Privacy policy
OpenAEO collects the minimum it needs to audit your site and show you the result: the domain you ask us to audit, and — if you choose to give it — your email address. We do not sell your data, we do not run advertising trackers, and we do not build profiles on you. This page lists exactly what is stored, who it is shared with, and how to have it deleted. Last updated 30 July 2026.
What we collect
When you run an audit: the domain or URL you submit, and the results our crawler computed from that page. If you are not logged in, this is not attached to any identity.
When you give us your email for the full audit: your email address, the domain you audited, and that audit's result, so we can send you the report and know what you asked about.
When you create an account: your email address and a salted, hashed password (we never store the password itself). We also store the audits, citation tests, target prompts, competitor domains, and server-log excerpts you choose to save.
If you connect Google Search Console or Analytics: a refresh token that lets us read your search-performance and referral data. It is read-only, we never write to your Google account, and you can revoke it at any time from your Google account permissions.
Automatically: your IP address is used transiently for rate limiting (to stop abuse). We do not use advertising or analytics cookies. The only cookie we set is a session cookie that keeps you logged in.
Who we share it with
We share data only with the service providers needed to run the product, never with data brokers or advertisers:
- Netlify — hosting and data storage.
- Stripe — payments. Card details are entered on Stripe's own page and never touch our servers; we store only the last four digits and your plan.
- AI providers (OpenAI, Anthropic, Perplexity, Google) — when you run a citation test, your target prompts are sent to these assistants to check whether you are cited. Do not put confidential information in your prompts.
- Resend — sending transactional email (your report, password resets).
- Google — only if you connect Search Console or Analytics, to read your own data.
How long we keep it
Account data is kept while your account exists. Audit history is capped at the most recent 200 runs per account and citation runs at the most recent 52. Lead emails are kept until you ask us to remove them. Delete your account or email us and it goes.
Your rights
Wherever you live, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it — including the email address you gave for a report. If you are in the UK, EU, or a similar jurisdiction, these are your rights under the GDPR: access, rectification, erasure, restriction, portability, and objection. Email [email protected] and we will action it within 30 days. You can also complain to your local data-protection authority.
Our lawful basis is: performing the service you asked for (running audits, your account), and our legitimate interest in product updates to people who gave us their email — which you can stop at any time by replying to any email or writing to the address above.
Children
OpenAEO is a business tool and is not directed at anyone under 16. We do not knowingly collect their data.
Changes
If this policy changes materially, we will update the date at the top and, for account holders, say so by email. Questions go to [email protected].
Updated