Privacy
What we store, and who sees it
Plain words, no legal fog. If any of this stops being true, this page changes before anything else does.
Who is asking
PicksYou, Vilnius, Lithuania.
PicksYou is made and run from Vilnius, and whoever runs it decides what happens to everything described on this page. The company behind it is being registered; the day it exists, its name, its number and its address appear here and on the imprint.
Write to [email protected] about anything on this page. A person reads that address.
What we store
A free check stores five things:
- The business facts you typed: name, website, town, country, language and trade. Those describe a business, not a household.
- The answers the assistants gave, word for word, with the exact question we asked and what the call cost us.
- Your email address, if you leave one for the weekly re-check, with the day you confirmed it and the day you stopped it.
- A one way hash of your connection address, so the daily limit can count without us knowing whose connection it is. The address itself is never written down, not in the database and not in a log.
- Plain counters: which step of the checker happened, in which language, and which site you arrived from (the host name, nothing longer).
There is no account here yet, so there is no password, no card and no payment.
What we never do
No tracking script, no advertising cookie, no third party analytics. The only cookie is the session cookie the site needs to remember your language and to protect the form.
There is one more cookie in the code, and you will never be given it. When somebody on our team signs in to the admin panel, their browser gets a marker called py_internal, so our own test checks can be left out of the numbers we publish. It holds the number one and nothing else, it says nothing about a person, and only the staff sign-in page sets it.
We do not sell or rent anything about you, and your email goes to nobody except the company that carries our mail.
We never publish your results. A results page is private to whoever holds the link, it tells search engines not to index it, and robots.txt disallows it as well.
Why we are allowed to
You asked for the check, so we run it and show it to you. That is the service you requested (GDPR Article 6(1)(b)).
The weekly email is consent, and we ask for it twice: once when you type the address, once when you click confirm in the mail we send. Nothing weekly goes out before that second click (Article 6(1)(a)).
The hashed connection and the plain counters keep a free tool free and let us see whether it works at all. That is our legitimate interest (Article 6(1)(f)), and it is why neither of them holds a name or an address.
Which companies see it
Seven, and each one gets the least it needs to do its job:
- OpenAI. Gets the question we ask ChatGPT, and the answer text back when we read which businesses were named in it. Never your email.
- Perplexity. Gets the question we ask it. Nothing else.
- xAI. Gets the question we ask Grok, on the days Grok is switched on. Nothing else, and never your email.
- DataForSEO. Looks things up on our behalf, so it gets the question, or the business name and town, or the website address. It is how we read Google AI Overviews, the Google Maps listing, the "best in town" pages and the Bing index.
- Cloudflare. Sits in front of the site, and its Turnstile challenge on the form checks that a person, not a script, is spending our vendor money. It sees your connection address and the request.
- SMTP2GO. Carries our mail from EU servers, so it gets your email address and the mail itself.
- OVH, in France. The machine the site, the queue and the database run on. Everything we store sits there.
Hosting and mail are in the EU. The AI vendors and the search data provider are not, so the question, the business name and the town travel to their servers. We send them nothing about you personally, and that transfer rests on the data protection terms in each vendor contract.
How long we keep it
The AI answers stay. They are the evidence behind every count we ever showed you, and a count whose answer has been thrown away is a claim, not a receipt.
Your email stays while the weekly check runs, which is twelve weeks unless you keep it going with one click. Unsubscribing stops the mail that minute and keeps one row as a do not mail record, because forgetting that you unsubscribed is exactly how people get mailed again.
The hashed connection and the counters are kept as they are. Nothing here is deleted on a timer yet, and a deletion job we have not written is not a promise we are going to make. What we do promise is the next paragraph.
What you can ask for
Write to [email protected] and we act within 30 days: a copy of what we hold about you, a correction, or deletion. Deletion removes your email, the confirmation record and the check attached to it.
We keep the AI answers about the business, because they are what an assistant said in public about a business and they are the evidence under our numbers. If the business is you, a sole trader working under your own name, say so and the business and its answers go too.
You can also complain to a data protection authority: the State Data Protection Inspectorate in Lithuania (vdai.lrv.lt), or the one where you live.
Changes to this page
When we add a vendor, keep something longer, or start deleting on a timer, this page says so on the day it happens and the date at the top moves.