Privacy Policy

Last updated: 2026-07-22 · Effective: 2026-07-22 · Version 2.0

1. Who we are and how to reach us

The Service is operated by Findrix Corp., a corporation organized under the laws of the State of Delaware, United States ("Findrix," "we," "us"). Registered agent for service of process: Corporate Consulting Ltd., 605 Geddes Street, Wilmington, Delaware 19805, USA.

For personal data you give us directly — your account details, marketing and support interactions, and how you use the Service — Findrix is the controller. For personal data contained in the material you submit or make available for processing (for example, content on the sites you connect and the results of the probes we run on your behalf), you are the controller and Findrix acts as a processor under your instructions; our Data Processing Addendum governs that relationship on plans where it applies.

Our data-protection contact is dpo@findrix.ai. Because Findrix is established outside the EU/UK but offers services to people there, we are appointing a representative under GDPR Article 27 and UK GDPR; its details will be published here once appointed, and in the meantime EU/UK data subjects can reach us at the address above.

2. What we process, and why — by situation

We describe our processing by the situation in which it happens. For each, we set out the data categories, the legal basis under GDPR Article 6 (where it applies to you), and the recipients. Retention is in Section 3 and sharing in Section 4.

2.1 When you visit our website

• Data: IP address, device and browser information, pages viewed, referrer, and — only where permitted for your region — analytics and advertising identifiers.
• Why / legal basis: to serve and secure the site (legitimate interest, Art. 6(1)(f)); to measure our own traffic and advertising (your consent in opt-in regions, Art. 6(1)(a); legitimate interest with an opt-out elsewhere).
• Recipients: our hosting, analytics, and advertising providers described in Section 4 and the Cookie Policy.

2.2 When you join a waitlist or request information

• Data: the email, name, website, and any details you submit; and, for prospect qualification, limited public business information (for example, a public professional profile).
• Why / legal basis: to respond to your request and follow up about the Service (steps taken at your request before a contract, Art. 6(1)(b); legitimate interest in business development, Art. 6(1)(f); consent where required for marketing email).
• Recipients: our email, scheduling, and internal notification providers in Section 4.

2.3 When you create an account and sign in

• Data: your email address; if you sign in with Google, the identity information Google returns (email, name, avatar); authentication tokens; and organization or role information you provide.
• Why / legal basis: to create and secure your account and provide the Service (performance of a contract, Art. 6(1)(b); legitimate interest in account security, Art. 6(1)(f)).
• Recipients: our authentication and database provider (Supabase) and, for Google sign-in, Google as the identity provider.

2.4 When you use the product

• Data: the URLs and domains you submit; content fetched from those sites (HTML, structured data, robots.txt, llms.txt, sitemaps) and page-performance metrics; the brand and topic information you provide; the generated queries we send to AI assistants and search engines and the answers they return; the recommendations, scores, and reports we produce; and, where you connect a site or platform, deployment configurations and logs.
• Why / legal basis: to deliver the Service you signed up for — running audits, tracking AI citations, generating recommendations, and deploying approved changes (performance of a contract, Art. 6(1)(b)). Where this data contains personal data on behalf of a customer, we act as processor on the customer's instructions.
• Recipients: the AI model providers listed in Section 4 and our workflow and storage providers. To measure brand visibility we also route public URLs and the market-research queries we generate through infrastructure suppliers that retrieve public web content; these receive no personal data. The generated queries, target domains, and (where needed) page content are sent to obtain a result; we do not send your billing or authentication data.

2.5 When you contact support or receive our email

• Data: your email address, message content, attachments, and ticket metadata; delivery and open events for transactional email.
• Why / legal basis: to respond and keep a record of the exchange (performance of a contract and legitimate interest in support quality and dispute defense, Art. 6(1)(b) and (f)); marketing email is sent on the basis of consent or, where permitted, a soft opt-in you can withdraw at any time.
• Recipients: our transactional-email provider (Resend); for scheduled calls on our lead funnel, our scheduling provider (Calendly).

2.6 When you pay

• Data: billing name, billing email, plan, and payment-method metadata. Card numbers are handled by our payment processor and are not stored on our servers.
• Why / legal basis: to take payment and meet tax and accounting obligations (performance of a contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c)).
• Recipients: our payment processor (Stripe, once paid billing is live).

2.7 Our internal operations

• Data: server and access logs, application audit logs, error and performance telemetry, aggregated usage metrics, and abuse and rate-limit signals.
• Why / legal basis: to keep the Service secure, reliable, and lawful, to prevent fraud and abuse, to debug, and to improve the product in aggregate (legitimate interest, Art. 6(1)(f); legal obligation where records are required, Art. 6(1)(c)).
• Recipients: our monitoring and infrastructure providers in Section 4.

3. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, then delete or de-identify it. Our per-data-class schedule:

Closing your account. You can close your account at any time from your settings. Closing it starts a 30-day grace period (cancellable before it ends) for export; after that, your account and Customer Content are deleted or de-identified on the schedule above. To erase everything we hold about you, including any de-identified history, email privacy@findrix.ai and we will complete the erasure within 30 days, except where the law requires us to keep a record (for example, invoices).

4. Who we share data with

We share data only with the sub-processors needed to deliver the Service, and only as necessary. Every one is named — with its service, region, data categories, and privacy policy — on our sub-processor list. In summary, they fall into these groups:

We never sell personal data, and we never use your data to train AI models. The AI providers we use process your data only to return a result to us; we select providers whose API terms do not train their models on data submitted through those APIs, and we do not enrol in any such program.

Advertising partners. Where permitted for your region, the advertising and attribution pixels on our marketing site — Meta, LinkedIn, OpenAI Ads, and FirstPromoter — receive usage data so we can measure our own campaigns, build retargeting audiences, and credit referrals. They act as independent controllers and may use this data for their own purposes. You can opt out at any time; see the Cookie Policy and the advertising section of the sub-processor list.

We disclose data to authorities only when required by valid legal process, and we may share data in connection with a merger, financing, or sale of assets, subject to this policy.

5. International transfers

Your account and audit data are stored primarily in the European Union (Supabase in Ireland; Vercel in Frankfurt). Some sub-processors — notably the AI model providers and certain analytics tools — operate in the United States or globally. When personal data is transferred out of the EEA, UK, or Switzerland, we rely on an appropriate safeguard: the EU-US Data Privacy Framework where the recipient is certified, the European Commission's Standard Contractual Clauses, and the UK Addendum and Swiss adequacy references as applicable. You can request details of the safeguards from dpo@findrix.ai.

6. Your rights

Depending on where you live, you have some or all of these rights over your personal data.

Under the GDPR / UK GDPR, you may access your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20), object to processing including direct marketing (Art. 21), and withdraw consent at any time (Art. 7). You may also lodge a complaint with your local supervisory authority (Art. 77).

Under the CCPA / CPRA (California), you may know what we collect, access and delete it, correct it, and opt out of "sharing" for cross-context behavioral advertising. We do not sell personal data for money, but our advertising pixels may count as "sharing": opt out with the "Do not sell or share my personal information" link in the footer, or enable the Global Privacy Control signal in your browser, which we honor automatically. We will not discriminate against you for exercising these rights.

To exercise any right, email privacy@findrix.ai. We respond within 30 days (extendable where the law allows) and may need to verify your identity first.

7. Automated decisions

Findrix does not use personal data to make decisions about you by automated means that produce legal or similarly significant effects on you, and does not carry out that kind of profiling (GDPR Article 22). The scores and recommendations the Service produces are informational outputs about websites and AI visibility, not automated decisions about individuals.

8. AI and your data

Measuring and improving AI visibility is what Findrix does, so it is worth being explicit: we do not use Customer Content, outputs, or other customer data to train, fine-tune, or develop any AI, machine-learning, or large-language model. We send only the generated queries and, where needed, page content required to obtain a result from the AI providers in Section 4, and we choose providers whose API terms do not train on that data.

9. Security

Technical and organizational measures include:

• Encryption in transit (TLS) and at rest (provider-managed AES-256);
• SSRF protection with address validation on all outbound fetches;
• An audit log of administrative actions;
• Scoped credentials for site deployments — no broad credentials stored;
• Rate limiting and bot mitigation; and
• A security contact at /.well-known/security.txt.

10. Children

Findrix is a business product and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@findrix.ai and we will delete it.

11. Cookies

We explain the cookies and similar technologies we use, and how consent works in your region, in our Cookie Policy.

12. Changes to this policy

We post material changes here at least 30 days before they take effect and notify account holders by email. The change history is available on request.

13. Contact

Privacy questions: privacy@findrix.ai
Data-protection contact: dpo@findrix.ai
EU/UK Article 27 representative: to be appointed — details will be published here.