Privacy Policy

Last updated: 2026-09-28 · Effective: 2026-07-22 · Version 2.0

1. Who we are and how to reach us

The Service is operated by Findrix Corp., a corporation organized under the laws of the State of Delaware, United States ("Findrix," "we," "us"). Registered agent for service of process: Corporate Consulting Ltd., 605 Geddes Street, Wilmington, Delaware 19805, USA.

For personal data you give us directly — your account details, marketing and support interactions, and how you use the Service — and for the publisher and author contact details described in Section 2.8, Findrix is the controller. For personal data contained in the material you submit or make available for processing (for example, content on the sites you connect and the results of the probes we run on your behalf), you are the controller and Findrix acts as a processor under your instructions; our Data Processing Addendum governs that relationship on plans where it applies.

Our data-protection contact is dpo@findrix.ai. Because Findrix is established outside the EU/UK but offers services to people there, we are appointing a representative under GDPR Article 27 and UK GDPR; its details will be published here once appointed, and in the meantime EU/UK data subjects can reach us at the address above.

2. What we process, and why — by situation

We describe our processing by the situation in which it happens. For each, we set out the data categories, the legal basis under GDPR Article 6 (where it applies to you), and the recipients. Retention is in Section 3 and sharing in Section 4.

2.1 When you visit our website

• Data: IP address, device and browser information, pages viewed, referrer, and — only where permitted for your region — analytics and advertising identifiers.
• Why / legal basis: to serve and secure the site (legitimate interest, Art. 6(1)(f)); to measure our own traffic and advertising (your consent in opt-in regions, Art. 6(1)(a); legitimate interest with an opt-out elsewhere).
• Recipients: our hosting, analytics, and advertising providers described in Section 4 and the Cookie Policy.

2.2 When you join a waitlist or request information

• Data: the email, name, website, and any details you submit; and, for prospect qualification, limited public business information (for example, a public professional profile).
• Why / legal basis: to respond to your request and follow up about the Service (steps taken at your request before a contract, Art. 6(1)(b); legitimate interest in business development, Art. 6(1)(f); consent where required for marketing email).
• Recipients: our email, scheduling, and internal notification providers in Section 4.

2.3 When you create an account and sign in

• Data: your email address; if you sign in with Google, the identity information Google returns (email, name, avatar); authentication tokens; and organization or role information you provide.
• Why / legal basis: to create and secure your account and provide the Service (performance of a contract, Art. 6(1)(b); legitimate interest in account security, Art. 6(1)(f)).
• Recipients: our authentication and database provider (Supabase) and, for Google sign-in, Google as the identity provider.

2.4 When you use the product

• Data: the URLs and domains you submit; content fetched from those sites (HTML, structured data, robots.txt, llms.txt, sitemaps) and page-performance metrics; the brand and topic information you provide; the generated queries we send to AI assistants and search engines and the answers they return; the recommendations, scores, and reports we produce; and, where you connect a site or platform, connection configurations and logs.
• Why / legal basis: to deliver the Service you signed up for — running audits, tracking AI citations, generating recommendations, and recording which changes you apply (performance of a contract, Art. 6(1)(b)). Where this data contains personal data on behalf of a customer, we act as processor on the customer's instructions. Contact details of publishers and authors are not covered by this: we handle them as controller, as described in Section 2.8.
• Recipients: the AI model providers listed in Section 4 and our workflow and storage providers. To measure brand visibility we also route public URLs and the market-research queries we generate through infrastructure suppliers that retrieve public web content; these receive no personal data. The generated queries, target domains, and (where needed) page content are sent to obtain a result; we do not send your billing or authentication data.

2.5 When you contact support or receive our email

• Data: your email address, message content, attachments, and ticket metadata; delivery and open events for transactional email.
• Why / legal basis: to respond and keep a record of the exchange (performance of a contract and legitimate interest in support quality and dispute defense, Art. 6(1)(b) and (f)); marketing email is sent on the basis of consent or, where permitted, a soft opt-in you can withdraw at any time.
• Recipients: our transactional-email provider (Resend); for scheduled calls on our lead funnel, our scheduling provider (Calendly).

2.6 When you pay

• Data: billing name, billing email, plan, and payment-method metadata. Card numbers are handled by our payment processor and are not stored on our servers.
• Why / legal basis: to take payment and meet tax and accounting obligations (performance of a contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c)).
• Recipients: our payment processor, Stripe. Payment details are entered on Stripe's own checkout and billing pages; we store only the identifiers Stripe gives us for your customer and subscription records.

2.7 Our internal operations

• Data: server and access logs, application audit logs, error and performance telemetry, aggregated usage metrics, and abuse and rate-limit signals.
• Why / legal basis: to keep the Service secure, reliable, and lawful, to prevent fraud and abuse, to debug, and to improve the product in aggregate (legitimate interest, Art. 6(1)(f); legal obligation where records are required, Art. 6(1)(c)).
• Recipients: our monitoring and infrastructure providers in Section 4.

2.8 Publisher and author contact data

To help customers get their brand mentioned on the publications that AI assistants cite, we look up how to reach those publications. This means we hold some personal data about people who are not our customers — authors, editors, and other staff of a publication. We decide why and how this data is collected and kept, so Findrix is the controller for it. This section is the notice we give under GDPR Article 14 to people whose details we did not get from them directly.

• Data: name, job title, professional email address, LinkedIn profile, and the publication's contact page.
• Source: the publication's own public web pages. We may later add a business contact-data provider (Hunter.io) as a second source; if we do, we will name it on our sub-processor list before the first lookup.
• Why / legal basis: to help a Findrix customer contact the publication about being featured or about correcting what it says (legitimate interest, Art. 6(1)(f)). We collect only professional contact details tied to a public role at the publication.
• Recipients: the Findrix customer working on a placement with that publication. The email address stays hidden until the customer chooses to reveal it. We do not sell this data or publish it.
• Your rights: you can object to this processing (Art. 21) or ask us to delete your details (Art. 17) by emailing privacy@findrix.ai. The other rights in Section 6 apply as well.

3. How long we keep data

We keep personal data for as long as it is needed for the purpose it was collected for. Some classes are deleted automatically on a fixed schedule; the rest are kept while your account exists and are removed when you ask us to remove them. The table says which is which, so you can see exactly what happens without asking.

Closing your account. You can close your account at any time from your settings. Closing it starts a 30-day grace period during which you can cancel the request; while the request is pending, the account is limited to cancelling it or signing out, so download any reports or exports you want to keep before you ask us to close it. After the 30 days your sign-in is removed, your email address is replaced with a non-identifying token, and the content of your support messages is scrubbed; the rest — audits, reports and AI-probe history — stays in that anonymized form. To erase everything we hold about you, including that history, email privacy@findrix.ai: we do this by hand and will complete it within 30 days, except where the law requires us to keep a record (for example, invoices).

4. Who we share data with

We share data only with the sub-processors needed to deliver the Service, and only as necessary. Every one is named — with its service, region, data categories, and privacy policy — on our sub-processor list. In summary, they fall into these groups:

We never sell personal data, and we never use your data to train AI models. The AI providers we use process your data only to return a result to us; we select providers whose API terms do not train their models on data submitted through those APIs, and we do not enrol in any such program.

Advertising partners. Where permitted for your region, the advertising and attribution pixels on our marketing site — Meta, LinkedIn, OpenAI Ads, and FirstPromoter — receive usage data so we can measure our own campaigns, build retargeting audiences, and credit referrals. They act as independent controllers and may use this data for their own purposes. You can opt out at any time; see the Cookie Policy and the advertising section of the sub-processor list.

We disclose data to authorities only when required by valid legal process, and we may share data in connection with a merger, financing, or sale of assets, subject to this policy.

5. International transfers

Your account and audit data are stored primarily in the European Union (Supabase in Ireland; Vercel in Frankfurt). Some sub-processors — notably the AI model providers and certain analytics tools — operate in the United States or globally. When personal data is transferred out of the EEA, UK, or Switzerland, we rely on an appropriate safeguard: the EU-US Data Privacy Framework where the recipient is certified, the European Commission's Standard Contractual Clauses, and the UK Addendum and Swiss adequacy references as applicable. You can request details of the safeguards from dpo@findrix.ai.

6. Your rights

Depending on where you live, you have some or all of these rights over your personal data.

Under the GDPR / UK GDPR, you may access your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20), object to processing including direct marketing (Art. 21), and withdraw consent at any time (Art. 7). You may also lodge a complaint with your local supervisory authority (Art. 77).

Under the CCPA / CPRA (California), you may know what we collect, access and delete it, correct it, and opt out of "sharing" for cross-context behavioral advertising. We do not sell personal data for money, but our advertising pixels may count as "sharing": opt out with the "Do not sell or share my personal information" link in the footer, or enable the Global Privacy Control signal in your browser, which we honor automatically. We will not discriminate against you for exercising these rights.

To exercise any right, email privacy@findrix.ai. We respond within 30 days (extendable where the law allows) and may need to verify your identity first.

7. Automated decisions

Findrix does not use personal data to make decisions about you by automated means that produce legal or similarly significant effects on you, and does not carry out that kind of profiling (GDPR Article 22). The scores and recommendations the Service produces are informational outputs about websites and AI visibility, not automated decisions about individuals.

8. AI and your data

Measuring and improving AI visibility is what Findrix does, so it is worth being explicit: we do not use Customer Content, outputs, or other customer data to train, fine-tune, or develop any AI, machine-learning, or large-language model. We send only the generated queries and, where needed, page content required to obtain a result from the AI providers in Section 4, and we choose providers whose API terms do not train on that data.

9. Security

Technical and organizational measures include:

• Encryption in transit (TLS) and at rest (provider-managed AES-256);
• SSRF protection with address validation on all outbound fetches;
• A durable record of staff access to customer accounts — every support session opened on your account is recorded with who, whom and when — with other administrative actions recorded in our application logs;
• Read-only, purpose-scoped credentials for any site connection. Where a provider issues a long-lived refresh credential (Google Analytics), it is stored encrypted and deleted when you disconnect;
• Rate limiting and bot mitigation; and
• A security contact at /.well-known/security.txt.

10. Children

Findrix is a business product and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@findrix.ai and we will delete it.

11. Cookies

We explain the cookies and similar technologies we use, and how consent works in your region, in our Cookie Policy.

12. Changes to this policy

We post material changes here at least 30 days before they take effect and notify account holders by email. The change history is available on request.

13. Contact

Privacy questions: privacy@findrix.ai
Data-protection contact: dpo@findrix.ai
EU/UK Article 27 representative: to be appointed — details will be published here.