GDPR

Your data, and what you can ask us to do with it

The same facts as the privacy page, arranged the way the regulation asks for them. Plain words, no legal fog.

Updated 3 September 2026.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a file you can take elsewhere, object to the way we use it, and complain to a supervisory authority. One address answers all of it, [email protected], within one month.

Data controller

Data we collect

A free check touches five things, and nothing else:

• The business facts you type into the form: name, website, town, country, language and trade. Those describe a business, not a household.
• Your email address, if you leave one for the weekly re-check, with the day you confirmed it and the day you stopped it.
• A keyed one way hash of your connection address, so the daily limit can count without us knowing whose connection it is. The address itself is never written down, not in the database and not in a log.
• The answers the assistants return, word for word, with the question we asked and what the call cost us.
• A staff marker called py_internal, which only somebody signing in to our admin panel is given, so our own test checks fall out of the numbers we publish.

Purpose

• To run the check you asked for and show it to you.
• To send the weekly mail, if you asked for it.
• To keep the daily limit, so a free tool stays free and a script cannot spend our vendor budget.
• To trace every number we publish back to the answer it came from.

Legal basis

You asked for the check, so running it and showing it to you is the service you requested (Article 6(1)(b)).

The report by mail is consent, asked for twice: once when you type the address, once when you click confirm in the mail we send. Nothing is sent to that address before the second click (Article 6(1)(a)).

The hashed connection and the plain counters keep a free tool free and let us see whether it works at all. That is our legitimate interest (Article 6(1)(f)), and it is why neither of them holds a name or an address.

The do not mail record is kept so that an objection stays honoured. Forgetting that somebody unsubscribed is exactly how people get mailed again, and the regulation asks us not to (Article 21).

Sharing and transfers

The companies the privacy page names, and nobody else. Each one gets the least it needs to do its job.

OpenAI and Perplexity are in the United States and receive the question only: the business name, the town and the trade inside it. The search data provider receives the same. Nothing about you personally goes with any of it, and the transfer rests on the data protection terms in each vendor contract.

Your email address goes to the company that carries our mail and to nobody else, and that mail is delivered from servers inside the EU. No email address of yours leaves the EU.

The full list, with what each company gets

Retention

The AI answers stay, as they were returned. They are the evidence behind every count we ever showed anybody, the record of what each call cost us, and our sample of how the assistants behave over time. When a business is erased, everything that names it is removed from our records and the answers are kept under an anonymous business entry: nobody but our staff can open them, and no count about that business is ever shown again.

Your email stays with the check you left it on until you ask us to erase it, with one exception: an address that was never confirmed is deleted 30 days after it was typed, because the consent it was waiting for never came. Unsubscribing stops the mail that minute and keeps one row as a do not mail record, because forgetting that you unsubscribed is exactly how people get mailed again.

The hashed connection is kept for 30 days and then removed from the check. The daily limit only ever looks at the last 24 hours; the rest of the month is for spotting abuse. The plain counters are kept as they are.

Your rights under GDPR

• Access. A copy of what we hold about you.
• Rectification. A correction of anything that is wrong.
• Erasure. Your address, the confirmation record and everything that names your business go. The AI answers stay as anonymous samples, unless the business is you, a sole trader under your own name: say so and they go too.
• Portability. The same copy in a file you can hand to somebody else.
• Objection. Tell us to stop, including any mail about a check, which one click stops anyway.
• Complaint. The State Data Protection Inspectorate in Vilnius (vdai.lrv.lt), or the authority where you live.

An answer is what an assistant said in public about a town and a trade, and it may name a business, exactly as a search result would. A company's name is not personal data, so the answers about a company stay. If the business is you, a sole trader working under your own name, tell us at [email protected], or tick the box when you delete your account, and the answers about your business go too.

Cookies

One session cookie, which the site needs to keep your session and to protect the form. One staff marker, py_internal, which only somebody on our team is given when they sign in to the admin panel. No advertising cookie, no analytics cookie, no third party script.

Children

This site is for people aged 16 and over. It measures what AI assistants say about a business, and there is nothing here for a child.

How to exercise your rights

Write to [email protected] and say what you want done. We answer within one month, which is what the regulation allows, and usually within the week. We may ask one question to be sure which business or which address you mean, and we ask for nothing else.