Privacy Policy

Account information. Your name, email address, and sign-in details, handled by our authentication provider (Clerk), and the name of any team workspace you create or join. Clerk stores passwords; we never see them.

Billing information. Stripe processes payments. We don’t receive or store full card numbers. We keep your Stripe customer ID, a saved-card reference if you turn on auto-refill, your auto-refill settings, and a record of each purchase and each billable action (amount, date, and what it was for).

Content you submit. Brand and competitor names, domains, prompts, keywords, and the results we generate, including AI engines’ answers and the sources they cite. When you check, crawl, or audit a website, we fetch its public pages and store what we find.

AEBOT conversations. Your messages to the in-app assistant and its replies, files or designs you upload to it, and the notes it keeps about your sites and brand (for example your positioning and competitors) so it can pick up where you left off. You can delete notes on the Memory page.

Connected accounts. If you connect Google, the email address of that Google account, encrypted access tokens, and the Google Analytics and Search Console data we read for you (see section 5). If you pair a WordPress site, its URL and name, an encrypted connection key, the permissions you granted, and a record of changes made through AuditAE, including the previous version of what was changed.

AI assistants, agents, and the API. If you connect an AI client (such as Claude, ChatGPT, or Cursor) over MCP or use our API, we receive the tool calls it sends (tool name, inputs such as a domain or prompt, and which workspace made the call), not the rest of your conversation with it. We keep a log of each tool call for 180 days, to run and improve the Service: the tool, a summary of its inputs (such as domains, page addresses, brand names, keywords, and questions, but not page content you send to edit), the calling app’s name and user-agent string, and, for calls without an account, a hashed IP address. When an account or team workspace is deleted, its input summaries are removed from the log. API keys are stored only as a one-way hash. If an AI agent pays per call without an account, we create an agent workspace and keep a record of each payment (amount, method, and the processor’s or blockchain transaction reference).

Free tools. When you use a free tool (the free AI visibility check, the AI Search Audit, or the schema generators), we store what you enter (brand, domain, prompt, or URL), the results, your IP address, the page you ran it from, and your email address if you ask us to email you the report. With a free AI visibility check we also store the website that linked you to us (its domain only, not the full address) and any campaign tags in the link you arrived on (utm_source, utm_medium, and utm_campaign). With the AI crawler checker we log the domain you checked and count runs by the website that linked you to it (its domain only) or its campaign tag; that count isn’t linked to your IP address.

Website chat and documentation assistant. Messages you send to the chat on our website and the replies, with a one-way hash of your IP address, your browser’s user agent, and the page you were on. Questions you ask the documentation assistant in the dashboard, linked to your account.

Support and email. Support requests you send us, emails you send to AuditAE addresses, and a log of the emails we send you (recipient, subject, and delivery status), including whether you unsubscribed.

Agency and client details. If you use AuditAE for clients, the client names and email addresses you add, the reports you send them, and any client portal you create.

How you found us. If you accept cookies and arrive through a tagged link (for example an ad or a referral link) or from another website, we record the campaign or referring site and the page you landed on, and save them with your workspace when you sign up. Separately, and without cookies, a free AI visibility check records the referring website’s domain and the campaign tags in the link you arrived on, stored with the check itself. We use them only to see which sites and campaigns bring people to AuditAE. If you used one of our free tools before signing up, we link that check to your new workspace (through the sign-up link on that check, or by the email address or website you entered), and save the check’s referring website and campaign source with it, to learn which tool and which site or campaign brought you.

Usage, device, and security data. Server logs (IP address, browser, pages and API endpoints requested, errors, and times), bot-detection signals used to protect our forms and chat, and, if you accept cookies, analytics about how you use the site (section 6).

• To provide the Service you asked for: run audits and checks, operate AEBOT, act on connected accounts at your direction, send reports, and keep your workspace working (performance of our contract with you).
• To bill you, keep accounting records, and meet tax and legal obligations (contract and legal obligation).
• To keep the Service secure: detect bots, enforce rate limits and free-tier limits, prevent fraud and abuse, and debug problems (our legitimate interests in running a safe, reliable service).
• To communicate with you: account and billing notices, product updates about your account, replies to support, and, where allowed, marketing emails you can unsubscribe from (contract, legitimate interests, or consent where required).
• To improve AuditAE and understand how it is used, using analytics only if you accept them (consent) and aggregated usage data (legitimate interests).
• To comply with law and protect our rights, including responding to lawful requests and enforcing our Terms.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

AuditAE is built on AI models. To provide a feature, we send the content it needs to the relevant AI provider: prompts to the AI engines being checked (OpenAI, Google, and Perplexity, and DataForSEO for Google AI Overviews and AI Mode); and your messages, uploaded files, AEBOT’s notes, and any data AEBOT reads for you (including Google Analytics and Search Console data) to Anthropic, which powers AEBOT, the website chat, the documentation assistant, and parts of our analysis. AEBOT’s notes about your workspace are stored with Anthropic.

We don’t use your content or personal data to train AI models, and we use these providers through business APIs whose terms restrict them from training their models on the data we send. AI output can be inaccurate; see our Terms.

We don’t sell your personal information. We share it only as follows:

Service providers that process data for us under contract, only to provide their service:

• Clerk: sign-in and account management
• Stripe: payments, saved cards, receipts, and agent payments
• Supabase: our database
• Vercel: hosting, bot detection (BotID), and cookieless web analytics
• Upstash: rate limiting (keyed by IP address or account)
• Resend: sending and receiving email
• Anthropic, OpenAI, Google (Gemini), and Perplexity: AI processing (section 3)
• DataForSEO: search, keyword, backlink, and AI-answer data
• Google PageSpeed Insights: page-speed tests on URLs you audit
• Google (Analytics and Ads), OpenAI (ChatGPT Ads) and Microsoft (Clarity): analytics and ad measurement, only if you accept cookies (section 6)

People you choose to share with. Shared report links, group scorecards, and client portals can be opened by anyone with the link. Reports you send to clients go to the addresses you enter. WordPress sites you pair receive the changes you make and can display your AuditAE figures in their admin dashboard.

Legal and safety. When we believe in good faith it’s required by law or legal process, or needed to protect the rights, property, or safety of AuditAE, our users, or others, including to prevent fraud and abuse.

Business changes. To a company formed to operate AuditAE, or to a successor in a merger, acquisition, financing, or sale of assets, subject to this policy.

When you connect a Google account we request these scopes, each used only for the feature listed, plus openid to read the account’s email address so you can see which account is connected:

• Google Analytics (read-only), analytics.readonly: we list your GA4 properties so you can pick one per site, then read traffic and conversion metrics for it. We never change or delete GA data.
• Search Console (read-only), webmasters.readonly: we list your verified sites so you can pick one, then read query, page, and click data for it. We never change or delete Search Console data.
• Gmail (send-only), gmail.send: we send an email from your account only when you, or AEBOT at your request, trigger a send. We can’t read, list, or delete your mail.
• Drive (app files only), drive.file: we can create and edit only files AuditAE created for you, such as exported reports. We can’t see your other files.

Where it goes. Data we read from Google is shown to you in your dashboard, used to answer your questions in AEBOT (which sends it to Anthropic to generate the answer, section 3), and shown on client portals and in your WordPress dashboard widget only if you turn those on. Tokens are encrypted (AES-256-GCM) and stored server-side; they are never sent to your browser. You can revoke access at any time under Integrations in your dashboard, which deletes our copy of the tokens, or from your Google Account permissions page.

Limited Use. AuditAE’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above; we don’t transfer it except as needed to provide those features (such as to our AI provider), to comply with law, or in a merger or acquisition; we don’t use it for advertising; we don’t let humans read it except with your permission, for security, to comply with law, or in aggregated and anonymized form for operations; and we don’t use it to develop, improve, or train generalized AI or machine-learning models.

Essential (always on). Needed for the site to work and stay secure, so they don’t require consent: sign-in session cookies (Clerk), bot detection (Vercel BotID), a short-lived cookie that protects the Google connection flow, your cookie choice (aae_consent), and preferences stored in your browser such as theme, sidebar state, and the website chat session.

Analytics and advertising (only if you accept).

• Google Analytics (_ga cookies): how visitors use the site.
• Google Ads (_gcl cookies): measures whether our ads lead to sign-ups. When you sign up, a one-way hash of your email address is sent to Google to match the conversion (enhanced conversions).
• ChatGPT Ads (OpenAI’s measurement pixel and its cookies): measures whether our ads in ChatGPT lead to sign-ups, free-check leads, checkout starts and credit purchases. It records the pages you view on this site and those events, with the purchase amount. To match those events to ChatGPT ad clicks, it may also send a one-way hash of an email address, phone number or name you type into a form on this site.
• Microsoft Clarity (_clck, _clsk and Microsoft cookies): heatmaps and session replays of how pages are used, with form inputs masked. See the Microsoft Privacy Statement.
• Attribution (aae_ref, aae_land, 90 days): the campaign or referring site and the landing page you arrived from.

We also use Vercel Web Analytics, which counts page views, clicks on sign-up and other call-to-action links, chat opens and first messages, and free-check form submissions and errors, without cookies or identifying you across sites, so it runs whatever you choose in the cookie banner. A free AI visibility check records the referring website’s domain and any campaign tags with the check itself, also without cookies (see “Free tools” above).

Your choice. These stay off until you click Accept in the cookie banner. You can change your choice at any time in Cookie settings (also linked in the footer); rejecting after accepting deletes these cookies. If your browser sends a Global Privacy Control signal, we treat it as a rejection automatically. Your choice is stored for up to 6 months.

We send emails needed to run your account (sign-up, receipts, low balance, auto-refill and billing notices, audit and report results, support replies), which you can’t opt out of while you have an account. If you give us your email in a free tool, we send the report you asked for and may send a short follow-up about AuditAE. We may also email business contacts about AuditAE where the law allows. Every marketing email has an unsubscribe link, and we honor unsubscribes promptly.

• Account data, content, and history: for as long as your account is open, and deleted within 30 days after you ask us to delete your account, except as below.
• Billing and payment records: for as long as tax and accounting laws require (generally up to 7 years), even after your account is deleted.
• Free-tool submissions, website chat transcripts, and leads: for as long as they’re useful for the purpose they were collected for and for preventing abuse, and deleted sooner if you ask.
• Rate-limit records (IP address or account ID): expire automatically, within 48 hours for most limits. The AI crawler checker’s record of your one free check without an account expires after 30 days.
• AI assistant, agent, and API call log: 180 days.
• Connected-account tokens: until you disconnect the account or delete your AuditAE account.
• Unsubscribe records: kept so we keep honoring your choice.

Data in backups is deleted as backups rotate. We may keep information longer where the law requires it or to resolve disputes, prevent fraud, or enforce our Terms.

When an agency or other customer adds information about its own clients (for example a client’s name and email, or a client’s analytics data) or connects a client’s website or accounts, we process that data on the customer’s behalf and on its instructions. The customer is responsible for its own privacy notices and for having a lawful basis. If you are one of their clients, please contact that customer first; we will help them respond.

We protect data with encryption in transit (TLS), encryption of connection tokens and keys at rest, one-way hashing of API keys, access controls that limit who and what can reach production data, bot detection, and rate limiting. No system is perfectly secure. If a breach affects your personal data, we will notify you and any regulator as the law requires.

AuditAE is based in the United States, and we and our service providers process data in the United States and other countries. Where the law requires, such as for data from the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and our providers’ data processing terms.

Everyone can ask us to access, correct, export, or delete their personal data, and can unsubscribe from marketing emails, change cookie choices, disconnect connected accounts, and delete AEBOT notes.

EEA, UK, and Swiss residents also have the right to object to or restrict processing based on legitimate interests, to withdraw consent at any time (without affecting earlier processing), to data portability, and to complain to their local data protection authority.

California and other U.S. state residents have the right to know what personal information we collect, use, and disclose; to access, correct, and delete it; to opt out of its “sale” or “sharing” for cross-context behavioral advertising and of targeted advertising; and not to be discriminated against for using these rights. We don’t sell personal information for money. If you accept cookies, the Google Ads, ChatGPT Ads and Microsoft Clarity cookies may count as “sharing” or targeted advertising under those laws; clicking Reject, choosing Reject later in Cookie settings, or sending a Global Privacy Control signal opts you out. We don’t use or disclose sensitive personal information to infer characteristics about you. In the last 12 months we collected the categories described in section 1 (identifiers, commercial information, internet activity, approximate location derived from IP address, and professional information), for the purposes in section 2, and disclosed them to the recipients in section 4.

How to make a request. Email support@auditae.app from the address on your account, or tell us how to reach you. We will verify your request, which may mean confirming control of the email address, and respond within the time the law requires (usually 30 to 45 days). You can use an authorized agent, and we may ask for proof of their authority. If we decline your request, you can appeal by replying to our decision, and we will explain the outcome.

AuditAE is for businesses and professionals and is not intended for anyone under 18. We don’t knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. For material changes we will update the date above and notify signed-in users by email or in the product before the change takes effect.

Privacy questions and requests: support@auditae.app. Mail: AuditAE LLC, 8735 Dunwoody Place, Suite #10831, Atlanta, GA 30350.