Privacy Policy

Your account. Your email address, and the name you give your organisation and workspace. You can sign in with an emailed link or with a password. If you set a password we store only a hash of it, never the password itself, and we cannot read it or tell you what it is.

What you ask us to track. The brand names, domains and questions you enter. These are business details, not personal ones, but they are yours and we treat them as confidential.

What we collect on your behalf. The answers AI assistants give to your questions, and the sources those answers cite. These come from public AI services; we do not send them anything about you.

Usage. Pages visited, features used, and errors encountered, so we can tell a broken product from a quiet week.

We use a product analytics provider to record how the application is used, including session replay. Two limits are enforced in our code rather than by their settings, so they hold whichever provider we use:

Replay is disabled entirely on the sign-in pages and every authentication route. A sign-in link contains a working credential, and recording the address bar would put it in a third-party tool. Those parameters are also stripped from any URL we report anywhere.

Form inputs are masked by default, the opposite of the tool's own default, so a field is private unless someone deliberately marks it otherwise.

Card details.Payments go directly to Stripe. Card numbers never reach our servers; we hold only Stripe's customer and subscription identifiers, and which plan you are on.

Your passwords. There are none, anywhere.

We use third-party providers for hosting and databases, our job queue, email delivery, error reporting and product analytics. They process data only to provide those services to us.

Two are worth naming, because what they do affects you directly:

AI providers and data vendors. Collecting answers means sending your questions to AI services and to a data vendor that queries them on our behalf. We send them the question text and nothing else: never your identity, your account, or which brand the question belongs to.

Stripe handles payments. Card details go straight to them and never reach our servers.

A current list of our subprocessors is available on request at privacy@aimentiontracker.ai. We keep it out of this page deliberately: a named list here goes stale the first time we change a vendor, and a policy that is confidently out of date is worse than one that tells you how to get the current answer.

Your data is stored in the European Union. Some subprocessors above are United States companies and may process data outside the EU under the UK's international data transfer agreement or addendum to the EU standard contractual clauses. This means your information may be handled outside the United Kingdom. UK data protection law Principle 8 requires us to say so plainly, and this is us saying it.

Collected answers and the metrics derived from them are kept for as long as your account is open, because the product's value is the trend over time.

Delete your account and we remove your organisation, workspaces, brands, questions, collected answers and metrics within 30 days. Records we are legally required to retain, invoices chiefly, are kept for six years, as UK tax law requires.

Sign-in tokens expire after 15 minutes. Rate-limiting records are deleted within the hour.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email privacy@aimentiontracker.ai and we will respond within 30 days.

If you are in the EU or UK, you also have the right to object to processing, to restrict it, and to receive your data in a portable format. If you are unhappy with how we handled a privacy matter you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk — though we would rather you told us first so we can put it right.

We set a session cookie so you stay signed in, and a small number of analytics cookies. We do not use advertising cookies and we do not sell data to anyone, for any purpose.

If we change this policy materially we will email account holders before it takes effect. Questions go to privacy@aimentiontracker.ai.