Privacy

Only what the product needs to work:

Your account

The email address you sign up with, and a password stored only as a hash we cannot reverse. Nothing else is required to open an account.

Your business record

The business name, website domain, city, state and industry you enter. These are also the only facts the product is permitted to state about you in anything it generates.

Your tracked searches and their results

The questions you ask us to track, and the verbatim answers the AI engines gave, including the competitors they named instead of you, the sources they cited, and how you scored. This is the measurement record, and it is what the product exists to produce.

Your website content

If you host a site with us: the pages, sections, images and theme you create, plus any blog drafts written for you and whether you approved them.

Messages your visitors send you

If your hosted site has a contact form, the name, email, message and optional phone number each visitor submits, plus whether they asked to receive a text. These belong to you; we store and show them to you, and use them only for the automatic replies, review requests or opted-in texts you enable.

Where your visitors came from

Your hosted site counts visits — each once, on the page it started — by day and by where the visit came from (an AI assistant, a search engine, social media, another site or directly), with no cookies and no IP addresses. While a visitor has your site open, their browser tab remembers only the website that sent them (such as chatgpt.com) and the page they landed on. That note never leaves their device unless they send your contact form, in which case it is saved with their message so you can see which inquiries came from AI. The tab forgets it when it is closed.

What your inquiries were worth

If you mark an inquiry as having become a customer, you can add what the job was worth. It is yours, used only to show you your return, and never shared.

Messages sent on your behalf

If you turn them on, your site emails an automatic reply to people who send your contact form, and asks customers you mark as won for a Google review — every customer alike, never only the happy ones. Visitors may leave a phone number; we text it only if they ticked “OK to text me”, only about their message or a review, and never between 9pm and 8am their time. Every email has an unsubscribe link and every text says how to stop; once someone opts out, we keep a one-way fingerprint of their address, not the address, so they are never messaged again.

We do not sell your data, and we do not share it with anyone for advertising. We do not build a profile of you across other websites. We do not use advertising or cross-site tracking cookies. The app uses a sign-in cookie and, when you open a draft preview, a temporary preview cookie so the preview continues across pages. Some screens also use local browser storage for preferences and unfinished drafts. Customer-hosted sites use temporary browser storage to remember attribution for an inquiry; it is not sent to us unless the visitor submits the form.

We do not use your business data to train AI models. Your tracked searches are sent to the answer engines as questions, which is the entire product; they are not submitted as training material by us.

Running this product means other companies handle some of your data. Each one below is used for a specific job, and for nothing else:

• SupabaseDatabase, authentication, and file storage
• VercelApplication hosting, content delivery, and cookieless page analytics
• OpenAIAsking ChatGPT the tracked searches and recording its answers
• GoogleAsking Gemini and Google AI Overviews the tracked searches
• AnthropicAsking Claude the tracked searches, reading answers into structure, and writing blog drafts
• PerplexityAsking Perplexity the tracked searches
• SerpApiReading Google AI Overviews, which Google publishes no API for
• Google (Places, Business Profile, Search Console)Checking a business’s directory listing, reading and answering its Google reviews, and reading its search data — each only after the business connects that account
• ResendSending alert and digest emails to customers, and the emails a business sends its own customers (automatic replies, review requests)
• TwilioSending the text messages a business sends its own customers, only to numbers that consented on its site
• BrowserbaseTaking a screenshot of a customer’s existing website for the dashboard
• Meta, LinkedIn and XPublishing the social posts a business approves, to accounts the business connected
• StripeSubscription payments and billing
• BrowserbaseLoading public web pages for supported audits and screenshots
• SerpApiFinding public directory and search listing information
• TwilioSending opted-in text messages on a customer’s behalf
• MetaConnecting and publishing to Facebook or Instagram when a customer enables it
• LinkedInConnecting and publishing to LinkedIn when a customer enables it
• XConnecting and publishing to X when a customer enables it

When we ask an AI engine one of your tracked searches, the question and your business name go to that engine. That is unavoidable: asking is how the measurement works.

If you host a website with us and it has a contact form, the messages, contact details and optional phone numbers your visitors send are yours, not ours. We store them so you can read them and use them only for the automatic replies, review requests or opted-in texts you enable. You are the one responsible for telling your visitors how you handle what they send you.

Your measurement history is kept for as long as your account is open, because the value of it is the comparison over time. Deleting last quarter would destroy the thing you are paying for. Delete a business and its record, searches, answers and site go with it. Delete your account and everything goes.

You can export your raw measurement data from the dashboard on plans that include it, and you can delete any business, or your whole account, yourself at any time. Deletion is immediate and cascades: there is no soft-delete holding your data out of sight.

If you would rather we did it, or you want a copy of everything we hold, write to help@tryattention.ai.

Every row in our database is scoped to the account that owns it by database policy, not by application code. A bug in a page cannot show you someone else's data, because the database itself refuses. Passwords are hashed by our authentication provider and are never visible to us.

If this policy changes in a way that affects you, we will say so by email rather than quietly updating the date at the top.