: storing your cookie consent choice (aio_cookie_consent) and UI preferences. These expire after 1 year.
• Analytics cookies (with consent): Google Analytics 4 (_ga, _ga_*, _gid) to measure website traffic, page views, and user journeys. These are only set after you accept analytics cookies. GA4 data is anonymised, with IP anonymisation enabled. Data is retained for 26 months.
• Stripe cookies: Stripe may set cookies during the checkout process for fraud prevention and payment security. These are governed by Stripe's cookie policy.

You can manage your cookie preferences at any time via our cookie consent banner or our Cookie Policy page. Withdrawing analytics consent does not affect the lawfulness of prior processing.

• AI engine data: when our Platform queries AI engines (ChatGPT, Claude, Gemini, Perplexity, Grok) to generate visibility reports, the responses - including citations, rankings, and summaries - are stored and associated with your account.
• Public web data: our crawlers may index publicly available web pages associated with your domain to assess crawlability and structured data. We do not access password-protected content.

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data, subject to our legal retention obligations.
• Right to restrict processing: ask us to pause processing in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format (e.g. JSON or CSV).
• Right to object: object to processing based on legitimate interests, including direct marketing (we will always honour marketing opt-outs).
• Right to withdraw consent: at any time, where processing is consent-based.

To exercise these rights, email [email protected]. We will respond within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ICO) (UK) or your local supervisory authority (EEA).

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the third parties we share it with.
• Right to Delete: request deletion of personal information we have collected, subject to certain exceptions (e.g. completing a transaction, legal compliance).
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information and do not share it for cross-context behavioural advertising. No opt-out is required, but you may contact us to confirm this.
• Right to Limit Use of Sensitive Personal Information: we do not collect sensitive personal information as defined by the CPRA beyond what is necessary to provide the service.
• Right to Non-Discrimination: we will not deny you services, charge different prices, or provide a lower quality of service because you exercised any of these rights.

To exercise your California rights, email [email protected] with the subject line "California Privacy Request". We will verify your identity and respond within 45 days (extendable by a further 45 days with notice). You may designate an authorised agent to submit requests on your behalf.

We do not knowingly collect personal information from California residents under 16 years of age. If we learn we have done so, we will delete it promptly.

Residents of Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of certain processing. We honour these rights on request - email us at [email protected].

We share data with trusted third-party providers who process it on our behalf under written data processing agreements:

• Stripe - payment processing and subscription management.
• Supabase / PostgreSQL - database hosting and user authentication.
• Google Analytics - website and app analytics (consent-only).
• AI API providers (Anthropic, OpenAI, Google, Perplexity, xAI) - when our Platform queries these services to generate AI visibility data for your account. Queries contain your business domain and prompt text, not your personal contact details.
• Email delivery provider - sending transactional and marketing emails on our behalf.
• Cloud infrastructure - hosting, storage, and content delivery. Our primary infrastructure is located in the EU/UK.

We may disclose personal information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law or respond to valid legal process (e.g. subpoenas, court orders); (b) protect the rights, property, or safety of AIO, our users, or the public; (c) detect and prevent fraud or security incidents.

If AIO is acquired, merges with another company, or sells all or part of its assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.