In short
- We collect what we need to run your account, your checks and AI agent runs, and to bill you. We don't sell personal data or use it for advertising.
- Our checker reads only public pages and stores technical facts, not copies of pages.
- When you run an AI agent task, the model provider sees your task, public page text and masked screenshots. Neither we nor they use it to train models.
- You can export or delete your workspace and delete your account in the dashboard, or write to privacy@aiscovery.io.
Who we are
Aiscovery is run by Not set yet: legal entity name, registered in Not set yet: country of registration, at Not set yet: registered address ("we" or "us").
We decide how and why your personal data is used for accounts, billing, consent records, support, emails we send you and this website. In data protection terms, we are the controller for that data.
When a customer puts personal data into their workspace, for example by inviting a colleague, we process it for that customer under our Data Processing Addendum.
Privacy questions and requests: privacy@aiscovery.io. Not set yet: data protection officer, or none Not set yet: EU representative, or none Not set yet: UK representative, or none
What we collect on this website
You can read this website without telling us who you are. We collect personal data here only when you send us something or when our host handles your request.
- Demo request: your name, work email, store website, an optional note, the page you came from and the time. The website sends it straight to our team's private Telegram channel and doesn't store it.
- Launch partner application: your email, company, website, role, use case, the journey you want tested, your test environment, and optionally a timeline and security notes. It goes to the system our team uses to review applications.
- Free check: the website you enter and the result. To stop abuse, Cloudflare Turnstile checks that you're a person, and we keep a keyed hash of your IP address, never the address itself.
- Purchase form before checkout: your email, website, an optional key page, company, business type, your browser's time zone, the plan, and your agreement to our checks, with a keyed hash of your IP address. If you tick "Remind me once", we also record that choice.
- Request details: our host, Vercel, processes your IP address, browser and the page you asked for to deliver and protect the site.
- Analytics, only when turned on: counts of page views and page speed, without cookies. See our Cookie Notice.
- Your cookie choice: when you answer our cookie banner, your browser keeps the answer in one cookie. It holds no ID, and we don't keep a copy. See our Cookie Notice.
- Visit replays, only when turned on and only if you accept analytics: Microsoft Clarity captures clicks, scrolling, mouse movement and the page as you see it, with your IP address, browser and device and a random ID in a cookie, so we can play visits back and see heatmaps. Our forms are masked so what you type stays in your browser. See our Cookie Notice.
- Google Analytics, only if you accept analytics cookies in our cookie banner: the pages you visit, where you came from (such as a search engine or a campaign link), your browser, device and approximate location, a random ID in a cookie, and clicks on buttons such as Request a demo. Google uses your IP address to estimate your location and doesn't store it. If you don't accept, we don't load Google Analytics. See our Cookie Notice.
What we collect in the product
- Account: your name, work email, a hash of your password (never the password itself) and whether your email is verified.
- Sign-in sessions: your IP address and browser, to keep your account secure.
- Workspace and team: the workspace name, the websites you add, team roles, invitations (the invitee's email), your fix notes and settings.
- Consent records: when someone turns on automatic checks, the website, the version and fingerprint of the text they agreed to, the time, who agreed, and a keyed hash of their IP address. These prove who allowed the checks.
- Billing: your Stripe customer and subscription IDs, plan, payment status and invoice references. Stripe handles your card; we never see card details.
- Site check results: technical facts from public pages, such as status codes, redirects, robots.txt rules, page titles and descriptions, structured data types, file fingerprints and timings. We don't keep copies of your pages, cookies or full headers.
- AI agent runs: the task, a step log of what the agent did (actions, verdicts and page paths, never what it typed), the verdict and masked step screenshots.
- Ask Aiscovery: your questions, the answers, and the results from your workspace used to answer them.
- Emails we send you: who we sent each email to, its type and whether it was delivered.
- Support: your messages and the workspace, website and check IDs the dashboard attaches when you contact us.
People named on websites we check
Public pages can contain personal data, such as a name on an About page. Our checker reads only public pages, and it stores the limited facts listed above, so a name can appear only if it is part of a page title or description.
Website owners who don't want our checker or our agents to read their site can block them in robots.txt or email abuse@aiscovery.io. We honor that for every customer. Our checker page explains how.
AI models and your data
Site checks call no AI model. When you run an AI agent task, the agent's model provider receives your task instructions, text from public pages of your store, page addresses and, for agents that use a screen, masked step screenshots. Ask Aiscovery sends your question and the results it needs to OpenAI. Our Sub-processors page names each provider and what it receives.
Before a screenshot reaches a model or our storage, we hide form fields, embedded frames and text that looks like an email address, phone number, card, account or order number. If we can't confirm the mask worked, we drop the screenshot.
We don't use your data to train AI models, and we use the providers' business APIs, whose terms don't let them train on our requests.
AI agents and Ask Aiscovery don't make decisions about people. They test websites and answer questions about results, and they can be wrong. See our Terms of Service.
Why we use your data
Where data protection law asks for a legal basis, these are the ones we rely on:
| What we do | Legal basis |
|---|---|
| Run your account, workspace, checks, agent runs, Ask Aiscovery and support | Our contract with you, or with your employer |
| Take payments, issue invoices and keep billing records | Our contract, and our legal duties under tax and accounting law |
| Keep consent records that prove who allowed checks | Our legitimate interest in showing that checks were authorized, and in defending legal claims |
| Keep accounts and the service secure, stop abuse and fraud | Our legitimate interest in a safe service |
| Answer demo requests, partner applications and free checks | Steps you ask us to take before a contract, and our legitimate interest in replying |
| Send the one reminder you can ask for on the purchase form | Your consent, which you can withdraw by writing to privacy@aiscovery.io |
| Measure how the website is used, without cookies | Our legitimate interest in improving the website |
| Count visits, where they come from and demo requests with Google Analytics, and play back visits and see heatmaps with Microsoft Clarity, to fix confusing pages | Your consent, given in our cookie banner. You can withdraw it any time under Cookie settings at the bottom of every page. |
We send service emails, such as sign-in links, results and billing notices, because they are part of the service. We don't send marketing emails. The only reminder we send is the one you can ask for on the purchase form: one email if you don't finish checkout.
International transfers
Some of our providers process data outside your country, including in the United States. Where the law requires it, we protect those transfers with safeguards such as the European Commission's standard contractual clauses. Write to privacy@aiscovery.io for details.
How long we keep data
| Data | How long |
|---|---|
| Account | Until you delete your account. Sign-in sessions end after 7 days. |
| Workspace, websites, results, fixes, reports, consent records, step logs, emails sent and support messages | While you subscribe, then 12 months after your plan ends, so you can still read and export them. Then we delete the workspace. Deleting the workspace yourself removes it sooner. |
| Raw page evidence from checks | 90 days |
| Step screenshots from agent runs | 30 days on a paid plan, 7 days otherwise |
| Ask Aiscovery conversations | 30 days. Then they are hidden and deleted the next time you open your history, or with your workspace. You can delete one sooner. |
| Sign-in, invitation and password emails | The link and content are wiped once used or expired, and the record is deleted 14 days later. |
| Purchase forms | Kept as the record of your order and of what you agreed to. We don't yet delete forms that never led to a payment automatically; ask us and we delete yours. |
| Billing records | At least as long as tax and accounting law requires. |
| Free checks | The result page works for 7 days. Then we erase the IP hash and the claim code, and keep the website and result as a record of the check. |
| Demo requests | In our Telegram channel for up to 12 months, then deleted. |
| Google Analytics data | 14 months. Its cookies last up to 13 months, and we ask about analytics again after 6 months. |
Your rights
Depending on the law that applies to you, you can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to get a copy in a portable format. Where we rely on your consent, you can withdraw it at any time.
In the dashboard, a workspace owner can export the workspace and delete it, and each person can delete their own account. For anything else, write to privacy@aiscovery.io. We reply within 1 business day and complete requests within one month.
If we process your data for one of our customers, for example because a colleague invited you, we pass your request to that customer and help them answer it.
You can also complain to the data protection authority where you live or work. We'd like the chance to help first.
Security
Each workspace is isolated in our database with row-level security, our services use the least access they need, and data travels encrypted with TLS. IP addresses in consent records and free checks are stored only as keyed hashes. Our Security page has more.
No system is perfectly secure. If a breach puts your personal data at risk, we tell you and the authorities as the law requires.
Children
Aiscovery is a service for businesses. It isn't meant for children, and we don't knowingly collect their personal data.
Changes to this notice
When this notice changes, we update the date at the top. Before a change that matters to customers, such as a new kind of data or a new provider, we email workspace owners and admins.