Privacy Policy

GenSight.AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Generative Engine Optimization (GEO) SaaS platform. We operate in compliance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and applicable United States privacy laws (including CCPA/CPRA).

1. Information We Collect

We collect information that identifies, relates to, or could reasonably be linked to you ("Personal Data") in the following categories:

• Account & Contact Information: Name, email address, company name, and job title when you register for a trial or premium account.
• Audit & Input Data: URLs, target niches, and metadata you submit into the GenSight Engine. Note: Public URLs submitted for auditing are not considered Personal Data, but any proprietary data entered into search parameters is processed under this policy.
• Billing Information: Payment details processed securely via our PCI-DSS compliant third-party payment processors (e.g., Stripe). We do not store full credit card numbers on our servers.
• Technical & Usage Data: IP addresses, browser type, operating system, and interaction metrics (e.g., audit generation history, PDF downloads) collected via server logs and application functionality.
• Connected-Site Crawl Data: if you connect a website you control to our Bot Analytics feature, we collect metadata about requests made to that site by identified AI crawlers only (crawler identity, requested page path, and timestamp). This data describes automated software agents, not people, and contains no personal data: we do not collect your visitors' IP addresses, and requests from human visitors are never recorded in any form.

Cookies & Local Storage

GenSight.AI does not use third-party tracking cookies, advertising pixels, or analytics services (such as Google Analytics). We do not track you across websites or share browsing data with any third party.

We use your browser's localStorage (not cookies) to store functional preferences such as your light/dark mode setting, active session email, and temporary audit data for page navigation. This data never leaves your browser and is not transmitted to our servers or any third party.

We also store a random visitor identifier in localStorage, together with how you first arrived at our site (the referring website and any campaign parameters in the link you followed). This identifier is sent to our servers with your page visits and with the actions you take here (running an audit, leaving your email, starting a checkout) so we can understand which channels bring visitors and how they move through the site. It contains no personal data, is not shared with any third party, and is not linked to your IP address; if you later sign in or purchase, it is associated with your account. Clearing your browser's site data removes it.

Our authentication system (Supabase Auth) may set a strictly necessary session token to maintain your login state. This is exempt from consent requirements under the UK GDPR, EU ePrivacy Directive, and PECR as it is essential for the service to function.

When you use our payment system, Stripe may set its own cookies on its domain (stripe.com) during checkout. These are governed by Stripe's own privacy policy and are not controlled by GenSight.AI.

Because we do not set any tracking, advertising, or non-essential cookies, a cookie consent banner is not required for our platform.

2. How We Use Your Data (Lawful Basis)

Under the UK/EU GDPR, we must have a lawful basis for processing your data. We utilize your data for the following purposes:

• Performance of a Contract: To generate GEO audits, render dashboards, deliver PDF artifacts, and manage your subscription.
• Legitimate Interests: To analyze usage trends, improve our deterministic scoring algorithms, and maintain the security of our infrastructure against scraping or API abuse.
• Consent: To send marketing communications, which you can opt out of at any time.

3. AI Processing & Third-Party Subprocessors

GenSight.AI utilizes Large Language Models (LLMs) to perform vector gap analysis. By using our service, you acknowledge that input data (URLs and target niches) are transmitted via secure API to third-party sub-processors (e.g., Google Cloud / Gemini API).

Strict Data Perimeter: We configure our enterprise API agreements such that your submitted data and audit results are not used by these third-party providers to train their foundational models.

Vercel Web Analytics (cookieless): We use Vercel's built-in privacy-friendly analytics to count aggregate page visits. No cookies are set, no localStorage is written, and no personal data is stored. IP addresses are immediately hashed using a daily-rotated salt that prevents re-identification beyond that 24-hour window. See Vercel's analytics privacy policy.

Connected Analytics Integrations

Our Bot Analytics feature lets you measure AI crawler activity on websites you control, through either of two mechanisms: authorizing us to read analytics from your Cloudflare account via an API token you create, or deploying a small GenSight-provided component in your own hosting environment.

What is collected: AI-crawler request metadata only, as described in Section 1 (crawler identity, page path, timestamp). Both mechanisms are designed so that no information about your human visitors reaches us: the Cloudflare integration requests only rows attributable to known AI crawlers, and the edge component inspects the crawler signature and records nothing for any other request.

Credentials: API tokens you supply are encrypted at rest and used solely to read the analytics required for this feature. You can revoke a token at any time in your Cloudflare account, which disables the integration. Upon disconnection you may request deletion of the crawl statistics we hold for your domain by contacting us.

4. United States Privacy Rights (CCPA/CPRA)

If you are a resident of California or a state with similar privacy frameworks, you have specific rights regarding your personal information. GenSight.AI does not sell or share your personal information to third parties for cross-context behavioral advertising.

5. Your European and UK Data Rights

If you reside in the EEA or the UK, you possess the following rights:

• The Right to Access & Portability: Request a copy of the personal data we hold about you.
• The Right to Erasure (Right to be Forgotten): Request the deletion of your account and associated personal data.
• The Right to Rectification: Correct inaccurate or incomplete data.
• The Right to Restrict Processing: Limit how we use your data under certain circumstances.

To exercise any of these rights, please contact us at contact@gensight.ai. We will respond within 30 days.

6. Data Security and Retention

We implement commercially reasonable technical and organizational measures to protect your data, including TLS encryption in transit and AES-256 encryption at rest. We retain Personal Data only for as long as necessary to fulfill the purposes outlined in this policy or to comply with legal obligations. If an account is deleted, audit history and associated data are purged from our active databases within 60 days.

7. International Data Transfers

As a global SaaS platform operating from the United Kingdom, your data may be transferred to, stored, and processed in the United States (where our cloud servers or API providers may be located). We ensure such transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the UK ICO and the European Commission.

8. Changes to this Policy

We may update this Privacy Policy to reflect changes in our technology or legal requirements. We will notify active users of material changes via email or a prominent notice on our platform.