Privacy policy

Last updated 16 September 2026

Written to be read. It says what is collected, why, who else touches it, and how to have it removed.

Data controller Bedi SEO Mohali, Punjab, India [email protected]

1. What we collect

Account: email address, a name if you enter one, a hashed password, your plan, and the day you chose for the weekly email.
Businesses you track: the business name, its website, other names it goes by, its country and city, what our reader concluded it sells, the questions tracked, and every answer collected from AI systems about those questions.
Use of the site: server logs with IP address, time and page requested, kept for up to 30 days for abuse prevention and debugging. No analytics or advertising trackers are installed.
Public question finder and free check: the business name and website you enter, your IP address (for the daily limit), and the result, kept for 24 hours unless you sign up, in which case the result moves into your account.
Messages you send us: the contact form or email, kept as long as needed to answer and for our records.
Optional Google Analytics connection: if you connect your Google Analytics account, we read session data for the one GA4 property you choose — counts of sessions by source, landing page and date — to show which visits came from AI assistants. Details in section 8.
Optional visit snippet: if you paste our script on your own website, it records a visit only when a visitor arrived from an AI assistant (ChatGPT, Perplexity, Gemini, Copilot, Claude and similar). What is kept: the AI's name, the page path, the referring site and the time. What is not: cookies, IP addresses, or anything identifying the visitor. Ordinary visitors send nothing.

2. Why we use it

To run the service you signed up for: reading your website, writing and asking questions, storing the answers, showing your dashboard, sending your weekly email and monthly report.
To keep the service working and fair: rate limits, abuse prevention, fixing faults.
To answer you when you write to us.
To bill you for a paid plan.

The legal bases are performance of our contract with you, our legitimate interest in running a secure service, and, for any marketing email, your consent — which we do not currently ask for, because we do not send marketing email.

3. Who else processes it

Railway (hosting and database, United States).
Cloudflare — sits in front of the website to block abusive traffic and deliver email sent to our addresses; it sees the request metadata any web host sees.
Google — only if you connect Google Analytics: we call the Google Analytics Data API to read the sessions described in section 8. Google's own handling of your account is governed by Google's privacy policy.
DataForSEO — sends your tracked questions to ChatGPT, Gemini and Google as anonymous queries. Nothing identifying you is included.
Anthropic — receives the public text and page list of the website you track, to read what the business sells and write questions.
Resend — delivers the weekly email, monthly report and contact-form messages.
Razorpay — handles payments; we receive a payment reference and the plan, never card details.

We do not sell personal data and do not share it with advertisers.

4. How long we keep it

Account and business data: for as long as the account exists. Removing a business deletes its data immediately; deleting the account deletes everything within two working days.
Server logs: up to 30 days.
Free check and question-finder results: 24 hours.
Emails to us: as long as needed for the matter, then archived for our records.

5. Your rights

Wherever you are, you can ask us to show you the personal data we hold, correct it, delete it, export it, or stop a particular use. Email [email protected] from the account address. We answer within 30 days, usually much sooner. Residents of the EU/EEA and UK also have the right to complain to their data-protection authority; residents of India have the rights set out in the Digital Personal Data Protection Act, 2023.

6. Cookies

One cookie: the session that keeps you signed in. It holds a random token, not your email. There are no tracking cookies.

7. Children

The service is for businesses and is not directed at anyone under 18.

8. Google user data (Google Analytics connection)

This section applies only if you choose to connect Google Analytics. It is written to meet the Google API Services User Data Policy, including its Limited Use requirements.

What we ask for. One permission: read-only access to Google Analytics (analytics.readonly). We cannot change anything in your Analytics account, and we do not ask for access to any other part of your Google account.
What we read. For the single GA4 property you pick, aggregate session counts grouped by source, landing page and date, plus engagement rate, average session length and key-event counts — the numbers needed to show visits that arrived from AI assistants against your other traffic. We do not read user-level or identifying data, and we do not read other properties.
What we store. The connection token Google issues, encrypted before it is written to the database with an authenticated cipher whose key lives only in the server's environment (never in the database or in code); the property ID you chose; and the daily aggregate counts we derived. We do not store raw Google Analytics reports.
How it is protected. All transfers use TLS. The encrypted token is never returned by any API response and never shown in any page. Only you can see your visit numbers, signed in to your account; staff access the underlying data only at your request, to resolve a support problem, and only for that purpose.
What we do with it. Only to display your AI-visit numbers to you and include them in your own reports and emails.
What we never do. We do not sell Google user data, share it with third parties, use it for advertising, transfer it to data brokers, use it to build profiles, or use it to train or improve AI or machine-learning models — ours or anyone else's. Humans do not read it except as described above, with your permission, for security, or where the law requires.
How long, and how to stop. Click Disconnect on the Visits card, or remove the business, and the token and the property ID are deleted immediately; the derived daily counts are deleted with the business. You can also revoke our access at any time at myaccount.google.com/permissions, after which we can no longer read anything.
Limited Use. AI Visibility Tracking's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Changes

If this policy changes in a way that matters, the date at the top changes and account holders are told by email before it takes effect.