Privacy Policy
Last updated: 2026-11-07 · DRAFT — pending legal review
This Privacy Policy explains how [Company Name] ("we", "us", "our") processes personal data when you use GEO.actor. We act as the data controller for your personal data.
Contact: gkadiysky@gmail.com
1. Data we collect
- Account data: email address, name (if provided), organisation name.
- Usage data: pages visited, features used, tracking run history, API calls.
- Brand data: website URLs, keywords, and content you add to the platform.
- Payment data: billing address, VAT number. Card details are processed by Stripe — we never store card numbers.
- Technical data: IP address, browser type, device type, error logs.
- Communications: messages you send us via the contact form or email.
2. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Platform services | Art. 6(1)(b) — performance of contract |
| Billing and payment processing | Art. 6(1)(b) — performance of contract |
| Security and fraud prevention | Art. 6(1)(f) — legitimate interests |
| Improving the Platform | Art. 6(1)(f) — legitimate interests |
| Sending service-related emails (magic links, alerts) | Art. 6(1)(b) — performance of contract |
| Sending marketing emails (product updates) | Art. 6(1)(a) — consent (opt-in) |
| Complying with legal obligations | Art. 6(1)(c) — legal obligation |
3. Data retention
- Account data: retained while your account is active, then 30 days after deletion request or cancellation.
- Tracking and brand data: retained for the duration of your subscription, then 30 days.
- Billing records: retained for 7 years to comply with tax and accounting obligations.
- Error logs: retained for 90 days.
- Outreach contact data: retained until suppressed or deleted, subject to GDPR Article 21 objection rights.
4. Sub-processors
We use the following sub-processors to deliver the Platform. Each has a signed Data Processing Agreement:
| Sub-processor | Purpose | Country |
|---|---|---|
| OpenAI | AI answer engine queries (Share of Model) | USA |
| Anthropic | AI answer engine queries (Share of Model) | USA |
| Perplexity | AI answer engine queries (Share of Model) | USA |
| AI answer engine queries; Google AI Overviews via DataForSEO | USA | |
| DataForSEO | SERP data, AI Overviews, backlink data | CY / global |
| Brave Search | Search index data | USA |
| Cloudflare | Edge network, CDN, Workers KV, R2 object storage | USA / EU |
| Neon | Postgres database hosting (EU region) | EU |
| Stripe | Payment processing and billing | USA / EU |
| Sentry | Error monitoring and performance tracking | USA |
Transfers to the USA rely on the EU-US Data Privacy Framework adequacy decision or Standard Contractual Clauses where applicable.
5. Your GDPR rights
Under the GDPR, you have the following rights:
- Access (Art. 15): Request a copy of personal data we hold about you.
- Rectification (Art. 16): Request correction of inaccurate data.
- Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
- Portability (Art. 20): Receive your data in a structured, machine-readable format.
- Objection (Art. 21): Object to processing based on legitimate interests, including direct marketing. Objections to direct marketing are always honoured immediately.
- Restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
6. How to exercise your rights
Email gkadiysky@gmail.com with the subject line "Data Subject Request". We respond within 30 days. Identity verification may be required. You also have the right to lodge a complaint with your local supervisory authority.
7. Cookies
We use only strictly necessary cookies. See the Cookie Notice for details.